AZ-204 Practice Exam 56 — 20 Questions

Question 1

You need to upload a large file (10 GB) to Azure Blob Storage with the ability to pause and resume the upload. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload block blobs in parallel. Uploading a large file (10 GB) to Azure Blob Storage with pause/resume capability requires breaking the file into blocks and uploading them in parallel using the Azure Storage SDK. The SDK supports block blob operations, allowing you to track progress, retry failed blocks, and resume from the last committed block. A single Put Blob operation cannot handle files larger than 5 GB, and neither the Azure Portal nor AzCopy with /SyncCopy provides programmatic pause/resume control.

Answer

Use a single Put Blob operation

Answer

Use the Azure Portal to upload the file

Answer

Use AzCopy with the /SyncCopy parameter

Question 2

You are debugging a performance issue in a live web application monitored by Application Insights. You need to see real-time metrics such as request rate, response times, and any exceptions as they occur, without waiting for the usual telemetry pipeline. Which Application Insights feature should you use?

Accepted Answer

Live Metrics Stream. Live Metrics Stream (option B) is the correct feature because it provides real-time, low-latency telemetry directly from the Application Insights SDK, bypassing the usual ingestion pipeline. This allows you to monitor request rate, response times, and exceptions as they occur, which is exactly what the scenario requires for debugging a live performance issue without waiting for data to be processed.

Answer

Application Insights Analytics (Log Analytics)

Answer

Metrics Explorer

Answer

Application Insights Profiler

Question 3

Which TWO Azure services can be used to implement a pub/sub messaging pattern?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics supports a publish/subscribe pattern through its topic and subscription model. Publishers send messages to a topic, and multiple subscriptions can independently receive copies of each message, enabling fan-out delivery to multiple consumers. This is the core pub/sub mechanism in Azure Service Bus.

Answer

Azure Blob Storage

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 4

Which TWO Azure services can be used to implement a publish-subscribe messaging pattern?

Accepted Answer

Azure Event Grid. Azure Service Bus Topics (Option D) natively implement a publish-subscribe pattern by allowing multiple subscriptions to receive copies of messages sent to a topic. Azure Event Grid (Option B) is a fully managed event routing service that uses a publish-subscribe model, where publishers send events and subscribers handle them via webhooks or Azure services. Both support decoupled communication with multiple receivers.

Answer

Azure Queue Storage

Answer

Azure Notification Hubs

Answer

Azure Event Hubs

Question 5

You are using Azure CLI to upload a blob using your Azure AD credentials (--auth-mode login). The command fails with an authorization error. What is the most likely cause?

Accepted Answer

The user does not have the 'Storage Blob Data Contributor' role on the storage account. When using `--auth-mode login` with Azure CLI, the operation relies on Azure AD role-based access control (RBAC). The user must be assigned a built-in role like 'Storage Blob Data Contributor' or 'Storage Blob Data Owner' on the storage account to authorize blob uploads. Without this role, the request fails with an authorization error because Azure AD has no permissions to grant access to the blob data plane.

Answer

The Azure CLI version is outdated

Answer

The storage account key is not provided

Answer

The container name does not exist

Question 6

A company uses Azure Logic Apps to integrate with a third-party SaaS application. The Logic App must send an HTTP request to the SaaS API and handle pagination. Which connector should be used?

Accepted Answer

HTTP. The HTTP connector is the correct choice because it allows the Logic App to send a raw HTTP request to any REST API and handle pagination manually by inspecting response headers (e.g., 'nextLink') or body properties. Unlike other connectors, it provides full control over request/response cycles, enabling custom pagination logic without relying on a predefined API schema.

Answer

API Connection

Answer

HTTP + Swagger

Answer

HTTP Webhook

Question 7

You are using Azure API Management to expose a legacy SOAP API as a RESTful API. The SOAP API has complex XML schemas. You need to transform the SOAP response to JSON. Which policy should you use?

Accepted Answer

set-body. The `set-body` policy is correct because it allows you to replace the body of the SOAP response with a JSON representation. In Azure API Management, you can use the `set-body` policy with a Liquid template or a .NET expression to transform the incoming XML SOAP response into JSON, effectively converting the complex XML schemas to a RESTful JSON output.

Answer

transform-body

Answer

return-response

Answer

convert-to-json

Question 8

You are designing a solution that processes orders from an e-commerce website. The solution must guarantee that each order is processed exactly once. Which TWO Azure services can you use to achieve this requirement?

Accepted Answer

Azure Service Bus. Azure Service Bus supports sessions and message deferral, which enable exactly-once processing by ensuring that a message is not removed from the queue until the consumer explicitly completes it after successful processing. If the consumer fails, the message becomes visible again, preventing duplicate processing. This guarantee is achieved through the Peek-Lock receive mode and the use of duplicate detection, which automatically discards duplicate messages within a defined time window.

Answer

Azure Storage Queues

Answer

Azure Event Grid

Answer

Azure Cache for Redis

Question 9

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

Accepted Answer

The storage account is behind a firewall and the Cognitive Search service IP is not allowed.. When a storage account is protected by a firewall, Azure Cognitive Search's indexer must be granted explicit network access. Even if the connection string is correct, the indexer's outbound requests will be blocked unless the storage account's firewall rules include the IP address or subnet of the Cognitive Search service. This is a common misconfiguration that results in 'Data source credentials are invalid' errors despite valid credentials.

Answer

The Cognitive Search service is in a different region than the storage account.

Answer

The Cognitive Search service's admin key is missing.

Answer

The indexer configuration is missing the storage account key.

Question 10

You need to call a third-party REST API from your Azure Function app. The API requires an API key in the header. Where should you store the API key to keep it secure?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like API keys, with access control via Azure AD and automatic rotation capabilities. The Function app can securely retrieve the key at runtime using a managed identity, avoiding hardcoding or exposing the secret in configuration files or environment variables.

Answer

Environment variable in the hosting plan

Answer

Connection string in the Function app

Answer

App settings in the Function app configuration

Question 11

Your app uses Azure Key Vault to store secrets. You need to grant the app access to read secrets using managed identity. Which RBAC role should you assign to the app's managed identity?

Accepted Answer

Key Vault Secrets User. The Key Vault Secrets User role (D) is the correct RBAC role because it grants the managed identity permission to perform read operations on secrets, specifically 'Microsoft.KeyVault/vaults/secrets/read' and 'Microsoft.KeyVault/vaults/secrets/getSecret/action'. This aligns with the requirement to read secrets using managed identity without granting broader management or cryptographic key permissions.

Answer

Key Vault Crypto Officer

Answer

Key Vault Reader

Answer

Key Vault Contributor

Question 12

You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?

Accepted Answer

DefaultAzureCredential. DefaultAzureCredential is the correct choice because it automatically chains multiple authentication sources, including managed identity, environment variables, and Visual Studio credentials. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will first attempt to authenticate using the managed identity endpoint, making it the most seamless and recommended approach for this scenario.

Answer

SharedAccessSignatureCredential

Answer

InteractiveBrowserCredential

Answer

ClientSecretCredential

Question 13

Your company runs a batch processing job on Azure Batch. The job processes large datasets and requires access to Azure Storage. You need to ensure that the compute nodes can securely access the storage account without exposing credentials. What should you configure?

Accepted Answer

Managed identity for the Batch pool. Managed identities for Azure resources allow compute nodes to authenticate to Azure Storage without storing credentials. Option A is wrong because Azure AD service principals require managing credentials and are not the simplest approach for Batch compute nodes to access storage. Option B is wrong because storage account access keys are shared secrets that should not be exposed. Option D is wrong because shared access signatures (SAS) tokens can be exposed and need to be managed.

Answer

Azure AD service principal

Answer

Storage account access keys

Answer

Shared access signatures (SAS)

Question 14

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The API needs to call a downstream API (also secured by Microsoft Entra ID) on behalf of the signed-in user (On-Behalf-Of flow). You have already configured the web API to authenticate users with Microsoft.Identity.Web. How should you implement the token acquisition for the downstream API?

Accepted Answer

Inject `ITokenAcquisition` and call `GetAccessTokenForUserAsync` with the scopes for the downstream API. Microsoft.Identity.Web provides the `ITokenAcquisition` service specifically for ASP.NET Core applications to acquire tokens for downstream APIs using the OAuth 2.0 On-Behalf-Of flow. Calling `GetAccessTokenForUserAsync` with the required scopes handles the token exchange automatically, leveraging the incoming user token and client credentials configured in the app. This is the recommended approach when using Microsoft.Identity.Web, as it abstracts the complexity of the OBO flow and integrates seamlessly with the ASP.NET Core authentication pipeline.

Answer

Use ADAL.NET's `AcquireTokenOnBehalfOf` method

Answer

Use the `Azure.Identity` library with `DefaultAzureCredential` to acquire a token

Answer

Manually construct an HTTP POST to the Microsoft Entra ID token endpoint with the user access token and client credentials

Question 15

You are deploying a background processing job that reads messages from an Azure Storage Queue. The job must run on the same compute resources as the main web application and must not require additional deployment or monitoring overhead. Which solution should you use?

Accepted Answer

Add an Azure WebJob to the App Service that hosts the main application.. Azure WebJobs run in the same App Service plan as the main web application, sharing compute resources without requiring separate deployment or monitoring. A WebJob with a continuous trigger can read from an Azure Storage Queue using the QueueTrigger attribute, meeting the requirement of no additional overhead.

Answer

Deploy an Azure Function with a Queue trigger on the Consumption plan.

Answer

Create a separate Azure Container Instance to run a continuous job.

Answer

Use Azure Logic Apps with a recurrence trigger to poll the queue.

Question 16

Your application runs on Azure Kubernetes Service (AKS). It needs to access Azure Key Vault secrets. You want to avoid using a service principal. Which solution should you implement?

Accepted Answer

Deploy the Secrets Store CSI Driver with workload identity. The Secrets Store CSI Driver with workload identity allows your AKS pods to securely access Azure Key Vault secrets without managing a separate service principal. Workload identity uses Azure AD pod-managed identities or federated identity credentials to authenticate directly to Key Vault, eliminating the need for explicit service principal credentials.

Answer

Mount secrets as a ConfigMap from Key Vault

Answer

Create a service principal and assign it to the AKS cluster

Answer

Use a Helm chart to inject secrets

Question 17

You are designing a solution to store large amounts of structured data that is accessed frequently and requires low-latency reads. The data must be globally distributed and support automatic failover. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and automatic failover.. Azure Cosmos DB with multi-region writes and automatic failover is the correct choice because it provides globally distributed, low-latency reads and writes with automatic failover at the database level. It supports multiple consistency models and guarantees single-digit millisecond read latencies, making it ideal for frequently accessed structured data that requires global distribution and high availability.

Answer

Azure Table Storage with geo-replication.

Answer

Azure SQL Database with active geo-replication and failover groups.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS).

Question 18

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to automatically scale individual microservices based on custom metrics (e.g., queue depth). Which feature should they use?

Accepted Answer

Horizontal Pod Autoscaler. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a deployment or replica set based on observed metrics, including custom metrics like queue depth. HPA queries the Kubernetes Metrics API, which can be extended with custom metrics adapters (e.g., Prometheus Adapter) to support application-specific metrics, enabling fine-grained scaling for each microservice.

Answer

Virtual Node

Answer

Vertical Pod Autoscaler

Answer

Cluster Autoscaler

Question 19

You need to grant a user the ability to read and write blobs in a specific container for 24 hours. The solution must use delegated access without exposing the storage account key. What should you use?

Accepted Answer

User delegation shared access signature (SAS). A user delegation SAS is secured with Azure AD credentials and is the only SAS type that uses delegated authorization without exposing the storage account key. It allows you to grant granular, time-limited access (e.g., 24 hours) to a specific container for read and write operations, meeting the requirement exactly.

Answer

Storage account access key

Answer

Account shared access signature (SAS)

Answer

Service shared access signature (SAS)

Question 20

You are developing a solution that uses Azure Functions to process events from Azure Event Grid. The function must handle events reliably. Which TWO options should you implement?

Accepted Answer

Enable retry policy on the Event Grid subscription.. Event Grid subscriptions support automatic retry policies that can be configured to retry event delivery on transient failures, ensuring reliable processing. Option D is correct because a dead-letter destination (e.g., a storage blob) captures events that cannot be delivered after exhausting retries, preventing data loss and enabling later analysis.

Answer

Use Durable Functions for orchestration.

Answer

Implement manual checkpointing in the function code.

Answer

Use a queue trigger instead of an Event Grid trigger.