AZ-204 Practice Exam 57 — 20 Questions

Question 1

Refer to the exhibit. You run this KQL query in Azure Resource Graph Explorer. The query returns no results. What is the most likely reason?

Accepted Answer

The resource type is incorrect; it should be 'microsoft.insights/components' in lowercase.. The KQL query uses the resource type 'Microsoft.Insights/Components' with mixed case, but Azure Resource Graph Explorer requires resource types to be specified in all lowercase. The correct type is 'microsoft.insights/components'. When the case does not match, the query returns no results because Azure Resource Graph performs a case-sensitive match on the 'type' property.

Answer

The 'contains' operator is case-sensitive.

Answer

The query must specify a subscription filter.

Answer

The 'where' clause must use '== ' instead of '=='.

Question 2

You need to store billions of small log entries (each ~200 bytes) generated from multiple IoT devices. The logs are written in chronological order and are rarely updated. You need to run queries that scan large ranges of data by timestamp each day. You want to maximize write throughput and minimize storage costs. Which Azure Storage solution should you choose?

Accepted Answer

Azure Table Storage with a partition key combining device ID and date, and row key as timestamp.. Azure Table Storage is ideal for this scenario because it supports high-volume, low-cost storage of structured log data with efficient range queries. By using a partition key of device ID combined with date, you distribute writes across partitions for high throughput, while the row key as timestamp enables fast, server-side range scans over chronological data without the overhead of a separate index.

Answer

Azure Cosmos DB SQL API with a collection partitioned by timestamp.

Answer

Azure Blob Storage with append blobs and a custom index for timestamp queries.

Answer

Azure SQL Database with a clustered columnstore index.

Question 3

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. The `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 4

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Accepted Answer

rate-limit policy. The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.

Answer

xml-to-json policy

Answer

cache-lookup policy

Question 5

You are developing an ASP.NET Core web API that is hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You want to avoid storing any credentials in the application code or configuration. Which approach should you use?

Accepted Answer

Enable the system-assigned managed identity for the App Service and configure Key Vault access policies to allow that identity.. Enabling a system-assigned managed identity for the App Service allows it to authenticate to Azure Key Vault without any credentials stored in code or configuration. The managed identity is automatically managed by Azure AD (now Microsoft Entra ID) and can be granted access to Key Vault secrets via access policies, eliminating the need for client IDs, client secrets, or connection strings.

Answer

Use the Key Vault SDK with a client ID and client secret stored in App Service application settings.

Answer

Use Microsoft Entra ID application roles to assign the App Service a role that allows reading secrets.

Answer

Store the Key Vault URL and a connection string with the secret in the application's app.config file.

Question 6

A checkout API uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the authentication provider at the App Service platform level. This ensures that the HTTP trigger function only receives requests with valid tokens, without requiring custom authorization logic in the function code.

Answer

Deployment slots

Answer

Application Insights sampling

Answer

Function timeout

Question 7

You have an Azure App Service web app that experiences fluctuating traffic. During peak hours, the CPU usage reaches 90% and response times increase. You want to automatically scale out the number of instances when CPU usage exceeds 75% and scale in when it drops below 25%. The scaling should be gradual to avoid thrashing. Which configuration should you use?

Accepted Answer

Configure autoscale rules on the App Service plan scale-out setting, using CPU percentage as the metric with appropriate thresholds and cool-down periods.. Azure App Service autoscale rules allow you to scale out (increase instance count) when CPU percentage exceeds 75% and scale in (decrease instance count) when it drops below 25%, with configurable cool-down periods (e.g., 5–10 minutes) to prevent thrashing. This directly addresses the fluctuating traffic pattern and gradual scaling requirement using the App Service plan's scale-out blade.

Answer

Enable 'Always On' and configure manual scale based on scheduled times.

Answer

Use Azure Functions with the Consumption Plan to handle the web app logic.

Answer

Deploy the web app to Azure Container Instances and use the scale-on-CPU feature.

Question 8

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

Accepted Answer

Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.. It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.

Answer

Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

Answer

Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

Question 9

External partners are given Shared Access Signatures to upload product images to a specific Blob Storage container named 'images'. A partner reports accidentally uploading files to the 'contracts' container, which should not be accessible. What is the most likely configuration mistake?

Accepted Answer

The SAS was generated at the storage account level, granting write access that applies to multiple containers rather than being scoped to the 'images' container only. A SAS generated at the storage account level grants permissions across all containers within that account. When the SAS URI includes only the account endpoint (e.g., https://.blob.core.windows.net/) and a set of permissions (like write), the token can be used to access any container, including 'contracts'. To restrict access to a single container, the SAS must be scoped to the container resource URI (e.g., https://.blob.core.windows.net/images) and the signed resource type must be 'c' (container) or 'b' (blob), not 's' (service).

Answer

The SAS expiry time is too long, giving partners time to discover and access other containers

Answer

The partner used a storage account key instead of the provided SAS token

Answer

The SAS was signed with a stored access policy that did not name the correct container

Question 10

You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?

Accepted Answer

Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.. Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.

Answer

Configure Azure Front Door to terminate SSL and forward traffic to App Service.

Answer

Use an App Service Managed Certificate for the custom domain.

Answer

Export the certificate from Key Vault as a PFX file and upload it to App Service.

Question 11

A company deploys an Azure App Service web app that stores sensitive data in Azure Blob Storage. The security team requires that all access to the blob storage must be authenticated and authorized via Microsoft Entra ID, and that no anonymous access is permitted. The web app must also be able to access the storage using its managed identity. Which configuration should the company implement?

Accepted Answer

Enable the web app's system-assigned managed identity, assign the Storage Blob Data Contributor role to the identity, and disable anonymous access on the storage account.. It satisfies all requirements: enabling a system-assigned managed identity for the web app allows it to authenticate to Azure Blob Storage without storing credentials, assigning the Storage Blob Data Contributor RBAC role authorizes that identity to read/write blobs, and disabling anonymous access ensures no unauthenticated requests are permitted. This configuration enforces Microsoft Entra ID (formerly Azure AD) as the sole authentication mechanism, meeting the security team's mandate.

Answer

Create a custom RBAC role that allows full access to the storage account and assign it to the web app's service principal.

Answer

Use storage account access keys and store them in Key Vault, then configure the web app to retrieve them at runtime.

Answer

Generate a shared access signature (SAS) token with read permissions, store it in App Settings, and configure the web app to use it.

Question 12

You need to grant a user access to read and write blobs in a specific container for exactly 24 hours. The user is external to your organization. Which two methods can you use? (Choose two.)

Accepted Answer

Create a shared access signature (SAS) token with an expiry time of 24 hours. A shared access signature (SAS) token can be scoped to a specific container and granted read and write permissions, with an expiry time set to exactly 24 hours. This allows the external user to access only that container for the specified duration without exposing the storage account key or requiring Azure AD authentication.

Answer

Share the storage account access key with the user

Answer

Create an account SAS token with read and write permissions

Answer

Assign the 'Storage Blob Data Contributor' role to the user's Microsoft account

Question 13

Arrange the steps to implement Azure AD authentication in an ASP.NET Core web app in the correct order.

Accepted Answer

Register app in Azure AD → Configure settings in appsettings.json → Add Microsoft.Identity.Web NuGet package → Configure middleware in Startup.cs → Secure endpoints with [Authorize] attribute. First register the app in Azure AD, then configure settings, add NuGet, configure middleware, and secure endpoints.

Answer

Add Microsoft.Identity.Web NuGet package → Register app in Azure AD → Configure settings in appsettings.json → Configure middleware in Startup.cs → Secure endpoints with [Authorize] attribute

Answer

Configure middleware in Startup.cs → Register app in Azure AD → Add Microsoft.Identity.Web NuGet package → Configure settings in appsettings.json → Secure endpoints with [Authorize] attribute

Answer

Secure endpoints with [Authorize] attribute → Register app in Azure AD → Configure settings in appsettings.json → Add Microsoft.Identity.Web NuGet package → Configure middleware in Startup.cs

Question 14

You need to store a large (terabytes) append-only dataset for compliance purposes. The data must be immutable to prevent tampering after writes. You also want to minimize storage cost and achieve high write throughput. Which Azure Storage solution should you use?

Accepted Answer

Azure Blob Storage with Append Blobs and an immutable blob policy. Azure Blob Storage with Append Blobs and an immutable blob policy is correct because Append Blobs are optimized for append-only operations (e.g., logging, audit trails) and support high write throughput. Immutable blob policies (WORM – Write Once, Read Many) enforce data immutability at the blob level, preventing modification or deletion during the retention period, which meets compliance requirements. This combination minimizes storage cost by using the cool or archive tier for Append Blobs, while still achieving the required write performance.

Answer

Azure Data Lake Storage Gen2 with Append Blobs and immutability

Answer

Azure Files with immutable shares

Answer

Azure NetApp Files with immutability

Question 15

An application calls a Event Grid event stream through HTTP. The developer must implement retries without overwhelming the remote system during partial outages. Which retry pattern is best?

Accepted Answer

Exponential backoff with jitter and a maximum retry limit. Exponential backoff with jitter and a maximum retry limit is the best pattern because it prevents overwhelming the Event Grid endpoint during partial outages by progressively increasing wait times between retries, while jitter randomizes those intervals to avoid thundering herd problems. The maximum retry limit ensures the system does not retry indefinitely, aligning with Event Grid's own retry policy (which uses exponential backoff up to 30 minutes and a max of 30 retries for HTTP 5xx errors). This balances resilience with resource protection.

Answer

Immediate infinite retries

Answer

Retry only after restarting the application

Answer

Disable all timeout settings

Question 16

You have an order processing system using Azure Service Bus. Each order generates multiple messages that must be processed in order and by the same consumer. Which Service Bus feature ensures this?

Accepted Answer

Message sessions. Message sessions in Azure Service Bus enable ordered, sequential processing of related messages by a single consumer. When messages belong to the same session, they are guaranteed to be delivered in order and are locked to a single consumer until the session is complete, ensuring that all messages for a given order are processed by the same consumer without interleaving.

Answer

Topics and subscriptions

Answer

Dead-letter queues

Answer

Auto-forwarding

Question 17

An Azure Functions IoT command API must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used?

Accepted Answer

Premium plan. The Premium plan (Elastic Premium EP) is the correct choice because it supports VNet integration for accessing resources inside a virtual network, allows execution durations up to 30 minutes (the Consumption plan caps at 10 minutes by default), and provides serverless scaling without requiring you to manage virtual machines. This plan also offers always-ready instances to reduce cold start latency, which is critical for IoT command APIs.

Answer

Azure Batch pool

Answer

Consumption plan

Answer

App Service Free tier

Question 18

You are deploying a sensitive configuration to Azure Container Instances. The configuration must be encrypted at rest and not visible in the container logs. What should you use?

Accepted Answer

Azure Key Vault with managed identity and secret volumes. Azure Key Vault with managed identity and secret volumes is the correct choice because it allows you to mount secrets as files into the container without exposing them in environment variables or logs. The secrets are encrypted at rest in Key Vault and are only accessible via a managed identity assigned to the container group, ensuring the configuration remains secure and invisible in container logs.

Answer

Environment variables in the container group

Answer

Azure Files volume mounted into the container

Answer

ConfigMap in a Kubernetes cluster

Question 19

You need to store terabytes of archival data that must be retained for 10 years. The data is accessed once or twice per year. You need to minimize storage costs. Which Azure Storage tier should you use?

Accepted Answer

Archive. The Archive tier is designed for data that is rarely accessed (a few times per year or less) and has a flexible retrieval latency of several hours, making it ideal for long-term retention of terabytes of archival data for 10 years at the lowest storage cost. It offers the lowest per-GB storage price among Azure Blob Storage tiers, directly meeting the requirement to minimize costs for infrequently accessed data.

Answer

Cool

Answer

Hot

Answer

Premium

Question 20

A web app for a webhook processor needs separate staging and production environments. The team must warm up the new version before swapping traffic. Which App Service feature should be used?

Accepted Answer

Deployment slots. Deployment slots are the correct feature because they enable separate staging and production environments within the same App Service plan, allowing you to warm up the new version in a staging slot before performing a zero-downtime swap with the production slot. This directly supports the requirement for traffic swapping after warm-up, which is a core capability of slot-swapping in Azure App Service.

Answer

Backup and restore

Answer

App Service access restrictions

Answer

Always On only