AZ-204 Practice Exam 58 — 20 Questions

Question 1

You are deploying a containerized application to Azure Container Instances (ACI). The application writes temporary data to a local disk that must persist across container restarts (e.g., after a crash). Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mount an Azure Files share as a volume in the container group.. Azure Container Instances (ACI) supports mounting an Azure Files share as a persistent volume. When a container restarts (e.g., after a crash), the temporary disk is wiped, but data written to an Azure Files share persists independently of the container's lifecycle. This meets the requirement for data to survive container restarts.

Answer

Use the temporary disk automatically allocated by ACI.

Answer

Store data in an Azure Cosmos DB database.

Answer

Use an emptyDir volume as available in Kubernetes.

Question 2

An application calls a third-party shipping API through HTTP. The developer must implement retries without overwhelming the remote system during partial outages. Which retry pattern is best?

Accepted Answer

Exponential backoff with jitter and a maximum retry limit. Exponential backoff with jitter and a maximum retry limit is the best pattern because it progressively increases the delay between retries, preventing the client from overwhelming the third-party shipping API during partial outages. Jitter randomizes the delay to avoid thundering herd problems where multiple clients retry simultaneously, and the maximum retry limit ensures the system does not retry indefinitely, preserving resources and allowing for graceful degradation.

Answer

Immediate infinite retries

Answer

Retry only after restarting the application

Answer

Disable all timeout settings

Question 3

You need to store billions of small log entries (each ~200 bytes) written in chronological order from multiple producers. The logs are read sequentially in bulk once per day. You need to maximize write throughput and minimize storage costs. Which Azure Storage solution should you choose?

Accepted Answer

Append Blob in Blob Storage. Append Blob in Blob Storage is optimized for append operations, making it ideal for writing small log entries in chronological order from multiple producers. It provides high write throughput because each append operation is atomic and can be performed concurrently, and it minimizes storage costs by storing data in a cost-effective blob tier without the overhead of indexing or metadata management required by other solutions.

Answer

Block Blob in Blob Storage with high block count

Answer

Azure Data Lake Storage Gen2 with hierarchical namespace

Answer

Azure Files with SMB protocol

Question 4

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used?

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it is a fully managed event routing service designed for high-volume, lightweight event notifications using native event routing (HTTP-based push model). It supports serverless handlers like Azure Functions and automatically delivers events to subscribers with built-in retry and dead-lettering, making it ideal for reacting to Azure resource state changes.

Answer

Azure DNS

Answer

Azure Files

Answer

Azure Service Bus queue

Question 5

An application needs to upload large thumbnail metadata to Blob Storage reliably over unstable networks. Which upload approach should be used?

Accepted Answer

Block blob staged block upload with commit. Block blob staged block upload with commit is the correct approach because it allows uploading large thumbnails in smaller, independent blocks that can be retried individually if a network failure occurs. This method uses the Put Block and Put Block List REST APIs, enabling reliable uploads over unstable networks by committing only successfully uploaded blocks. It is specifically designed for large files and provides fine-grained control over upload progress and error recovery.

Answer

Page blob only

Answer

Append blob only

Answer

Table Storage batch operation

Question 6

You are developing a C# application that stores sensitive documents in Azure Blob Storage. The application needs to generate a time-limited shared access signature (SAS) that allows a client to only read and list blobs in a specific container. The SAS must be valid for exactly 1 hour from the current time. Which code snippet correctly creates the SAS? (Assume the BlobServiceClient and BlobContainerClient are properly initialized.)

Accepted Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = container.Name, Permissions = "rl", ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);. It creates a `BlobSasBuilder` with the container name, permissions set to "rl" (read and list), and an expiration time of exactly 1 hour from the current UTC time. The `GenerateSasUri` method then produces a SAS URI that grants the specified permissions for the container. This matches the requirement for a time-limited SAS that allows only read and list operations on blobs in the container.

Answer

var sasBuilder = new BlobSasBuilder { Permissions = "r", ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);

Answer

var sasToken = container.GetSasToken(permissions: "rl", duration: TimeSpan.FromHours(1));

Answer

var sasBuilder = new BlobSasBuilder { Permissions = "rl", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);

Question 7

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used?

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution for up to 30 minutes (unlimited execution duration), and provides serverless scaling without managing virtual machines. The Consumption plan has a 10-minute timeout and lacks VNet integration for all triggers, while the Premium plan offers these features with pre-warmed instances and dedicated compute resources.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 8

You need to execute a PowerShell script every night to clean up unused resources in your Azure subscription. The script should run with a specific service principal identity that has the necessary permissions. You want a serverless solution with minimal management overhead. Which Azure service should you use?

Accepted Answer

Azure Automation with a scheduled runbook.. Azure Automation with a scheduled runbook is the correct choice because it is designed specifically for running PowerShell scripts on a recurring schedule using a service principal identity, with built-in support for Azure authentication via managed identities or Run As accounts. This provides a serverless solution with minimal management overhead, as Azure Automation handles the scheduling, execution, and identity management without requiring you to maintain any infrastructure.

Answer

Azure Functions with a timer trigger running PowerShell.

Answer

Azure Logic Apps with a recurrence trigger running a PowerShell action.

Answer

Set up a scheduled task on an Azure VM to run the script.

Question 9

You are processing messages from an Azure Storage queue in a worker role. To handle messages that repeatedly fail, you want to move them to a separate 'poison' queue after 5 delivery attempts. Which property of the received message should you check to determine the number of attempts?

Accepted Answer

DequeueCount. The DequeueCount property tracks how many times a message has been dequeued from the queue. Each time a worker role retrieves the message but fails to process it (and does not delete it), the message becomes visible again after the visibility timeout expires, incrementing DequeueCount. By checking this property, you can implement a retry policy that moves the message to a poison queue after a threshold (e.g., 5 attempts).

Answer

MessageId

Answer

ExpirationTime

Answer

PopReceipt

Question 10

A company stores secrets (e.g., connection strings) in Azure Key Vault and needs them automatically rotated every 90 days. Which solution should they implement?

Accepted Answer

Use Event Grid to trigger an Azure Function or Automation runbook that rotates the secret. Azure Key Vault does not natively support automatic secret rotation; you must implement a custom solution using Event Grid to detect expiration events and trigger an Azure Function or Automation runbook that generates a new secret and updates the vault. This pattern leverages Key Vault's eventing capabilities to automate the rotation workflow without manual intervention.

Answer

Configure Key Vault access policies to enforce rotation

Answer

Enable Key Vault firewall to limit access

Answer

Enable soft-delete on the vault

Question 11

You are designing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The application needs to authorize access to resources based on custom roles (e.g., 'Admin', 'Editor') that are not defined in Microsoft Entra ID app roles or groups. The role mappings are dynamic and stored in an application database. How should you implement authorization in the API?

Accepted Answer

Use the OnTokenValidated event in OpenID Connect middleware to query the database and add custom role claims to the identity.. It uses the OnTokenValidated event in OpenID Connect middleware to enrich the user's identity with custom role claims from the application database after token validation. This approach allows dynamic role mappings stored externally to be injected into the ClaimsPrincipal, which can then be evaluated by the standard [Authorize] attribute with role policies. It avoids modifying Entra ID configuration and keeps role management flexible within the application.

Answer

Define the roles as Microsoft Entra ID app roles and assign them to users. This is the standard way to handle roles.

Answer

Store the roles in the Microsoft Entra ID token by customizing the token issuance in Microsoft Entra ID.

Answer

Use the [Authorize] attribute with a custom authorization filter that checks the database on every request without modifying the claims.

Question 12

You are developing an ASP.NET Core web API hosted on Azure App Service. The API needs to read secrets from Azure Key Vault at startup. You have enabled a system-assigned managed identity for the App Service. Which code should you use to create the Key Vault SecretClient?

Accepted Answer

new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential()). `DefaultAzureCredential` automatically attempts to authenticate using the environment's managed identity when running on Azure App Service. Since a system-assigned managed identity is enabled, `DefaultAzureCredential` will chain through available credential sources and successfully use the managed identity endpoint to obtain a token for Key Vault, without requiring any explicit tenant ID, client ID, or secret.

Answer

new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret))

Answer

new SecretClient(new Uri(keyVaultUrl), new ChainedTokenCredential())

Answer

new SecretClient(new Uri(keyVaultUrl), new InteractiveBrowserCredential())

Question 13

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The team wants the control to be enforceable during normal operations.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth flow for single-page apps because it prevents the client secret from being exposed by using a dynamically generated code verifier and challenge. This flow ensures that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original code verifier, making it secure for public clients that cannot safely store secrets.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 14

You have an Azure App Service that uses a system-assigned managed identity. You need to grant it permission to read a secret from Azure Key Vault. Which RBAC role should you assign at the Key Vault scope?

Accepted Answer

Key Vault Secrets User. The system-assigned managed identity needs to read a secret from Azure Key Vault. The 'Key Vault Secrets User' RBAC role grants exactly that permission — the ability to read secret contents. This is the least-privilege role that allows the 'Microsoft.KeyVault/vaults/secrets/read' action, which is required for reading secret values.

Answer

Key Vault Reader

Answer

Key Vault Contributor

Answer

Key Vault Certificate User

Question 15

A developer is implementing least-privilege storage access. The application runs on Azure App Service and must avoid stored credentials. Which design should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Enable managed identity and grant least-privilege access to the target resource. Azure Managed Identity provides an automatically managed identity in Azure AD that allows the App Service to authenticate to any service supporting Azure AD authentication without storing any credentials. By granting the managed identity only the specific permissions required (least-privilege) on the target storage resource (e.g., Storage Blob Data Reader), the application avoids stored credentials and eliminates the need for custom operational scripts. This aligns with the principle of zero standing credentials and is the recommended approach for Azure App Service.

Answer

Use a shared administrator account

Answer

Disable authentication for the target resource

Answer

Store a client secret in source control

Question 16

You are developing an application that runs on Azure App Service. The application needs to store session state. The session state must be shared across multiple instances of the app and survive restarts. You need to choose a session state provider. What should you use?

Accepted Answer

Use Azure Redis Cache as a session state provider.. Azure Redis Cache provides a distributed, in-memory data store that can be shared across multiple instances of an App Service application and persists data through restarts. It is the recommended session state provider for Azure App Service when high availability and scalability are required, as it stores session data externally from the application's memory.

Answer

Use Azure Table Storage for session state.

Answer

Use a SQL Database to store session data.

Answer

Use the in-memory session state provider.

Question 17

Your IoT solution generates billions of small telemetry entries (each ~100 bytes). Data is written once and rarely updated. You need to run analytical queries on the last 30 days of data daily, scanning large ranges by timestamp, requiring sub-second response times. You want the lowest storage cost. Which Azure Storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is correct because it is a NoSQL key-value store optimized for high-volume, low-cost storage of structured data like telemetry entries. It supports efficient range queries on the partition key (e.g., timestamp) and row key, enabling sub-second scans of large date ranges. Its storage cost is the lowest among Azure storage options for this workload, as it charges only for consumed capacity with no minimum throughput commitments.

Answer

Azure Blob Storage

Answer

Azure Cosmos DB

Answer

Azure Data Lake Storage

Question 18

You are developing a .NET 8 application that stores customer data in Azure Blob Storage. The application uses the Azure.Storage.Blobs SDK. You need to ensure that the blob containers are created only if they do not already exist. Which method should you call?

Accepted Answer

CreateIfNotExistsAsync. The `CreateIfNotExistsAsync` method is the correct choice because it atomically checks for the existence of the blob container and creates it only if it does not already exist, returning a Boolean indicating whether creation occurred. This aligns with the requirement to avoid errors when the container already exists, without requiring a separate existence check.

Answer

ExistsAsync

Answer

DeleteIfExistsAsync

Answer

CreateAsync

Question 19

A company is designing a serverless application using Azure Functions. They need to orchestrate multiple functions in a workflow, handle errors, and manage state. Which TWO features should they use?

Accepted Answer

Fan-out/Fan-in pattern. The Fan-out/Fan-in pattern is a core feature of Durable Functions that allows you to execute multiple functions in parallel (fan-out) and then aggregate their results (fan-in). This pattern is essential for orchestrating workflows, handling errors via retry policies, and managing state across function executions. Durable Functions provide built-in state management and checkpointing, making them ideal for serverless orchestration scenarios.

Answer

Azure Event Grid

Answer

Azure Logic Apps

Answer

Azure Data Factory

Question 20

A company stores archival data in Azure Blob Storage. The data is accessed only a few times per year, and retrieval can take up to 15 hours. Which blob access tier minimizes storage costs while meeting these requirements?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is designed for data that is rarely accessed (a few times per year) and has a retrieval latency of up to 15 hours, which matches the requirement. It offers the lowest storage cost among Azure Blob Storage tiers, making it optimal for long-term archival data where infrequent access and delayed retrieval are acceptable.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier