AZ-204 Practice Exam 58 — 20 Questions

Question 1

You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?

Accepted Answer

The container image logs environment variables at startup, exposing the secure variable.. Option D is correct because the `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.

Answer

The --secure-environment-variables flag is misspelled.

Answer

The --secure-environment-variables flag is not supported for ACI.

Answer

The DB_PASSWORD value contains special characters that were not escaped.

Question 2

You are developing an Azure Logic App that processes files from an FTP server. The workflow must run every 10 minutes and process only new files. You need to ensure that files are not processed more than once. What should you use?

Accepted Answer

Use the FTP trigger 'When a file is added or modified' with a recurrence of 10 minutes.. Option C is correct because the 'When a file is added or modified' FTP trigger in Azure Logic Apps automatically tracks processed files using a built-in 'trigger state' mechanism. When combined with a recurrence schedule (e.g., every 10 minutes), it ensures that only new or modified files since the last run are processed, preventing duplicate processing without external state management.

Answer

Use the FTP trigger 'When a file is added' with a recurrence of 10 minutes.

Answer

Use the 'When a file is added' trigger and store processed file names in a SQL database.

Answer

Use the Sliding Window trigger and set the window size to 10 minutes.

Question 3

Refer to the exhibit. You run this Azure CLI command to configure an Azure Web App for Containers. The web app fails to start, and the logs show 'unauthorized: authentication required'. What is the most likely cause?

Accepted Answer

The command did not include admin credentials or managed identity configuration. Option A is correct because the Azure CLI command `az webapp config container set` without specifying `--docker-registry-server-user` and `--docker-registry-server-password` (or a managed identity configuration) means the web app cannot authenticate with a private container registry. The 'unauthorized: authentication required' error indicates the registry requires credentials, and the web app has none configured, so it fails to pull the image.

Answer

The image tag 'latest' does not exist

Answer

The web app is configured to use a deployment slot, but the slot is not specified

Answer

The --docker-registry-server-url is incorrect

Question 4

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Option D is correct because implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 5

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to securely store configuration settings such as database connection strings and API keys. The solution must minimize administrative overhead and automatically rotate keys. What should they use?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver.. Option B is correct because Azure Key Vault with the Secrets Store CSI driver allows you to mount secrets as volumes or environment variables in AKS pods without exposing them in plaintext or requiring manual rotation. The CSI driver synchronizes secrets from Key Vault to a Kubernetes volume, and Key Vault supports automatic key rotation policies, minimizing administrative overhead while ensuring security.

Answer

Store secrets as Kubernetes Secrets objects with base64 encoding.

Answer

Use Azure App Configuration with feature flags.

Answer

Store secrets as environment variables in the container's deployment YAML.

Question 6

Which TWO actions should you perform to configure autoscaling for an Azure App Service web app based on CPU usage?

Accepted Answer

Configure the minimum and maximum instance limits.. Option A is correct because autoscaling in Azure App Service requires you to define the minimum and maximum instance limits to control the scaling range. These limits ensure the web app scales out or in within a safe boundary, preventing runaway costs or performance degradation. Without setting these limits, the autoscale engine cannot determine the operational range for scaling actions.

Answer

Enable manual scaling and set the instance count to 3.

Answer

Set the default instance count to 1.

Answer

Create a scale rule based on a specific date and time.

Question 7

You are reviewing an ARM template snippet for an Azure App Service. The exhibit shows the site configuration. You need to ensure that the app supports WebSocket connections for a real-time feature. Which setting must be added?

Accepted Answer

Add 'webSocketsEnabled': true to siteConfig.. Option D is correct because the 'webSocketsEnabled' property in the siteConfig of an Azure App Service ARM template explicitly enables WebSocket protocol support. WebSocket connections require a persistent, full-duplex communication channel over a single TCP connection, which is not enabled by default in Azure App Service. Setting this property to true allows the app to handle real-time features like chat or live notifications.

Answer

Set alwaysOn to false.

Answer

Set http20Enabled to false.

Answer

Change ftpsState to AllAllowed.

Question 8

You are developing a solution that uses Azure Container Apps. Your application is a microservice that needs to expose a gRPC endpoint. The service must scale to zero when idle. What should you do?

Accepted Answer

Deploy the microservice to Azure Container Apps and configure a scale rule with minReplicas set to 0.. Azure Container Apps natively supports gRPC endpoints and can scale to zero by setting `minReplicas` to 0 in a scale rule. This configuration allows the microservice to run only when there are active requests, reducing costs during idle periods. The combination of gRPC support and dynamic scaling makes Container Apps the correct choice for this scenario.

Answer

Use Azure Functions with a gRPC trigger.

Answer

Deploy the microservice to Azure Kubernetes Service with a virtual node.

Answer

Deploy the microservice to Azure Container Instances with a scale rule.

Question 9

You are developing an Azure Function that runs on a Consumption plan. The function needs to process a large file uploaded to Azure Blob Storage. The processing is CPU-intensive and may take up to 30 minutes. What should you use to implement the function?

Accepted Answer

Configure the function app to use a Premium plan to allow longer execution times.. Azure Functions on a Consumption plan have a maximum execution timeout of 10 minutes (or 5 minutes by default). For CPU-intensive processing that may take up to 30 minutes, you must use a Premium plan, which supports unlimited execution duration (subject to the functionTimeout setting, which can be set up to 60 minutes by default and up to unlimited if configured). The Premium plan also provides dedicated instances and pre-warmed workers, which are suitable for long-running, resource-intensive workloads.

Answer

Use a blob trigger and set the batchSize to 1 to avoid timeouts.

Answer

Set the functionTimeout in host.json to 30 minutes on the Consumption plan.

Answer

Create an orchestrator function using Durable Functions to manage the processing.

Question 10

Your application stores user profile images in Azure Blob Storage. You need to serve these images to users with low latency from a domain name that you own. What should you use?

Accepted Answer

Create an Azure CDN endpoint with a custom domain and point it to the blob container.. Option B is correct because Azure CDN provides global edge caching, which reduces latency for serving static images from Blob Storage. By configuring a custom domain on the CDN endpoint, you can serve content under your own domain name while benefiting from CDN acceleration. This combination addresses both the low-latency requirement and the custom domain ownership.

Answer

Enable static website hosting and configure a custom domain directly on the storage account.

Answer

Configure a custom domain in Azure DNS and point it to the storage account endpoint.

Answer

Use Azure Front Door with a custom domain.

Question 11

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

Question 12

Which TWO options are valid ways to scale an Azure Functions app running on the Premium plan?

Accepted Answer

Configure pre-warmed instances to reduce cold start.. Option B is correct because pre-warmed instances in the Premium plan reduce cold start latency by keeping a specified number of instances always loaded and ready to handle requests. Option C is correct because the Premium plan allows you to set both minimum and maximum instance counts, giving you control over baseline capacity and scaling limits. These settings are configured in the function app's scale settings and are not available in the Consumption plan.

Answer

Disable scale-to-zero to keep instances always warm.

Answer

Scale out based on the length of a storage queue.

Answer

Set the scale mode to 'Automatic' with no configuration.

Question 13

A company deploys a containerized application on Azure Kubernetes Service (AKS). They need to ensure high availability and disaster recovery across regions. Which THREE actions should they take?

Accepted Answer

Configure Pod Disruption Budgets. Pod Disruption Budgets (PDBs) are correct because they ensure that a minimum number of pods remain available during voluntary disruptions, such as node maintenance or cluster upgrades. In a multi-region AKS deployment for high availability and disaster recovery, PDBs protect application uptime by preventing too many replicas from being taken down simultaneously, which is critical for maintaining service continuity across regional failovers.

Answer

Use Azure Front Door for global load balancing

Answer

Enable Cluster Autoscaler

Question 14

You are designing a solution that uses Azure Functions to process messages from an Azure Service Bus queue. Which TWO configurations can improve the throughput of the function?

Accepted Answer

Set maxMessagesPerBatch to a higher value. Increasing maxMessagesPerBatch allows the Azure Functions Service Bus trigger to retrieve more messages in a single batch from the queue, reducing the number of round trips to the Service Bus namespace. This directly improves throughput by enabling the function to process multiple messages concurrently within the same function invocation, assuming the function code can handle parallel processing efficiently.

Answer

Set maxDeliveryCount to a higher value

Answer

Set newBatchThreshold to a lower value

Answer

Set maxMessagesPerBatch to a lower value

Answer

Set maxEventBatchSize to a higher value

Question 15

A company runs an ASP.NET Core web app on Azure App Service. They need to implement health checks that monitor the app's dependencies, such as a database and an external API. The health endpoint should return a 200 status if all dependencies are healthy, a 503 if any dependency is unhealthy, and a 400 if the request is malformed. Which approach should you take?

Accepted Answer

Implement custom health checks using the ASP.NET Core Health Checks middleware.. Option A is correct because the ASP.NET Core Health Checks middleware allows you to implement custom health checks that monitor specific dependencies like a database and an external API. You can configure the middleware to return a 200 OK status when all checks pass, a 503 Service Unavailable when any check fails, and a 400 Bad Request for malformed requests by using the appropriate response writer and status code mapping.

Answer

Use the ASP.NET Core Diagnostics middleware to generate a health page.

Answer

Configure Application Insights availability tests.

Answer

Use the built-in health check endpoint in Azure App Service.

Question 16

You have an Azure Function app that uses an Event Hubs trigger. The function processes events in batches. You notice that some events are being processed more than once. Which setting should you adjust to minimize duplicate processing?

Accepted Answer

Enable checkpointing in the function code. Option B is correct because checkpointing in Azure Event Hubs stores the offset of the last successfully processed event in a durable store (e.g., Azure Blob Storage). When the function restarts or scales, it resumes from that checkpoint, preventing reprocessing of already-handled events. Without checkpointing, the default behavior may start from the earliest offset or use the `latest` position, leading to duplicate processing.

Answer

Increase the maxRetries per event

Answer

Increase the event batch size

Answer

Decrease the prefetch count

Question 17

You are designing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job is expected to run for up to 2 hours. You need to minimize costs. Which ACI configuration should you use?

Accepted Answer

Use a container group with a restart policy of 'OnFailure' or 'Never'.. Option A is correct because setting the restart policy to 'OnFailure' or 'Never' ensures that the container does not restart after the batch job completes, avoiding unnecessary compute charges. ACI bills per second of container runtime, so any idle or restarted container time directly increases cost. For a finite batch job, a restart policy that prevents automatic restarts is the most cost-effective choice.

Answer

Use GPU-enabled containers for faster processing.

Answer

Deploy the container group in a virtual network.

Answer

Use a container group with a restart policy of 'Always'.

Question 18

You run the above command. The web app is connected to a GitHub repository via Continuous Deployment. You push a new commit to the 'main' branch, but the web app does not update. What is the most likely cause?

Accepted Answer

The GitHub webhook is not configured to trigger on push events.. The web app is configured for Continuous Deployment via GitHub, which relies on a webhook to notify Azure App Service of new commits. When a push event occurs on the 'main' branch, the webhook must be configured to trigger the deployment. If the webhook is not set to fire on push events, Azure will never receive the notification, and the app will not update despite the new commit.

Answer

The repository is Mercurial, not Git.

Answer

The deployment rollback is enabled and blocking new deployments.

Answer

The 'branch' property is set to 'main', but the actual branch is 'master'.

Question 19

You are deploying a web app to Azure App Service. You need to enable continuous deployment from a GitHub repository. Which TWO actions are required?

Accepted Answer

Set up a build provider like GitHub Actions or Kudu. B is correct because to enable continuous deployment from GitHub, you need a build provider that compiles your code and deploys it to Azure App Service. GitHub Actions is a modern CI/CD solution that can build and deploy your application, while Kudu is the legacy deployment engine that can also handle build and sync operations. Without a build provider, the source code cannot be transformed into a runnable application on App Service.

Answer

Create a new App Service plan

Answer

Enable Application Insights

Answer

Add a custom domain to the App Service

Question 20

You are developing an Azure Functions app that uses Durable Functions to orchestrate a long-running workflow. The workflow involves calling multiple external APIs. You need to ensure that the orchestration can survive a function app restart. Which feature should you use?

Accepted Answer

Use the default checkpointing and replay mechanism.. Option A is correct because Durable Functions inherently use a checkpointing and replay mechanism to persist the orchestration state to a storage backend (Azure Storage queues, tables, and blobs). This ensures that after a function app restart, the orchestrator function can replay from the last checkpoint, restoring the exact execution context and continuing the workflow without data loss.

Answer

Log orchestration state to Application Insights.

Answer

Implement retry policies on the activity functions.

Answer

Set a high timeout on the orchestration.