AZ-204 Practice Exam 59 — 20 Questions

Question 1

You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?

Accepted Answer

Use the Microsoft.Identity.Web library to validate the token.. Option C is correct because Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.

Answer

Configure the Azure Functions host to use Microsoft Entra ID authentication.

Answer

Use the Microsoft Authentication Library (MSAL) to validate the token.

Answer

Use Azure AD B2C to validate the token.

Question 2

A company has an Azure App Service web app that occasionally returns 500 errors. You need to diagnose the root cause without impacting production traffic. Which feature should you use?

Accepted Answer

Deployment slots. Deployment slots allow you to route a copy of your production traffic to a staging slot for debugging without affecting the live site. By swapping the staging slot into production after testing, you can reproduce and diagnose 500 errors in an isolated environment. This feature provides zero-downtime deployment and traffic routing, making it ideal for diagnosing production issues safely.

Answer

Kudu console

Answer

Application Insights

Answer

Autoscaling rules

Question 3

Which TWO actions should you take to enable a user-assigned managed identity for an Azure App Service web app?

Accepted Answer

Create the managed identity resource in Microsoft Entra ID.. Option A is correct because a user-assigned managed identity is a standalone Azure resource created in Microsoft Entra ID (formerly Azure AD). It must exist as an identity resource before it can be assigned to any Azure service, including an App Service web app. This identity is then tied to a specific tenant and can be used by multiple Azure resources.

Answer

Configure the identity in each deployment slot separately.

Answer

Store the identity's client ID in an app setting.

Answer

Create the managed identity in the same resource group as the web app.

Question 4

You are developing an Azure App Service web app that must authenticate users via Microsoft Entra ID. Which TWO components are required to set up authentication?

Accepted Answer

Client ID and Client Secret. To authenticate users via Microsoft Entra ID in an Azure App Service web app, you must register the app in Entra ID (Option C) to establish an identity and configure authentication. The Client ID and Client Secret (Option B) are then used as credentials in the OAuth 2.0 authorization code flow to verify the app's identity and obtain tokens. These two components are mandatory for the standard OpenID Connect authentication flow.

Answer

A managed identity

Answer

An Azure AD B2C tenant

Answer

Azure Front Door

Question 5

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

Accepted Answer

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.. Option A is correct because the ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer

Configures the App Service to require authentication for cross-origin requests.

Answer

Enables CORS for all origins by setting allowedOrigins to a wildcard.

Answer

Blocks all cross-origin requests because supportCredentials is false.

Question 6

You deploy the above ARM template resource. After deployment, the web app cannot connect to Application Insights. The Application Insights resource exists in the same region. What is the most likely cause?

Accepted Answer

The app setting 'APPINSIGHTS_INSTRUMENTATIONKEY' is deprecated; you should use 'APPLICATIONINSIGHTS_CONNECTION_STRING' instead.. Option B is correct because the ARM template likely sets the 'APPINSIGHTS_INSTRUMENTATIONKEY' app setting, which is deprecated. Application Insights now requires the 'APPLICATIONINSIGHTS_CONNECTION_STRING' app setting for authentication and telemetry ingestion, as the instrumentation key alone is no longer sufficient for newer SDK versions and regional endpoints.

Answer

The dependsOn is incorrect; it should reference the Application Insights resource ID.

Answer

The web app needs a user-assigned managed identity to access Application Insights.

Answer

The instrumentation key must be set under a different name, like 'APPINSIGHTS_KEY'.

Question 7

You are developing a serverless application using Azure Functions. The function needs to scale to zero when idle and handle high traffic spikes. Which THREE features should you implement?

Accepted Answer

Use a Consumption hosting plan. A Consumption hosting plan is correct because it provides automatic scaling and can scale down to zero instances when the function is idle, meaning you only pay for execution time. This is essential for a serverless application that needs to handle high traffic spikes while minimizing costs during idle periods.

Answer

Enable the 'Always On' setting

Answer

Use a Premium hosting plan

Question 8

You are deploying a containerized application to Azure Container Instances (ACI). Which TWO actions should you take to ensure the container can securely access an Azure Key Vault?

Accepted Answer

Enable a managed identity for the container group. Option B is correct because enabling a managed identity for the container group allows the container to authenticate to Azure Key Vault without storing any credentials in the container image or code. The managed identity is automatically integrated with Azure AD, and the container can request an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. This token is then used to authorize requests to Key Vault, ensuring secrets are never exposed in environment variables or configuration files.

Answer

Pass secrets as environment variables

Answer

Register the container with an Azure AD application

Answer

Configure a custom DNS server

Question 9

Which TWO options are valid ways to authenticate an Azure Functions app to Azure Storage when using a managed identity? (Choose two.)

Accepted Answer

Enable system-assigned managed identity on the function app and grant it the 'Storage Blob Data Contributor' role. Option A is correct because enabling a system-assigned managed identity on the function app allows it to authenticate to Azure Storage without storing credentials. Granting the 'Storage Blob Data Contributor' role to that identity via Azure RBAC authorizes the function app to perform blob data operations (read, write, delete) using Azure AD tokens, which are automatically managed by the Azure platform.

Answer

Generate a shared access signature (SAS) token and include it in the connection string

Answer

Use the storage account access key in the connection string

Answer

Use the default AzureWebJobsStorage connection string from the function app settings

Question 10

Which TWO conditions are required to use the 'Run from Package' feature in Azure App Service?

Accepted Answer

The package must be accessible via a URL if not deployed locally.. Option A is correct because the 'Run from Package' feature in Azure App Service requires the deployment package to be accessible via a URL if it is not deployed locally (e.g., uploaded directly via the Azure portal or CLI). When using a remote URL, the package must be publicly accessible or secured with a SAS token, as App Service downloads it to the /home/data/SitePackages directory during startup. This ensures the app runs directly from the package without extracting it to the wwwroot folder.

Answer

The package must be stored in Azure Blob Storage.

Answer

The package size cannot exceed 500 MB.

Answer

The App Service must have a managed identity to access the package.

Question 11

You are reviewing the ARM template for an App Service. What is the effect of the 'alwaysOn' property set to true?

Accepted Answer

The app will stay loaded in memory to avoid cold starts.. Setting 'alwaysOn' to true in an Azure App Service ARM template ensures that the app is kept loaded in memory even when there is no incoming traffic. This prevents the app from being unloaded after a period of inactivity, which eliminates cold starts on subsequent requests. Cold starts occur when the app process is recycled or unloaded, causing a delay as the runtime and application code are reloaded.

Answer

The app will enable health checks at /health.

Answer

The app will scale out to multiple instances automatically.

Answer

The app will be redeployed whenever the code changes.

Question 12

Refer to the exhibit. You deploy this ARM template to a resource group. The template fails with a 'ResourceNotFound' error. What is the most likely cause?

Accepted Answer

The App Service plan 'myplan' does not exist in the resource group.. The ARM template references an App Service plan named 'myplan' in the 'serverFarmId' property of the Microsoft.Web/sites resource. If 'myplan' does not exist in the same resource group, the deployment fails with a 'ResourceNotFound' error because Azure Resource Manager cannot resolve the dependency on a non-existent resource. The template does not include a definition for the App Service plan, so it must already exist in the resource group.

Answer

The 'apiVersion' is incorrect.

Answer

The template is missing the 'dependsOn' property.

Answer

The 'type' property is incorrect for a web app.

Question 13

Which THREE factors should you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for a containerized workload? (Choose three.)

Accepted Answer

The need for orchestration of multiple containers. Option A is correct because AKS provides full orchestration capabilities for managing multiple containers across a cluster, including service discovery, load balancing, and scaling. ACI is designed for single-container or simple multi-container groups without native orchestration, making AKS the appropriate choice when complex orchestration is required.

Answer

The need for GPU-accelerated compute

Answer

The availability of Azure Application Gateway Ingress Controller

Question 14

You are developing an Azure Functions app that processes orders. The function must scale out automatically during peak hours but should not incur costs when idle. Which hosting plan should you use?

Accepted Answer

Consumption plan. The Consumption plan is correct because it automatically scales your function app based on demand, including scaling out to handle peak loads, and you only pay for execution time and resources consumed when your functions are running. When idle, there are no costs because the plan does not reserve any instances; it relies on a dynamic, event-driven scale model that can scale down to zero.

Answer

Premium plan

Answer

Container Instances

Answer

App Service plan

Question 15

Your Azure Functions app uses a consumption plan and processes messages from an Azure Service Bus queue. You notice that message processing takes up to 10 minutes, and some messages are being processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the Service Bus queue is shorter than the processing time.. Option C is correct because the default lock duration for a Service Bus queue is 30 seconds, which is far shorter than the 10-minute processing time. When the lock expires, the message becomes visible to other consumers, causing duplicate processing. The function host does not extend the lock automatically unless the client explicitly renews it, leading to multiple deliveries.

Answer

The max delivery count for the queue is set too low.

Answer

The function host is configured with a low maximum instance count.

Answer

The function does not handle poison messages correctly.

Question 16

You have an Azure Container Apps environment running multiple microservices. One microservice is experiencing high CPU usage and slow response times. You need to configure autoscaling rules to scale based on HTTP requests. Which scaling rule should you add?

Accepted Answer

HTTP scaling rule (KEDA). Option A is correct because KEDA's HTTP scaling rule is specifically designed to scale Azure Container Apps based on the number of concurrent HTTP requests, which directly addresses high CPU usage and slow response times caused by request load. Unlike CPU or memory metrics, HTTP scaling reacts to incoming request volume proactively, allowing the microservice to handle spikes before resource saturation occurs.

Answer

CPU percentage scaling rule

Answer

Memory percentage scaling rule

Answer

Custom scaling rule using Azure Monitor metrics

Question 17

Which THREE features are supported by Azure Container Apps? (Select three.)

Accepted Answer

Event-driven scaling using KEDA.. Azure Container Apps uses KEDA (Kubernetes Event-Driven Autoscaling) to scale containers based on event-driven metrics such as queue depth, HTTP request count, or custom Prometheus metrics. This allows containers to scale to zero when idle and scale out rapidly based on real-time demand, making it ideal for event-driven workloads.

Answer

Virtual network (VNet) injection.

Answer

Mounting Azure NetApp Files volumes.

Question 18

Which THREE considerations are important when designing an Azure Function that uses Durable Functions for fan-out/fan-in pattern?

Accepted Answer

The orchestrator function must be deterministic.. The orchestrator function in Durable Functions must be deterministic because it replays execution history multiple times to recover state after a process restart or to handle async operations. Non-deterministic code (e.g., random numbers, current time) would produce different results on replay, breaking the reliable execution model that Durable Functions relies on for fan-out/fan-in patterns.

Answer

Orchestration history is stored in memory to reduce latency.

Answer

The orchestrator function should be triggered by an HTTP trigger directly.

Question 19

You run the command above to create an Azure Container Instance. The container exits with a non-zero exit code. You need to check the logs to debug the issue. Which command should you use next?

Accepted Answer

az container logs --resource-group myRG --name mycontainer. The correct command is `az container logs` because it retrieves the stdout and stderr logs from a container that has exited, which is essential for debugging exit code failures. Since the container has already exited with a non-zero exit code, you need to inspect its logged output to understand the cause of the failure, and this command directly fetches those logs without requiring an active container.

Answer

az container attach --resource-group myRG --name mycontainer

Answer

az container exec --resource-group myRG --name mycontainer --exec-command /bin/sh

Answer

az container show --resource-group myRG --name mycontainer --query containers[0].instanceView.currentState.exitCode

Question 20

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS certificate. What should you do?

Accepted Answer

Place an Azure Application Gateway in front of the container group.. Azure Container Instances (ACI) does not natively support custom domain names or SSL/TLS termination. By placing an Azure Application Gateway in front of the container group, you can offload SSL/TLS termination at the gateway layer, map a custom domain via the gateway's frontend IP, and route traffic to the container group's private IP. This is the recommended pattern for adding HTTPS and custom domains to ACI workloads.

Answer

Configure the container to listen on port 443 and map a custom domain.

Answer

Upload the certificate to the container and configure the web server.

Answer

Use a private endpoint with a custom domain.