AZ-204 Practice Exam 59 — 20 Questions

Question 1

A company has an Azure Kubernetes Service (AKS) cluster. They want to ensure that pods can securely access Azure SQL Database without using connection strings or secrets. The solution must use the principle of least privilege. What should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Azure AD Workload Identity for AKS and assign a managed identity to the pod that has access to Azure SQL Database.. Azure AD Workload Identity allows you to assign a user-assigned managed identity to a pod in AKS. This identity can be granted specific permissions (e.g., db_datareader) on Azure SQL Database using Azure AD authentication, eliminating the need for connection strings or secrets. The pod authenticates directly via the managed identity token, adhering to the principle of least privilege by scoping access to only the required database roles.

Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets into the pod.

Answer

Store the SQL connection string in a Kubernetes secret and mount it as a volume in the pod.

Answer

Configure Azure SQL Database firewall to allow the AKS cluster's IP addresses.

Question 2

You are developing a .NET Core application that stores user profile images in Azure Blob Storage. The images are accessed frequently in the first week after upload, then rarely afterwards. You need to minimize storage costs while maintaining immediate access for the first week. What should you do?

Accepted Answer

Implement a lifecycle management policy to move blobs to Cool tier 7 days after creation.. Azure Blob Storage lifecycle management policies allow you to automatically transition blobs to a cooler tier (Cool) after a specified number of days, minimizing storage costs while maintaining immediate access for the first week. This policy is applied at the storage account level and requires no manual intervention or scheduled jobs, ensuring that blobs remain in the Hot tier for the first 7 days (frequent access) and then move to Cool tier (lower cost, still immediate access).

Answer

Manually change the blob tier to Cool after 7 days using a scheduled job.

Answer

Set the default access tier of the storage account to Cool.

Answer

Store blobs in Archive tier and use rehydration when needed.

Question 3

Which TWO actions should you take to secure an Azure Function app that is triggered by an HTTP request? (Choose two.)

Accepted Answer

Enable App Service Authentication and configure Microsoft Entra ID as the identity provider.. Enabling App Service Authentication with Microsoft Entra ID (formerly Azure AD) provides a managed identity layer that validates JWT tokens from Microsoft Entra ID before the request reaches your function code. This ensures only authenticated users or applications can invoke the HTTP-triggered function, offloading token validation and session management from your code. Option C is correct because storing secrets in Azure Key Vault and referencing them via Key Vault references (syntax @Microsoft.KeyVault(SecretUri=...)) in the function app settings prevents hardcoding credentials in configuration files or source code, aligning with the principle of least privilege and secure secret management.

Answer

Use function-level authorization keys (function or admin keys) for all HTTP triggers.

Answer

Set the function app's public access to 'Off' and use virtual network integration.

Answer

Enable Cross-Origin Resource Sharing (CORS) with allowed origins set to '*'.

Question 4

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to securely store configuration settings such as database connection strings and API keys. The solution must minimize administrative overhead and automatically rotate keys. What should they use?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver.. Azure Key Vault with the Secrets Store CSI driver allows you to mount secrets as volumes or environment variables in AKS pods without exposing them in plaintext or requiring manual rotation. The CSI driver synchronizes secrets from Key Vault to a Kubernetes volume, and Key Vault supports automatic key rotation policies, minimizing administrative overhead while ensuring security.

Answer

Store secrets as Kubernetes Secrets objects with base64 encoding.

Answer

Use Azure App Configuration with feature flags.

Answer

Store secrets as environment variables in the container's deployment YAML.

Question 5

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The team wants the control to be enforceable during normal operations.

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish/subscribe pattern where multiple independent subscribers can each receive a copy of every published message. Subscribers can be added later without modifying the publisher, and the team can enforce control during normal operations using topic-level authorization rules and subscription filters.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only

Question 6

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must use a managed identity to authenticate to the Service Bus to avoid managing secrets. Which configuration step is essential for this setup?

Accepted Answer

Enable system-assigned managed identity on the function app and assign the 'Azure Service Bus Data Receiver' role to the identity. Using a managed identity eliminates the need to manage secrets or connection strings. By enabling a system-assigned managed identity on the function app and assigning the 'Azure Service Bus Data Receiver' role to that identity, the function can authenticate to Azure Service Bus via Azure AD (OAuth 2.0) without any stored credentials. This is the recommended approach for secure, secretless authentication in Azure Functions.

Answer

Store the Service Bus connection string in the function app settings

Answer

Create a Key Vault reference to the connection string

Answer

Use the Service Bus SDK with a SharedAccessSignatureToken

Question 7

You are designing a solution for a healthcare application that stores patient data in Azure Cosmos DB. The data must be encrypted at rest using a customer-managed key stored in Azure Key Vault. You need to ensure that the key can be rotated without downtime. Which approach should you recommend?

Accepted Answer

Enable automatic key rotation on the Key Vault key and use the key's versionless identifier in Cosmos DB.. Using a versionless key identifier in Azure Cosmos DB allows the service to automatically use the latest version of the customer-managed key stored in Azure Key Vault. When the key is rotated in Key Vault, Cosmos DB picks up the new version without any manual intervention, ensuring zero downtime and continuous encryption at rest.

Answer

Configure Azure Security Center to automatically rotate the key.

Answer

After rotating the key in Key Vault, manually update the Cosmos DB account with the new key version.

Answer

Use the Cosmos DB account key rotation feature to regenerate the key.

Question 8

You are building an Azure Logic App that calls an external REST API secured with the OAuth 2.0 client credentials flow. You have registered an app in Microsoft Entra ID with client ID and client secret stored in Azure Key Vault. The Logic App uses a system-assigned managed identity with Get permission on the secret. Which action should you use in the Logic App designer to authenticate to the API?

Accepted Answer

HTTP action with 'Active Directory OAuth' authentication type, referencing the client ID and client secret. The OAuth 2.0 client credentials flow requires a client ID and client secret to obtain an access token from Microsoft Entra ID. The HTTP action's 'Active Directory OAuth' authentication type directly supports this flow, allowing you to reference the client ID and the client secret stored in Azure Key Vault. The Logic App's system-assigned managed identity has Get permission on the secret, enabling it to retrieve the secret at runtime without exposing it in the workflow definition.

Answer

HTTP action with 'Managed Identity' authentication type

Answer

Invoke an API with OAuth predefined connector

Answer

HTTP action with 'Basic' authentication and pass the secret as password

Question 9

You are developing a solution that processes events from Azure Event Hubs and stores them in Azure Blob Storage. The processing must be idempotent and exactly-once. Which approach should you use?

Accepted Answer

Use EventProcessorHost with checkpointing and blob leases to track processed events. The EventProcessorHost (EPH) pattern with checkpointing and blob leases provides the foundation for exactly-once processing in Event Hubs. Checkpointing records the offset of the last successfully processed event in Azure Blob Storage, while blob leases ensure partition ownership and prevent duplicate processing by competing consumers. This combination allows the processor to resume from the last checkpoint after a failure, guaranteeing that each event is processed exactly once.

Answer

Use Azure Functions with Event Hubs trigger and store events in batches

Answer

Use a simple consumer group and delete events after reading from Event Hubs

Answer

Implement a transactional outbox pattern with Azure SQL Database

Question 10

An application uses Azure Event Hubs to ingest telemetry data. The team wants to process the data in near real-time and store aggregated results in Azure SQL Database. Which Azure service should they use?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is a fully managed stream processing engine designed for real-time analytics on high-throughput data from sources like Event Hubs. It can ingest telemetry data, apply SQL-based queries for aggregation (e.g., tumbling windows), and output results directly to Azure SQL Database with exactly-once semantics, meeting the near-real-time requirement.

Answer

Azure HDInsight

Answer

Azure Functions

Answer

Azure Data Lake Storage Gen2

Question 11

Your company stores secrets in Azure Key Vault. You need to ensure that when a secret is disabled, it does not become accessible to applications that already have a cached copy. Which additional step must you take?

Accepted Answer

Rotate the secret immediately. When a secret is disabled in Azure Key Vault, the vault itself will reject new access requests, but applications that have already retrieved and cached the secret can continue using it until the cache expires or is refreshed. To immediately invalidate the cached copy, you must rotate the secret (change its value) so that any subsequent attempt to use the old cached value fails because it no longer matches the secret stored in Key Vault. Disabling alone does not force applications to re-authenticate or re-fetch; rotation ensures the cached value becomes obsolete.

Answer

Delete the secret

Answer

Enable soft-delete and purge protection

Answer

Use Key Vault access policies to deny access

Question 12

Audit logs are written daily as block blobs to an Azure Storage account. Logs older than 90 days must move to Cool tier automatically; logs older than 365 days must be deleted. The developer wants to implement this with no custom code and no recurring jobs. What is the correct solution?

Accepted Answer

Create a lifecycle management policy with two rules: tier to Cool after 90 days and delete after 365 days. Azure Blob Storage lifecycle management policies allow you to automate tier transitions and deletions based on blob age, without any custom code or recurring jobs. By defining a rule to tier blobs to Cool after 90 days and another rule to delete blobs after 365 days, the developer meets all requirements with a fully managed, no-code solution.

Answer

Write an Azure Function with a Timer trigger that lists all blobs, checks last-modified dates, and tiers or deletes them via the SDK

Answer

Enable Blob versioning and set a version retention policy of 365 days

Answer

Configure a Logic App with a Recurrence trigger to enumerate and process blobs weekly

Question 13

A company uses Azure Blob Storage to store sensitive documents. They want to ensure that data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data immediately if a security breach is detected. Which feature should they enable?

Accepted Answer

Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.. It combines customer-managed keys (CMK) in Azure Key Vault for encryption at rest with soft delete and purge protection, which allows immediate revocation of access by deleting or disabling the key in Key Vault. This ensures that the data becomes permanently inaccessible as Azure Storage relies on the CMK to encrypt/decrypt the data, and without the key, the data cannot be decrypted.

Answer

Enable infrastructure encryption for the storage account.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys.

Answer

Implement client-side encryption using Azure Key Vault.

Question 14

You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?

Accepted Answer

The App Service does not have a managed identity enabled and the Key Vault access policy is missing.. An Azure App Service must have a managed identity enabled and the Key Vault must have an access policy granting that identity the 'Get' permission for secrets. Without these, the App Service cannot authenticate to Key Vault, causing the deployment to fail with an access error.

Answer

The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.

Answer

The ARM template cannot use Key Vault references in app settings.

Answer

The secret name in the URI does not match the actual secret name.

Question 15

Refer to the exhibit. You deploy this ARM template to create an Azure App Service. After deployment, the application stops responding after a few minutes. The application is a .NET 6 web API that runs in a Linux container. What is the most likely cause?

Accepted Answer

The 'alwaysOn' setting is enabled but the App Service plan is on a tier that does not support Always On.. The 'alwaysOn' setting keeps the app loaded even after periods of inactivity, but it is only supported on Basic, Standard, Premium, and Isolated tiers. If the App Service plan is on a Free or Shared tier, enabling 'alwaysOn' causes the app to stop responding after a few minutes because the platform forcibly unloads idle apps, leading to timeouts or crashes.

Answer

The ARM template is missing the 'dependsOn' element.

Answer

The 'linuxFxVersion' is set incorrectly for .NET 6.

Answer

The 'WEBSITE_RUN_FROM_PACKAGE' app setting is incorrectly set to '1'.

Question 16

You are building an integration solution that connects an on-premises SQL Server database to Azure Data Factory. The on-premises network does not allow direct inbound connections from Azure. You need to securely transfer data from the database to Azure Blob Storage. Which data factory component should you use?

Accepted Answer

Self-hosted Integration Runtime. The Self-hosted Integration Runtime (SHIR) is required because the on-premises SQL Server database resides in a network that blocks direct inbound connections from Azure. SHIR acts as a bridge, running on a local machine or VM within the on-premises network, enabling Azure Data Factory to securely connect to the database via outbound HTTPS (port 443) or the Microsoft Service Bus. It handles data movement and transformation without exposing the on-premises network to inbound traffic.

Answer

Azure Integration Runtime

Answer

Azure-SSIS Integration Runtime

Answer

Azure Data Lake Storage connector

Question 17

You are deploying a critical application on Azure App Service. The application must be highly available across two Azure regions. You need to implement a disaster recovery strategy that meets the following requirements: automatic failover with minimal data loss, and the ability to test failover without affecting production. Which THREE actions should you perform?

Accepted Answer

Use deployment slots to test failover before making it active.. Deployment slots in Azure App Service allow you to create separate environments (e.g., staging) that can be swapped to production. This enables testing failover scenarios (like pointing Traffic Manager to the staging slot) without affecting the live production traffic, meeting the requirement for non-disruptive failover testing.

Answer

Configure the app to use active-passive database replication.

Answer

Deploy both instances in the same App Service Plan.

Question 18

You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and configure automatic rotation.. Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.

Answer

Store the connection string as an environment variable in the App Service.

Answer

Store the connection string in a web.config file with encrypted configuration.

Answer

Store the connection string in Azure App Configuration and use a managed identity.

Question 19

You need to diagnose a slow-performing Azure Function. Application Insights shows that the function's dependency calls to an external API take an unusually long time. Which Application Insights feature should you use to visualize the end-to-end request flow?

Accepted Answer

Application Map. Application Map is the correct feature because it provides a visual representation of the end-to-end request flow across distributed components, including dependency calls to external APIs. It shows the latency and failure rates for each dependency, allowing you to pinpoint where the slowdown occurs in the overall transaction.

Answer

Metrics Explorer

Answer

Live Metrics Stream

Answer

Smart Detection

Question 20

An e-commerce platform writes orders to a Cosmos DB container. A downstream inventory service must process every new or updated order exactly once, even if the inventory service restarts mid-batch. The solution must scale horizontally when order volume increases. What is the recommended design?

Accepted Answer

Use the change feed processor library with a dedicated lease container; each worker instance claims partition leases and commits checkpoints after processing each batch. The change feed processor library with a dedicated lease container is the recommended design because it provides exactly-once processing semantics through checkpointing, automatic partition lease management for horizontal scaling, and resilience to worker restarts by resuming from the last committed checkpoint. This pattern is purpose-built for Cosmos DB change feed consumption in distributed systems.

Answer

Poll the Cosmos DB container every 30 seconds using a _ts timestamp filter to find recently modified documents

Answer

Subscribe to Azure Event Grid Cosmos DB events and process them in an Azure Function

Answer

Enable Cosmos DB analytical store and run batch queries from an Azure Synapse Spark pool every hour