AZ-204 Practice Test 6 — 10 Questions

Question 1

Your application uses Azure Queue Storage to process orders. Occasionally, messages are not processed and remain in the queue. You need to ensure that messages are automatically retried after a specified time if they are not deleted. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the message visibility timeout to a small value. Setting the message visibility timeout to a small value ensures that if a message is not deleted after processing (i.e., the worker fails or crashes), the message becomes visible again in the queue after the short timeout. This allows other queue consumers to retry processing the message automatically. The visibility timeout controls how long a message is hidden from other consumers after being dequeued, and a small value reduces the delay before a retry occurs.

Answer

Configure a dead-letter queue

Answer

Enable queue storage logging

Answer

Increase the message time-to-live (TTL)

Question 2

A image resize worker runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) over the Microsoft backbone network. It uses a delegated subnet in the VNet to assign the app a network interface in the VNet, allowing it to reach private APIs without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 3

You are building a serverless application that processes images uploaded to an Azure Blob Storage container. When a new blob is added, an Azure Function (PowerShell) is triggered to generate a thumbnail and store it in a different container. The function must run with the least privilege necessary. The function uses a managed identity assigned to the function app. You need to grant the function access to read blobs from the source container and write blobs to the destination container. The storage account already has a private endpoint configured. What is the correct way to assign permissions?

Accepted Answer

Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.. It uses Azure RBAC roles scoped to individual containers, granting the function app's managed identity exactly the permissions needed: 'Storage Blob Data Reader' for reading from the source container and 'Storage Blob Data Contributor' for writing to the destination container. This follows the principle of least privilege, avoids over-permissioning, and works seamlessly with private endpoints since RBAC does not depend on network paths.

Answer

Generate a SAS token for the source container with read permission and for the destination container with write permission, and store them in Key Vault for the function to retrieve.

Answer

Add the function app's managed identity to the storage account's Access Control (IAM) with the 'Storage Blob Data Owner' role on the entire storage account.

Answer

Use the storage account connection string in the function app settings and access the blobs using the connection string.

Question 4

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

Accepted Answer

Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.. It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.

Answer

Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

Answer

Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

Answer

Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

Question 5

Your company has a set of REST APIs that are exposed through Azure API Management (APIM). One of the backend APIs is secured and requires an OAuth 2.0 access token from Microsoft Entra ID. The APIM instance has a system-assigned managed identity with permissions to request tokens for the backend API's scope. You need to configure APIM to automatically obtain a token and pass it to the backend API when requests come in. What should you do?

Accepted Answer

Add a set-backend-service policy with the authentication-managed-identity attribute. The `set-backend-service` policy with the `authentication-managed-identity` attribute allows APIM to use its system-assigned managed identity to obtain an OAuth 2.0 access token from Microsoft Entra ID for the specified backend API scope. This token is automatically attached to the backend request as an Authorization header, enabling secure access without manual token management.

Answer

Configure the backend API's subscription key in policy

Answer

Use a validate-jwt policy to check incoming token

Answer

Create a named value with the token and reference it in policy

Question 6

You are developing a microservices application. Each microservice must authenticate to Azure SQL Database using its own identity. You need to minimize credential management overhead. What should you use?

Accepted Answer

System-assigned managed identities. System-assigned managed identities enable each microservice to authenticate to Azure SQL Database without storing credentials in code or configuration. Azure automatically rotates the identity's service principal certificate and handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating manual credential management. This is the simplest approach when each microservice has a one-to-one relationship with its Azure resource (e.g., App Service or Azure Function).

Answer

User-assigned managed identities

Answer

Certificate-based authentication

Answer

Service principals with client secrets

Question 7

You are deploying a Node.js application to Azure Web Apps for Containers. The application needs to read configuration settings from Azure App Configuration. What is the recommended method to securely connect the app to the configuration store?

Accepted Answer

Use managed identity.. Using a managed identity allows the Node.js application running in Azure Web Apps for Containers to authenticate to Azure App Configuration without storing any secrets. Managed identities provide an automatically managed service principal in Microsoft Entra ID, enabling secure, code-free access to the configuration store via Microsoft Entra ID authentication, which is the recommended approach for production workloads.

Answer

Store connection string in environment variables.

Answer

Use Key Vault references in App Settings.

Answer

Hardcode the connection string.

Question 8

You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?

Accepted Answer

The container image logs environment variables at startup, exposing the secure variable.. The `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.

Answer

The --secure-environment-variables flag is misspelled.

Answer

The --secure-environment-variables flag is not supported for ACI.

Answer

The DB_PASSWORD value contains special characters that were not escaped.

Question 9

You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?

Accepted Answer

Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.. Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.

Answer

Use Azure Information Protection to encrypt the blobs with a customer-managed key.

Answer

Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.

Answer

Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.

Question 10

You are developing an API using Azure API Management (APIM). The API is backed by an Azure Function that processes requests. You need to implement caching for responses that are expensive to compute. The cache should expire after 10 minutes. What should you configure in APIM?

Accepted Answer

Add a cache-lookup and cache-store policy to the API operation.. Azure API Management (APIM) provides built-in caching policies—`cache-lookup` and `cache-store`—that can be applied directly to an API operation. These policies cache the response from the backend (the Azure Function) and respect the `cache-control` header or a specified duration, such as 10 minutes, without requiring an external cache. This is the simplest and most direct way to implement response caching for expensive-to-compute operations within APIM.

Answer

Configure Azure Redis Cache as an external cache in APIM.

Answer

Implement response caching in the Azure Function code.

Answer

Use Azure Front Door to cache responses.