AZ-204 Practice Exam 61 — 20 Questions

Question 1

You are developing a containerized application that will be deployed to Azure Container Instances (ACI). The application consists of a web front-end and a background worker that processes messages from an Azure Storage Queue. You need to ensure that the worker container runs continuously and processes messages as they arrive. The solution must minimize cost and management overhead. What should you do?

Accepted Answer

Deploy the worker as a container group in ACI with the restart policy set to Always.. Option D is correct because ACI with a restart policy of Always ensures the worker container restarts immediately after it finishes processing a message, allowing it to continuously poll the Azure Storage Queue for new messages. This minimizes cost by using a serverless container model without provisioning VMs or managing orchestration, and it reduces management overhead compared to alternatives like Azure Container Apps or VMs.

Answer

Use Azure Container Apps with a scale rule that triggers on queue length.

Answer

Run the worker inside an Azure virtual machine with a container runtime.

Answer

Deploy the worker as a container in ACI with the restart policy set to OnFailure.

Question 2

You deploy an Azure Function app that runs on the Consumption plan. The function writes logs to Application Insights. You notice that some log entries are missing during periods of high load. You need to ensure that all logs are captured without significantly increasing cost. What should you do?

Accepted Answer

Adjust the sampling rate in the Application Insights configuration to 100%.. Under high load, Application Insights uses adaptive sampling by default to reduce data volume, which can cause log entries to be dropped. Adjusting the sampling rate to 100% in the Application Insights configuration ensures all telemetry data is captured, while still running on the Consumption plan, which does not significantly increase cost because the function app itself scales and you only pay for execution time and resources used.

Answer

Change the function app to the Premium plan to get more CPU and memory.

Answer

Create a separate Application Insights resource for the function app.

Answer

Disable sampling in the function's host.json.

Question 3

You are designing a background job processing solution using Azure Batch. The job runs a large number of tasks that are CPU-intensive and require access to large input files stored in Azure Blob Storage. You need to minimize the time to process all tasks while controlling costs. Which THREE actions should you take?

Accepted Answer

Mount Azure Blob Storage as a file system using blobfuse to allow tasks to access files directly.. Mounting Azure Blob Storage as a file system using blobfuse allows tasks to directly access large input files without downloading them first, reducing data transfer time and eliminating local disk bottlenecks. This is critical for CPU-intensive tasks that need fast, concurrent access to shared data, minimizing overall processing time.

Answer

Set the task slots per VM to 1 to avoid contention.

Answer

Use a pool of small-sized VMs (e.g., Standard_A1_v2) to minimize cost per node.

Question 4

Your application writes millions of small records (each under 1 KB) to Azure Table Storage every day. You notice that query performance degrades over time. Which design change would most improve performance?

Accepted Answer

Use a hash of the timestamp as the PartitionKey to distribute writes evenly.. Option B is correct because using a hash of the timestamp as the PartitionKey distributes writes evenly across partition ranges, preventing hot partitions. Azure Table Storage scales by splitting partitions across storage nodes; sequential timestamps create a hot partition on the last node, degrading throughput. A hash ensures uniform load, maximizing the account's 20,000 IOPS per partition target.

Answer

Store all records in a single blob and use Blob Storage.

Answer

Increase the storage account's throughput limits.

Answer

Use a single PartitionKey and a sequential RowKey.

Question 5

You are designing a cost-effective solution to store log files that are accessed infrequently after 30 days. The logs must be retained for 7 years for compliance. Data must be available within 1 hour of a request. Which Azure Blob Storage access tier and lifecycle management rule should you use?

Accepted Answer

Use Hot tier for 30 days, then Cool tier until 90 days, then Archive tier until deletion after 7 years.. Option D is correct because it balances cost and compliance: the Hot tier handles initial frequent writes, Cool tier reduces cost for infrequent access after 30 days, and Archive tier provides the lowest-cost storage for long-term retention while still allowing rehydration within 1 hour (via High Priority rehydration). The lifecycle rule deletes the blobs after 7 years to meet compliance requirements.

Answer

Use Hot tier initially, then move to Archive after 30 days, and delete after 7 years.

Answer

Use Archive tier immediately and set a lifecycle rule to delete after 7 years.

Answer

Use Cool tier initially, then move to Archive after 30 days, and delete after 7 years.

Question 6

Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)

Accepted Answer

Storage account key (Shared Key).. Option A is correct because the storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.

Answer

Certificate-based authentication.

Answer

Managed Service Identity (MSI).

Answer

Shared access signature (SAS) token.

Question 7

You need to ensure that data stored in Azure Blob Storage is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you configure?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault. Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to use your own encryption keys to protect data at rest in Blob Storage. This feature leverages Azure Storage Service Encryption (SSE) but wraps the data encryption key with a customer-managed key stored in Azure Key Vault, providing full control over key rotation and access policies.

Answer

Azure Disk Encryption (ADE) for the storage account

Answer

Azure Information Protection (AIP) for the blob container

Answer

Azure Storage Service Encryption (SSE) with Microsoft-managed keys

Question 8

Which THREE of the following are true about Azure Storage queues? (Choose three.)

Accepted Answer

The maximum time-to-live for a message is 7 days.. Option B is correct because Azure Storage queue messages have a configurable time-to-live (TTL) with a maximum value of 7 days. Once the TTL expires, the message is automatically deleted from the queue. This is a hard limit enforced by the Azure Storage service, not a default setting.

Answer

Messages are processed in strict FIFO order.

Answer

Messages can be up to 1 MB in size.

Question 9

Which TWO of the following are features of Azure Blob Storage lifecycle management? (Choose two.)

Accepted Answer

Automatically delete blobs after a specified number of days.. Option A is correct because Azure Blob Storage lifecycle management policies allow you to define rules that automatically delete blobs after a specified number of days. This is commonly used to enforce data retention policies or clean up temporary data without manual intervention.

Answer

Automatically apply legal hold to blobs.

Answer

Automatically replicate blobs to another region.

Answer

Automatically encrypt blobs at rest.

Question 10

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. Option B is correct because the SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w

Question 11

You want to ensure that data in an Azure Storage account is replicated across multiple Azure regions to protect against regional outages. Which replication option should you choose?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within a primary region using LRS, then asynchronously replicates to a secondary region hundreds of miles away. This ensures data survives a complete regional outage because the secondary copy is available for read or write access after a failover, meeting the requirement for cross-region protection.

Answer

Locally-redundant storage (LRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Zone-redundant storage (ZRS)

Question 12

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. Option D is correct because the `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 13

Which TWO of the following are valid ways to authenticate to Azure Blob Storage from an application? (Choose two.)

Accepted Answer

Storage account access key. Option C is correct because a storage account access key provides full administrative access to the storage account, including Blob Storage. Applications can authenticate by including the key in the Authorization header using the SharedKey scheme, which HMAC-SHA256 signs the request. This is a standard, documented method for authenticating to Azure Blob Storage.

Answer

Microsoft account (personal) OAuth token

Answer

SQL Server authentication

Answer

Azure Cosmos DB primary key

Question 14

You are designing a solution that uses Azure File Shares. The application requires low-latency access to files from multiple Azure virtual machines in the same region. The files are accessed frequently and must support SMB protocol. Which storage account type and tier should you recommend?

Accepted Answer

FileStorage (premium file shares).. Option D is correct because Azure premium file shares (FileStorage) provide low-latency, high-performance access using the SMB protocol, which is required for frequently accessed files from multiple VMs in the same region. Standard tiers (cool or transaction-optimized) do not meet the low-latency requirement, and BlobStorage does not support SMB protocol natively.

Answer

Standard general-purpose v2 with cool tier.

Answer

Standard general-purpose v2 with transaction-optimized tier.

Answer

BlobStorage with hot tier.

Question 15

A company stores customer images in Azure Blob Storage. They need to reduce costs by automatically moving blobs that have not been accessed for 30 days to Cool tier, and after 90 days to Archive tier. They also need to delete blobs after one year. Which two Azure features should they implement? (Choose two.)

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policy is the correct feature because it allows you to define rules to automatically transition blobs to cooler tiers (Cool, Archive) based on the 'last accessed' or 'last modified' time, and to delete blobs after a specified period. This directly meets the requirement to move blobs after 30 days to Cool, after 90 days to Archive, and delete after one year, without manual intervention.

Answer

Azure Blob Storage object replication

Answer

Azure Blob Storage soft delete

Answer

Azure Blob Storage immutability policy

Answer

Azure Blob Storage versioning with a retention policy

Question 16

You deploy the ARM template shown in the exhibit. After deployment, you need to change the replication to geo-redundant storage (GRS) with read access (RA-GRS). What should you do?

Accepted Answer

Update the 'sku.name' to 'Standard_RAGRS' and redeploy.. Option D is correct because the ARM template initially deploys a storage account with 'Standard_GRS' (geo-redundant storage), but to enable read access to the secondary region (RA-GRS), you must change the SKU name to 'Standard_RAGRS'. Redeploying the template with this updated property updates the replication setting to RA-GRS, which provides both geo-redundancy and read access to the secondary endpoint.

Answer

Redeploy the same template; Standard_GRS already provides geo-redundancy.

Answer

Set the 'supportsHttpsTrafficOnly' property to false.

Answer

Change the 'accessTier' to 'Cool'.

Question 17

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

Accepted Answer

Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.. The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Answer

Convert the blob to an AppendBlob type.

Answer

Use the Get-AzStorageBlobContent cmdlet to download the blob directly.

Answer

Use the storage account key to access the blob.

Question 18

Your application uses Azure Queue Storage to process orders. Occasionally, messages are not processed and remain in the queue. You need to ensure that messages are automatically retried after a specified time if they are not deleted. What should you configure?

Accepted Answer

Set the message visibility timeout to a small value. Option A is correct because setting the message visibility timeout to a small value ensures that if a message is not deleted after processing (i.e., the worker fails or crashes), the message becomes visible again in the queue after the short timeout. This allows other queue consumers to retry processing the message automatically. The visibility timeout controls how long a message is hidden from other consumers after being dequeued, and a small value reduces the delay before a retry occurs.

Answer

Configure a dead-letter queue

Answer

Enable queue storage logging

Answer

Increase the message time-to-live (TTL)

Question 19

You are deploying an Azure Functions app that processes messages from an Azure Storage queue. The function must ensure that each message is processed at least once, and if processing fails, the message should be retried up to 5 times before being moved to a poison queue. Which configuration should you set?

Accepted Answer

Set the maxDequeueCount property in the host.json for the queue trigger to 5.. Option A is correct because the Azure Storage queue trigger's `maxDequeueCount` property in `host.json` controls the maximum number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 5 ensures that after 5 failed processing attempts, the message is automatically moved to the poison queue, satisfying the at-least-once processing and retry requirements without custom code.

Answer

Manually implement a retry loop in the function code.

Answer

Set the visibility timeout to 5 minutes in the queue.

Answer

Set the message time-to-live to 5 in the queue.

Question 20

You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?

Accepted Answer

Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.. Option D is correct because Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.

Answer

Use Azure Information Protection to encrypt the blobs with a customer-managed key.

Answer

Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.

Answer

Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.