AZ-204 Practice Exam 62 — 20 Questions

Question 1

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.. Option D is correct because lifecycle management rules in Azure Storage use the 'daysAfterModificationGreaterThan' condition to trigger actions based on the last modification time of a blob. This allows you to tier blobs to archive after 30 days and delete them after 365 days, which aligns with the requirement to manage blobs based on age when access tracking is not enabled.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.

Question 2

You are designing a solution to store large amounts of structured data that is accessed frequently and requires low-latency reads. The data must be globally distributed and support automatic failover. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and automatic failover.. Azure Cosmos DB with multi-region writes and automatic failover is the correct choice because it provides globally distributed, low-latency reads and writes with automatic failover at the database level. It supports multiple consistency models and guarantees single-digit millisecond read latencies, making it ideal for frequently accessed structured data that requires global distribution and high availability.

Answer

Azure Table Storage with geo-replication.

Answer

Azure SQL Database with active geo-replication and failover groups.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS).

Question 3

You are designing a solution that requires storing millions of small (1-5 KB) messages from IoT devices. Each message has a unique device ID and timestamp. You need to support efficient point queries by device ID and time range, and also support aggregation queries (e.g., count of messages per device per hour). Which Azure storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is the correct choice because it is a NoSQL key-value store optimized for storing large volumes of structured, non-relational data. It supports efficient point queries using the PartitionKey (device ID) and RowKey (timestamp), enabling fast retrieval by device ID and time range. Additionally, it allows aggregation queries like counting messages per device per hour via partition-scanned queries or client-side aggregation, and it is cost-effective for storing millions of small (1-5 KB) messages.

Answer

Azure Cosmos DB for NoSQL

Answer

Azure Queue Storage

Answer

Azure Blob Storage with JSON files

Question 4

Which TWO Azure Blob Storage access tiers are optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Archive. The Cool tier is optimized for data that is infrequently accessed and stored for at least 30 days, offering lower storage costs than Hot but higher access costs. The Archive tier is optimized for rarely accessed data with a minimum storage duration of 180 days, but it also supports infrequent access patterns and is often considered for long-term retention. Both Cool and Archive tiers are designed for infrequently accessed data, with Cool having a 30-day minimum and Archive a 180-day minimum, making them the correct answers for the 30-day requirement.

Answer

Transactional

Answer

Premium

Answer

Hot

Question 5

Which THREE Azure Storage features can be used to enforce immutability for compliance requirements?

Accepted Answer

Blob versioning with delete lock policy. Option A is correct because blob versioning with a delete lock policy prevents deletion of blob versions, effectively enforcing immutability by ensuring that once a version is created, it cannot be deleted or overwritten. This satisfies compliance requirements such as SEC 17a-4(f) or FINRA rules that mandate data preservation.

Answer

Soft delete for blobs

Answer

Storage account firewall rules

Question 6

You are developing an application that writes telemetry data to Azure Table Storage. Each telemetry event is about 5 KB in size, and the application writes up to 10,000 events per second. The data is queried by device ID and timestamp range. What is the most efficient partitioning strategy to maximize write throughput and query performance?

Accepted Answer

Use device ID as the partition key and timestamp as the row key.. Option B is correct because using device ID as the partition key distributes writes across multiple partitions, avoiding throttling from a single partition's scalability limit (up to 20,000 operations per second per partition). Using timestamp as the row key enables efficient range queries for a specific device within a time window, leveraging the table's natural sort order on row key.

Answer

Use timestamp as the partition key and device ID as the row key.

Answer

Use device type as the partition key and timestamp as the row key.

Answer

Use a single partition key for all events and use timestamp as the row key.

Question 7

You are using Azure File Storage to share configuration files across multiple virtual machines running a legacy application. The application requires SMB 3.0 protocol with encryption. You need to ensure the file share is accessible from all VMs without exposing it to the internet. Which configuration should you use?

Accepted Answer

Create a storage account with a private endpoint and mount the file share using the private IP. Option D is correct because a private endpoint assigns the storage account a private IP address from your virtual network, allowing VMs to access the file share over SMB 3.0 with encryption without exposing the storage account to the public internet. This meets the requirement for secure, private connectivity while supporting the legacy application's SMB 3.0 protocol needs.

Answer

Create a storage account with a shared access signature (SAS) token and mount using the SAS URL

Answer

Create a storage account with a public endpoint and use a VPN gateway to connect the VMs

Answer

Create a storage account with a public endpoint and configure the firewall to allow only the VNet

Question 8

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.. Option D is correct because Azure Blob Storage triggers in Azure Functions support path patterns that filter on blob name extensions, such as 'images/{name}.jpg' and 'images/{name}.png'. This allows the function to only fire when a blob with a matching extension is created, effectively ignoring non-image files without any runtime code or additional services.

Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Implement the function without filtering and check the content type inside the function, ignoring non-image blobs.

Question 9

Your application runs on Azure App Service and needs to access Azure Queue Storage. You want to avoid storing connection strings in configuration files. Which approach should you use?

Accepted Answer

Use a system-assigned managed identity with RBAC role 'Storage Queue Data Contributor' on the queue.. Option B is correct because using a system-assigned managed identity for an Azure App Service allows it to authenticate to Azure Queue Storage without any stored secrets. By assigning the 'Storage Queue Data Contributor' RBAC role, the app gains the necessary permissions to read, write, and delete queue messages, and the identity is automatically managed by Azure AD, eliminating the need for connection strings.

Answer

Hardcode the connection string in the application code.

Answer

Use an environment variable in the App Service configuration.

Answer

Store the connection string in Azure Key Vault and retrieve it at runtime using Key Vault references.

Question 10

You need to store a large number of small files (each < 100 KB) that will be accessed frequently from a web application. The files are static assets (CSS, JavaScript, images). Which Azure storage option provides the best performance for serving these files directly to users?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large volumes of unstructured data, including small static files. By integrating Azure CDN, you cache these files at edge nodes closer to users, drastically reducing latency and offloading origin requests. This combination provides the best performance for frequently accessed static assets served directly to a web application's users.

Answer

Azure Queue Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 11

Which TWO Azure services can be used to trigger an Azure Function when a new blob is created in a storage account? (Choose two.)

Accepted Answer

Azure Event Grid trigger. Option C is correct because Azure Event Grid provides a native event-driven integration that can trigger an Azure Function when a new blob is created. By subscribing to the 'Microsoft.Storage.BlobCreated' event, Event Grid delivers low-latency, reliable HTTP-based events directly to the function, making it ideal for high-throughput, serverless workflows.

Answer

Azure Cosmos DB trigger

Answer

Azure Queue Storage trigger

Answer

Azure Service Bus trigger

Question 12

You are building a web application that stores user-uploaded images in Azure Blob Storage. The application requires that images be accessible only via a time-limited URL. Which security mechanism should you use?

Accepted Answer

Generate a shared access signature (SAS) token for each blob.. A shared access signature (SAS) token provides delegated, time-limited access to a specific blob without exposing the storage account key. By generating a SAS token with an expiration time, you can enforce that the image URL is only valid for a limited period, meeting the requirement exactly. This is the standard Azure mechanism for granting granular, time-bound access to blob storage resources.

Answer

Use storage account access keys in the application code.

Answer

Assign the 'Storage Blob Data Reader' role to the application's managed identity.

Answer

Use Azure Key Vault to store and retrieve the storage account key.

Question 13

Which THREE of the following are true about Azure Blob Storage lifecycle management?

Accepted Answer

It can automatically move blobs to the Cool tier after a specified number of days.. Option B is correct because Azure Blob Storage lifecycle management policies can automatically transition blobs to the Cool tier after a specified number of days. This is achieved by defining a rule with a 'tierToCool' action and a 'daysAfterModificationGreaterThan' filter, allowing cost optimization based on data access patterns.

Answer

It can be defined at the container level.

Answer

It can change the replication type of the storage account.

Question 14

You are creating an Azure function that uses an output binding to write messages to an Azure Storage Queue. The function must ensure that messages are not lost if the function fails after writing to the queue. Which approach should you use?

Accepted Answer

Use the queue output binding with a queue trigger input binding in the same function.. Option D is correct because using a queue output binding with a queue trigger input binding in the same function ensures that the message is only written to the queue after the function execution completes successfully. If the function fails after the write, the output binding automatically rolls back the write, preventing message loss. This is achieved through the Azure Functions runtime's transactional behavior with storage bindings.

Answer

Use a separate queue client SDK to write messages and handle errors manually.

Answer

Write to the queue directly in the function code and rely on the function's retry policy.

Answer

Use a durable function to orchestrate the writing and processing.

Question 15

You need to securely connect an on-premises application to Azure Blob Storage without exposing data to the public internet. Which feature should you use?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint uses a private IP address from your virtual network to connect to Azure Blob Storage over the Microsoft backbone network, ensuring traffic never traverses the public internet. This provides a secure, private connection for on-premises applications via VPN or ExpressRoute, meeting the requirement to avoid public exposure.

Answer

IP firewall rules on the storage account

Answer

Storage account access keys

Answer

Shared access signature (SAS) with stored access policy

Question 16

You need to grant access to a blob stored in Azure Blob Storage for 30 minutes to a user who does not have an Azure account. Which security mechanism should you use?

Accepted Answer

Shared Access Signature (SAS) token. A Shared Access Signature (SAS) token is the correct choice because it provides delegated, time-limited access to a specific blob resource without requiring the user to have an Azure account. You can set the token's expiry to 30 minutes, granting temporary access via a URI that includes the necessary authentication parameters. This mechanism is designed for scenarios where you need to grant granular, time-bound access to external users or clients.

Answer

Azure RBAC roles

Answer

Storage account access keys

Answer

Managed identity

Question 17

You need to grant a user access to read and write blobs in a specific container for exactly 24 hours. The user is external to your organization. Which two methods can you use? (Choose two.)

Accepted Answer

Create a shared access signature (SAS) token with an expiry time of 24 hours. Option A is correct because a shared access signature (SAS) token can be scoped to a specific container and granted read and write permissions, with an expiry time set to exactly 24 hours. This allows the external user to access only that container for the specified duration without exposing the storage account key or requiring Azure AD authentication.

Answer

Share the storage account access key with the user

Answer

Create an account SAS token with read and write permissions

Answer

Assign the 'Storage Blob Data Contributor' role to the user's Microsoft account

Question 18

You are developing an application that writes blobs to Azure Blob Storage. The application requires high throughput and must handle transient failures. You need to implement a retry policy. Which approach should you use?

Accepted Answer

Configure the retry policy in the Azure.Storage.Blobs SDK. The Azure.Storage.Blobs SDK provides built-in retry policies (e.g., ExponentialRetry, FixedRetry) that handle transient failures automatically with configurable delays, retry counts, and backoff strategies. This is the recommended approach because it integrates directly with the SDK's client pipeline, respects service throttling, and avoids blocking threads or reinventing error handling logic.

Answer

Use a circuit breaker pattern

Answer

Implement a custom retry loop with Thread.Sleep

Answer

Generate a SAS token with a long expiry

Question 19

Your application writes millions of small log entries per hour to an Azure Storage account. You notice throttling errors (HTTP 503) during peak traffic. You need to minimize throttling without changing the application code. What should you do?

Accepted Answer

Use a separate storage account for log data. Option B is correct because using a separate storage account for log data isolates the high-volume write traffic from other workloads, distributing the request load across different storage account endpoints. Azure Storage accounts have scalability targets (e.g., up to 20,000 requests per second per account for blob storage), and splitting logs into a dedicated account prevents hitting those limits, reducing HTTP 503 throttling errors without requiring code changes.

Answer

Request a storage account limit increase from Azure Support

Answer

Change the replication type to geo-redundant storage (GRS)

Answer

Enable soft delete on the blob container

Question 20

You are migrating an on-premises application to Azure. The application uses a network file share (NFS) to store files. You need to minimize code changes. Which Azure storage service should you use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the Server Message Block (SMB) protocol and the Network File System (NFS) protocol. Since your on-premises application already uses an NFS share, migrating to Azure Files with NFS support allows you to mount the share directly with minimal code changes, as the application can continue to use the same file system semantics and NFS client calls.

Answer

Azure Disk Storage

Answer

Azure Blob Storage

Answer

Azure Queue Storage