AZ-204 Practice Test 8 — 10 Questions

Question 1

You are a developer at a global e-commerce company. The company uses Azure Blob Storage to store product images and customer uploads. The application is deployed in the East US region. You need to design a solution that meets the following requirements: - Customers upload images (up to 10 MB) that must be immediately accessible worldwide after upload. - You must minimize egress costs for data transfer from Azure to customers. - The solution must be resilient to regional outages. - You must not use any custom caching logic. Which approach should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Front Door with caching enabled, and point it to a single Blob Storage account in East US.. Azure Front Door with caching enabled provides global HTTP caching at Microsoft edge nodes, which minimizes egress costs by serving cached content from the edge closest to the user. It also offers built-in regional failover for resilience, and requires no custom caching logic. This meets all requirements: immediate global accessibility, minimized egress costs, regional outage resilience, and no custom caching.

Answer

Use read-access geo-redundant storage (RA-GRS) and direct customers to the secondary endpoint for reads.

Answer

Use Premium Block Blob storage in multiple regions and use Traffic Manager for routing.

Answer

Use Azure CDN from Microsoft with the storage account as origin, and enable geo-replication on the storage account.

Question 2

Your web app running on Azure App Service requires access to a storage account using managed identity. You enable the system-assigned managed identity on the App Service and assign the 'Storage Blob Data Contributor' role at the storage account scope. However, the app receives 403 errors when trying to read blobs. What is the most likely cause?

Accepted Answer

The managed identity token is being requested with the wrong audience. You need to specify 'https://storage.azure.com' as the resource.. When using managed identity with Azure Storage, the access token must be requested with the correct audience (resource). For Azure Blob Storage, the audience must be 'https://storage.azure.com'. If the app requests the token with a different audience (e.g., the default Azure Resource Manager endpoint 'https://management.azure.com'), the token will be rejected by the storage service, resulting in a 403 error despite the role assignment being in place.

Answer

Managed identity is not supported for Azure App Service; use a connection string instead.

Answer

The role assignment has not propagated yet; wait 30 minutes.

Answer

The storage account has a firewall rule that blocks the App Service outbound IPs.

Question 3

A web app experiences intermittent high latency. You discover that the Azure SQL database is experiencing a high number of connection timeouts. The application uses Entity Framework Core with the default connection pooling settings. You need to improve database connection reliability without changing the application code. What should you do?

Accepted Answer

Set the Minimum Pool Size to 10 in the connection string.. Setting the Minimum Pool Size to 10 pre-creates a baseline of open connections in the pool, reducing the frequency of new connection creations during traffic spikes. This mitigates intermittent connection timeouts caused by the default pool starting empty and struggling to keep up with demand under high latency. Since the application uses Entity Framework Core with default pooling, this change is applied via the connection string without modifying code.

Answer

Increase the maximum pool size in the connection string.

Answer

Set the Connection Lifetime to 300 seconds.

Answer

Enable Multipool in the connection string.

Question 4

You need to reduce costs for an Azure Functions app that runs intermittently. The current Consumption plan bills for execution time. Which change would be MOST cost-effective?

Accepted Answer

Migrate to Flex Consumption plan with higher memory. The Flex Consumption plan allows you to configure per-instance memory and concurrency settings, which can reduce costs for intermittent workloads by optimizing resource usage. Unlike the standard Consumption plan, Flex Consumption lets you set higher memory limits without paying for idle time, making it more cost-effective for functions that run sporadically but require more memory when active.

Answer

Switch to Premium plan with pre-warmed instances

Answer

Use an App Service plan with Always On

Answer

Deploy to Azure Container Instances

Question 5

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to detect and automatically respond to a potential credential theft attack where an anomalous number of failed logins are followed by a successful login from a different geographic location. Which Microsoft Sentinel feature should you use?

Accepted Answer

An analytics rule with an automated response. An analytics rule in Microsoft Sentinel can be configured to detect patterns like anomalous failed logins followed by a successful login from a different geography. The rule can then trigger an automated response, such as running a playbook or creating an incident, to remediate the threat in near real-time. This combines detection and automated action within a single rule, making it the correct choice for this scenario.

Answer

Microsoft Sentinel Data Connectors

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel playbooks

Question 6

You are developing a web application that runs on Azure App Service. The application needs to store session state. Which Azure service provides the best performance and reliability for session state storage?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis provides the best performance and reliability for session state storage because it is an in-memory data store with sub-millisecond latency, designed for high-throughput, low-latency scenarios like session caching. It supports session state providers natively in ASP.NET and ASP.NET Core, ensuring fast reads and writes for each user request without the overhead of disk I/O or network latency associated with other storage options.

Answer

Azure Table Storage

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 7

You run the command above to create an Azure Container Instance. The container exits with a non-zero exit code. You need to check the logs to debug the issue. Which command should you use next?

Accepted Answer

az container logs --resource-group myRG --name mycontainer. The correct command is `az container logs` because it retrieves the stdout and stderr logs from a container that has exited, which is essential for debugging exit code failures. Since the container has already exited with a non-zero exit code, you need to inspect its logged output to understand the cause of the failure, and this command directly fetches those logs without requiring an active container.

Answer

az container attach --resource-group myRG --name mycontainer

Answer

az container exec --resource-group myRG --name mycontainer --exec-command /bin/sh

Answer

az container show --resource-group myRG --name mycontainer --query containers[0].instanceView.currentState.exitCode

Question 8

A developer accidentally deleted a secret from Azure Key Vault. Soft-delete is enabled with a retention period of 90 days. After 60 days, you attempt to recover the secret. What should you do?

Accepted Answer

Run the Azure CLI command: az keyvault secret recover. When soft-delete is enabled on Azure Key Vault, deleted secrets are retained for the specified retention period (90 days in this case). Since only 60 days have passed, the secret is still in a soft-deleted state and can be recovered using the `az keyvault secret recover` command, which restores the secret to an active state.

Answer

Enable purge protection on the Key Vault first, then recover the secret.

Answer

Recover is not possible because the retention period of 90 days has not elapsed.

Answer

Run the Azure CLI command: az keyvault secret undelete

Question 9

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 10

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow