AZ-204 Practice Test 9 — 10 Questions

Question 1

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 2

Your company runs a critical web application on Azure App Service (Windows) that experiences intermittent high CPU usage. The application uses the Standard tier with auto-scaling based on CPU percentage. During auto-scale events, there is a delay of several minutes before new instances become available, causing temporary performance degradation. You need to reduce the latency of scaling out. What should you do?

Accepted Answer

Enable the 'Always On' setting in the App Service application settings.. The 'Always On' setting prevents the App Service from being unloaded after periods of inactivity, which reduces the cold-start latency when new instances are added during auto-scale events. Without 'Always On', idle instances may be recycled, causing delays of several minutes as the application re-initializes on new VMs.

Answer

Configure auto-scaling to use HTTP queue length as the metric.

Answer

Upgrade the App Service plan to the Premium tier.

Answer

Change the auto-scale metric to memory percentage instead of CPU.

Question 3

You need to process large volumes of streaming data from IoT devices in near real-time. The processed data must be stored in Azure Cosmos DB for further analysis. Which Azure service should you use for stream processing?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is purpose-built for real-time stream processing, capable of ingesting large volumes of data from sources like Azure Event Hubs or IoT Hub, applying SQL-based queries, and outputting results directly to Azure Cosmos DB. This aligns perfectly with the requirement for near real-time processing and storage in Cosmos DB.

Answer

Azure Batch

Answer

Azure Databricks

Answer

Azure Data Lake Storage

Question 4

Refer to the exhibit. You deploy the ARM template to create an Azure Key Vault. After deployment, you attempt to add an access policy to grant a user 'Get' secret permissions using the Azure portal, but the option is grayed out. What is the most likely reason?

Accepted Answer

RBAC authorization is enabled, so access policies are not used. When Azure Key Vault is configured to use Azure RBAC (Role-Based Access Control) for authorization, the traditional access policy UI is disabled. The ARM template in the exhibit sets 'enableRbacAuthorization' to true, which switches the vault's authorization model from vault-level access policies to Azure RBAC roles. In this mode, you must assign roles (e.g., Key Vault Secrets User) via Azure RBAC instead of adding access policies.

Answer

The vault is disabled due to 'enableSoftDelete'

Answer

The property 'enabledForDeployment' is set to false

Answer

Soft delete is enabled, which prevents access policy changes

Question 5

You are building a solution that needs to process large CSV files uploaded to Azure Blob Storage. Each file can be up to 1 GB. You want to minimize processing time and cost. Which approach should you recommend?

Accepted Answer

Use Azure Data Factory to copy the data from Blob Storage to Azure SQL Database and perform transformations.. Azure Data Factory (ADF) is the correct choice because it is a fully managed, serverless data integration service designed for high-scale data movement and transformation. ADF can directly read large CSV files from Blob Storage using Copy Activity with built-in parallelization and chunking, then transform the data using Mapping Data Flows or stored procedures in Azure SQL Database, all without provisioning VMs or managing infrastructure. This minimizes both processing time (via scale-out) and cost (pay-per-use, no idle compute).

Answer

Use Azure Logic Apps to trigger a function that parses the CSV and inserts into Cosmos DB.

Answer

Download the file to an Azure VM and use a custom script to parse and insert into a database.

Answer

Use Azure Stream Analytics to read the CSV from Blob Storage and output to a data warehouse.

Question 6

A company uses Azure SQL Database and needs to encrypt sensitive columns (e.g., credit card numbers) at rest and in transit, with the ability to allow specific applications to decrypt. They want to manage encryption keys centrally in Azure Key Vault and avoid managing certificates. Which technology should they use?

Accepted Answer

Always Encrypted with column master key in Azure Key Vault.. Always Encrypted with a column master key stored in Azure Key Vault is the correct choice because it encrypts sensitive columns (like credit card numbers) at rest and in transit, ensuring data remains encrypted throughout the entire pipeline, including during query processing. The column master key in Azure Key Vault allows centralized key management without handling certificates, and only applications with access to the corresponding column encryption key can decrypt the data, meeting the requirement for application-specific decryption.

Answer

Transparent Data Encryption (TDE) with Azure Key Vault.

Answer

Dynamic Data Masking (DDM) with Azure Key Vault.

Answer

Row-Level Security (RLS) with Azure Key Vault.

Question 7

You are reviewing an Azure Policy definition that applies to storage accounts. The policy has an effect of 'deny' and specifies network ACLs. What is the intended behavior of this policy?

Accepted Answer

Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny. The Azure Policy definition with effect 'deny' and network ACL conditions will block the creation of any storage account that does not include a virtual network rule allowing 'vnet1' and does not have the default action set to 'Deny'. This ensures that only storage accounts with the specified network restrictions are permitted, enforcing a security baseline that denies all traffic except from the allowed virtual network.

Answer

Allow all storage accounts to be created regardless of network rules

Answer

Deny all traffic to storage accounts

Answer

Allow only traffic from the specified virtual network

Question 8

A Blob Storage workflow for product images must prevent accidental overwrite and support recovery of prior versions. Which two features should be enabled?

Accepted Answer

Blob soft delete. Blob soft delete (B) protects against accidental deletion or overwrite by retaining deleted blobs for a configurable retention period, allowing recovery. Blob versioning (D) automatically maintains prior versions of a blob, enabling restoration of any previous state. Together, they provide comprehensive protection against overwrites and support version recovery.

Answer

SFTP support

Answer

Static website hosting

Question 9

A company is building a microservices application on Azure Container Instances. Each microservice needs to authenticate to Azure Key Vault to retrieve secrets. They want to avoid storing any credentials in the container images or environment variables. What should they do?

Accepted Answer

Enable managed identity for the container group and grant it access to Key Vault.. Azure Container Instances supports managed identities, allowing the container group to authenticate to Azure Key Vault without any credentials stored in the image or environment variables. By enabling a system-assigned or user-assigned managed identity on the container group and granting that identity the appropriate Key Vault access policy (e.g., 'Get' secret permission), the application can acquire an Azure AD token from the Instance Metadata Service (IMDS) endpoint and use it to retrieve secrets securely.

Answer

Use Docker secrets mounted as volumes.

Answer

Use a shared access signature (SAS) token to access Key Vault.

Answer

Store the Key Vault URI and a client secret in environment variables.

Question 10

Your company runs a web application on Azure App Service that uses a custom domain. The application must be accessible only via HTTPS. You have already uploaded an SSL certificate for the custom domain. However, users can still access the site via HTTP. You need to enforce HTTPS redirection. What should you do?

Accepted Answer

Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.. The 'HTTPS Only' setting in the App Service's TLS/SSL settings blade enforces that all incoming requests are redirected from HTTP to HTTPS at the platform level, before any application code runs. Since you have already uploaded an SSL certificate, enabling this setting ensures that users cannot access the site via HTTP, meeting the requirement without modifying application code.

Answer

Set the 'Minimum TLS Version' to 1.2.

Answer

Add a rewrite rule in the web.config file to redirect HTTP to HTTPS.

Answer

Configure the App Service to require client certificates.