AZ-204 Develop Azure compute solutions — 100 Questions

Question 1

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS termination. You need to configure these features. Which resource should you create alongside the container group?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway. Azure Application Gateway provides Layer 7 load balancing with SSL/TLS termination and custom domain support. By associating a custom domain with the Application Gateway's frontend IP and uploading an SSL certificate, you can terminate HTTPS connections at the gateway and forward traffic to the container group over HTTP. This meets the requirement without exposing the container group directly.

Answer

Azure Front Door

Answer

Azure Container Registry

Answer

Azure DNS zone

Question 2

You have an Azure Function with a Service Bus queue trigger. The function processes messages that must be handled in order within each partition of the queue. You need to ensure that the function does not process multiple messages from the same partition concurrently, while still allowing parallel processing across different partitions. Which setting should you configure?

Answer

Set the batch size to 1 in the function configuration.

Answer

Set the maxConcurrentCallsPerSession to 1, or use a session-enabled queue and set maxConcurrentSessions to 1 if using sessionId.

Answer

Use a consumption plan, which automatically limits concurrency.

Answer

Use a queue trigger instead of a Service Bus trigger.

Question 3

You are deploying a batch processing application to Azure Container Instances (ACI). The application processes multiple files from an Azure Blob Storage container and writes results to another container. Each container instance processes a single file and then exits. The processing logic is written in a Docker image that reads input and output connection strings from environment variables. You need to configure the container group so that it writes the results to the output container durably and efficiently. The environment variables must be provided at runtime but must not be exposed in the ACI configuration. Which approach should you use?

Accepted Answer

Use a managed identity for the container group, grant the identity access to an Azure Key Vault secret that contains the storage account connection string. The application retrieves the secret at startup using the managed identity and then writes directly to Azure Blob Storage.. Option B is the most secure and recommended approach for handling sensitive information like storage account connection strings in Azure Container Instances. By using a managed identity, the container group can authenticate to Azure Key Vault without storing any credentials in its configuration. The application then retrieves the secret at runtime from Key Vault. This ensures the connection string is never exposed in the ACI configuration, meeting the security requirement. While the STEM states the application currently reads from environment variables, this approach necessitates a minor adaptation in the application's secret retrieval mechanism to directly query Key Vault using the managed identity, which is a standard security best practice.

Answer

Mount an Azure File Share volume for the output container and configure the application to write output files to a directory on that share. Store the connection string for the file share in a secure fashion using Key Vault and pass it as an environment variable.

Answer

Embed the storage account connection string directly into the Docker image during build time and rely on the container's environment to provide the output blob container name.

Answer

Set the storage account connection string as an environment variable in the ACI container group definition (YAML or ARM template) and have the application use it at runtime.

Question 4

You deploy a containerized application to Azure Container Instances (ACI). The application writes state to the /data directory. You need to ensure that if the container restarts, the data persists. Which type of volume mount should you use?

Accepted Answer

Azure Files share. Azure Files shares provide a fully managed SMB file share in the cloud that can be mounted to Azure Container Instances. When a container restarts, the data written to the /data directory persists because the share lives independently of the container lifecycle, ensuring state survives crashes or restarts. Azure Disk volumes also provide persistent storage for ACI and would similarly ensure data persistence across container restarts.

Answer

emptyDir volume

Answer

hostPath volume

Answer

Azure Disk volume

Question 5

A IoT command API runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) using the app's outbound IP addresses. It works by injecting the app's outbound traffic into the VNet via a delegated subnet, allowing the app to reach private APIs hosted inside the VNet without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 6

An Azure Functions IoT command API must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used?

Accepted Answer

Premium plan. The Premium plan (Elastic Premium EP) is the correct choice because it supports VNet integration for accessing resources inside a virtual network, allows execution durations up to 30 minutes (the Consumption plan caps at 10 minutes by default), and provides serverless scaling without requiring you to manage virtual machines. This plan also offers always-ready instances to reduce cold start latency, which is critical for IoT command APIs.

Answer

Azure Batch pool

Answer

Consumption plan

Answer

App Service Free tier

Question 7

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS termination. You need to configure these features. Which resource should you create alongside the container group?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy both containers in the same App Service plan using multiple containers.. To run both containers in the same App Service plan for cost minimization and allow independent scaling, you must deploy each container as a separate Azure App Service app within the same App Service plan. This allows each app (and thus each container) to be scaled independently based on its own load. Using Docker Compose (option B) or the multi-container feature in App Service scales all containers as a single unit, failing the independent scaling requirement. Option A (AKS) and Option D (ACI) deploy the worker outside the App Service plan, violating the cost minimization goal. None of the provided options perfectly describe this correct approach without ambiguity or contradiction.

Answer

Deploy the web front-end in App Service and the worker in Azure Kubernetes Service.

Answer

Use Docker Compose to run both containers in the same App Service plan.

Answer

Deploy the worker as a separate Azure Container Instance.

Question 8

You are designing a serverless application using Azure Functions. The application processes messages from Azure Service Bus. You need to ensure that processing is idempotent and that messages are not lost. Which THREE actions should you take?

Accepted Answer

Implement idempotency in the function logic.. Option B is correct because idempotency in the function logic ensures that if the same message is delivered more than once (which Service Bus can do under at-least-once delivery), reprocessing does not produce duplicate side effects, satisfying the requirement for idempotent processing. Option C is correct because PeekLock mode lets the function receive a message with a lock and only call Complete after successful processing, so a crash or failure before completion causes the lock to expire and the message to be redelivered rather than lost. Option E is correct because setting the max delivery count on the queue bounds retries and moves poison messages to the dead-letter queue after the limit is reached, preventing infinite retry loops while preserving the message for investigation. Option A is not required for idempotency or message durability; batching is a throughput optimization and can even complicate per-message completion semantics. Option D is incorrect because AutoComplete marks messages complete as soon as the function returns successfully, which can lose messages if the function fails after receiving but before fully processing, and it removes the explicit control needed for reliable completion.

Answer

Process messages in batches to improve throughput.

Answer

Use the AutoComplete option to automatically mark messages as complete.

Question 9

You are developing an Azure Logic App that processes files from an FTP server. The workflow must run every 10 minutes and process only new files. You need to ensure that files are not processed more than once. What should you use?

Accepted Answer

Use the FTP trigger 'When a file is added' with a recurrence of 10 minutes.. The 'When a file is added' FTP trigger in Azure Logic Apps automatically tracks processed files using a built-in 'trigger state' mechanism. When combined with a recurrence schedule (e.g., every 10 minutes), it ensures that only new files since the last run are processed, preventing duplicate processing without external state management.

Answer

Use the 'When a file is added' trigger and store processed file names in a SQL database.

Answer

Use the FTP trigger 'When a file is added or modified' with a recurrence of 10 minutes.

Answer

Use the Sliding Window trigger and set the window size to 10 minutes.

Question 10

You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?

Accepted Answer

Use the Microsoft.Identity.Web library to validate the token.. Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.

Answer

Configure the Azure Functions host to use Microsoft Entra ID authentication.

Answer

Use the Microsoft Authentication Library (MSAL) to validate the token.

Answer

Use Azure AD B2C to validate the token.

Question 11

You are designing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job is expected to run for up to 2 hours. You need to minimize costs. Which ACI configuration should you use?

Accepted Answer

Use a container group with a restart policy of 'OnFailure' or 'Never'.. Setting the restart policy to 'OnFailure' or 'Never' ensures that the container does not restart after the batch job completes, avoiding unnecessary compute charges. ACI bills per second of container runtime, so any idle or restarted container time directly increases cost. For a finite batch job, a restart policy that prevents automatic restarts is the most cost-effective choice.

Answer

Use GPU-enabled containers for faster processing.

Answer

Deploy the container group in a virtual network.

Answer

Use a container group with a restart policy of 'Always'.

Question 12

The web app is connected to a GitHub repository via Continuous Deployment. You push a new commit to the 'main' branch, but the web app does not update. What is the most likely cause?

Accepted Answer

The GitHub webhook is not configured to trigger on push events.. The web app is configured for Continuous Deployment via GitHub, which relies on a webhook to notify Azure App Service of new commits. When a push event occurs on the 'main' branch, the webhook must be configured to trigger the deployment. If the webhook is not set to fire on push events, Azure will never receive the notification, and the app will not update despite the new commit.

Answer

The repository is Mercurial, not Git.

Answer

The deployment rollback is enabled and blocking new deployments.

Answer

The 'branch' property is set to 'main', but the actual branch is 'master'.

Question 13

You deploy the above ARM template resource for a web app. The web app reads the connection string from the 'DefaultConnection' name. However, the web app fails to connect to the database with an error 'Login failed for user 'myuser'. What is the most likely cause?

Accepted Answer

The SQL server is configured to use Microsoft Entra authentication only, not SQL authentication.. The error 'Login failed for user 'myuser'' indicates that SQL authentication is failing. If the SQL server is configured to use Microsoft Entra authentication only, SQL logins are disabled, so the connection string using SQL authentication (user ID and password) will fail. This is the most likely cause.

Answer

The user ID does not have access to the database.

Answer

The connection string type should be 'SQLServer' instead of 'SQLAzure'.

Answer

The connection string is missing 'Trusted_Connection=True;'.

Question 14

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. Which TWO features should you enable to ensure the function processes events in order and exactly once?

Accepted Answer

Process events in batches. Option B (Process events in batches) is correct because the Event Hubs trigger delivers events to a function as an ordered batch from a single partition, and processing the batch as a unit preserves the partition's sequence order while allowing the function to commit progress for the whole batch. Option C (Implement checkpointing in the function) is correct because the Event Hubs trigger's checkpointing mechanism (storing offsets in the associated storage account) records which events have been successfully processed, so on restart or scale-out the function resumes after the last checkpoint and avoids reprocessing, which is how exactly-once processing is approximated. Option A (Durable Functions) is not required here because durable orchestrations address stateful workflow coordination, not Event Hubs partition ordering or offset checkpointing. Option D (session support) is not applicable because Event Hubs sessions are used for ordered processing of session-affiliated events, not for the standard Event Hubs trigger's exactly-once semantics. Option E (retry policy) only handles transient failures and does not by itself guarantee ordering or exactly-once delivery.

Answer

Durable Functions

Answer

Enable session support on Event Hubs and use the session-enabled trigger

Answer

Use a retry policy in the function

Question 15

You are designing a solution that uses Azure Functions to process messages from an Azure Service Bus queue. Which TWO configurations can improve the throughput of the function?

Accepted Answer

Set maxMessagesPerBatch to a higher value. Option B is correct because increasing maxMessagesPerBatch (the Service Bus trigger's maxMessageCount/batch size) lets each function invocation pull and process more queue messages at once, raising overall throughput. Option C is correct because lowering newBatchThreshold causes the host to dispatch a new function instance sooner (as soon as the in-flight count drops below the threshold), increasing parallelism and message consumption rate. Option A is wrong because maxDeliveryCount only controls how many times a message is retried before dead-lettering; it does not affect processing throughput. Option D is wrong because reducing maxMessagesPerBatch processes fewer messages per invocation, lowering throughput. Option E is wrong because maxEventBatchSize is an Event Hubs trigger setting, not a Service Bus queue trigger setting, so it does not apply here.

Answer

Set maxDeliveryCount to a higher value

Answer

Set maxMessagesPerBatch to a lower value

Answer

Set maxEventBatchSize to a higher value

Question 16

You are developing a serverless application using Azure Functions. The function needs to scale to zero when idle and handle high traffic spikes. Which THREE features should you implement?

Accepted Answer

Use a Consumption hosting plan. Option A (Use a Consumption hosting plan) is correct because the Consumption plan is the only Azure Functions hosting model that scales to zero when idle and bills per execution, which directly satisfies the scale-to-zero requirement. Option B (Use a queue trigger for processing) is correct because queue-triggered functions (e.g., Azure Storage Queue or Service Bus) decouple producers from consumers and let the scale controller add instances based on queue length, which is the standard pattern for absorbing high traffic spikes. Option C (Leverage the built-in scaling controller for automatic scaling) is correct because the Azure Functions scale controller monitors trigger metrics (queue depth, Event Hub events, etc.) and dynamically adds or removes worker instances, enabling elastic scaling under load. Option D (Enable the 'Always On' setting) is not correct because Always On keeps the app loaded and prevents idle unload, which contradicts the scale-to-zero requirement and is only available on App Service/Premium plans. Option E (Use a Premium hosting plan) is not correct because although Premium supports pre-warmed instances and VNet integration, it does not scale to zero when idle (it requires a minimum of one always-ready instance).

Answer

Enable the 'Always On' setting

Answer

Use a Premium hosting plan

Question 17

You are deploying a containerized application to Azure Container Instances (ACI). Which TWO actions should you take to ensure the container can securely access an Azure Key Vault?

Accepted Answer

Enable a managed identity for the container group. To securely access Azure Key Vault from Azure Container Instances, the recommended approach is to enable a managed identity for the container group. This allows the container to authenticate to Key Vault without requiring any credentials in the container image or code. The managed identity is integrated with Microsoft Entra ID, and the container can request an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. This token authorizes requests to Key Vault, ensuring secrets are never exposed. Note that Azure Container Instances does not support mounting a volume directly from Key Vault; the volume mount option shown in option C is not available in ACI.

Answer

Pass secrets as environment variables

Answer

Mount a volume that maps to a Key Vault secret store

Answer

Register the container with an Azure AD application

Answer

Configure a custom DNS server

Question 18

Refer to the exhibit. You are deploying this ARM template to create a deployment slot for an Azure App Service. The template deploys successfully. However, the slot-specific app setting 'DEPLOYMENT_SLOT' is not visible in the Azure portal under the slot's Configuration > Application settings. What is the most likely cause?

Accepted Answer

The template does not set 'slotSticky' to true for the app setting. In ARM templates, app settings are made slot-specific (sticky) by explicitly listing them in the 'appSettingNames' property of a 'Microsoft.Web/sites/slots/config' resource with the name 'slotConfigNames'. Without this configuration, the setting is treated as a regular, non-sticky app setting. While it will still appear under the slot's Configuration > Application settings in the Azure portal, it will not be marked as a 'Deployment slot setting' and thus will not be pinned to the deployment slot during a swap.

Answer

Slot settings are not supported in ARM templates

Answer

Deployment slots have been deprecated for App Service

Answer

The app setting name must be prefixed with 'APPSETTING_'

Question 19

Refer to the exhibit. You have an Azure App Service that uses the authentication settings shown. Users report that they are repeatedly prompted to sign in even after authenticating. What is the most likely cause?

Accepted Answer

The 'loginParameters' does not include 'offline_access'.. The most likely cause is that the 'loginParameters' does not include 'offline_access'. For Azure App Service Authentication (Easy Auth) to maintain a user's session without repeated sign-ins, it needs to be able to refresh the access token silently. This requires a refresh token, which is only issued by Microsoft Entra ID if the 'offline_access' scope is explicitly requested during the initial login. Without this scope, no refresh token is provided, and once the access token expires (typically after 1 hour), the user is prompted to sign in again.

Answer

The 'allowedAudiences' is missing the App Service URL.

Answer

The 'issuer' URL is incorrect; it should be a tenant-specific endpoint.

Answer

No 'tokenRefreshEndpoint' is configured for session management.

Question 20

Which TWO features of Azure App Service can help you reduce application downtime during deployments?

Accepted Answer

Deployment slots.. Deployment slots (C) let you deploy a new version to a separate staging slot with its own hostname while the production slot keeps serving traffic, so the app stays available until you are ready to promote the build. Slot swap with auto-swap (E) performs a VIP swap that warms up the target slot and swaps the hostnames, and auto-swap can trigger the swap automatically after a successful deployment, minimizing the cutover window and downtime. Continuous deployment from GitHub (A) only automates build and release triggering; it does not itself provide a zero-downtime cutover mechanism. Traffic Manager (B) is a DNS-based global load-balancing and failover service, not an App Service deployment feature that reduces downtime during a slot-based release. Auto-heal (D) restarts or recycles a misbehaving app based on rules, which addresses runtime faults rather than deployment downtime.

Answer

Continuous deployment from GitHub.

Answer

Traffic Manager.

Answer

Auto-heal.