AZ-204 Develop Azure compute solutions — 25 Questions

Question 1

You have an Azure Function with a Service Bus queue trigger. The function processes messages that must be handled in order within each partition of the queue. You need to ensure that the function does not process multiple messages from the same partition concurrently, while still allowing parallel processing across different partitions. Which setting should you configure?

Choose an answer to begin — your selection is scored in the full session.

Answer

Set the batch size to 1 in the function configuration.

Answer

Set the maxConcurrentCallsPerSession to 1, or use a session-enabled queue and set maxConcurrentSessions to 1 if using sessionId.

Answer

Use a consumption plan, which automatically limits concurrency.

Answer

Use a queue trigger instead of a Service Bus trigger.

Question 2

You are deploying a batch processing application to Azure Container Instances (ACI). The application processes multiple files from an Azure Blob Storage container and writes results to another container. Each container instance processes a single file and then exits. The processing logic is written in a Docker image that reads input and output connection strings from environment variables. You need to configure the container group so that it writes the results to the output container durably and efficiently. The environment variables must be provided at runtime but must not be exposed in the ACI configuration. Which approach should you use?

Accepted Answer

Use a managed identity for the container group, grant the identity access to an Azure Key Vault secret that contains the storage account connection string. The application retrieves the secret at startup using the managed identity and then writes directly to Azure Blob Storage.. Option B is the most secure and recommended approach for handling sensitive information like storage account connection strings in Azure Container Instances. By using a managed identity, the container group can authenticate to Azure Key Vault without storing any credentials in its configuration. The application then retrieves the secret at runtime from Key Vault. This ensures the connection string is never exposed in the ACI configuration, meeting the security requirement. While the STEM states the application currently reads from environment variables, this approach necessitates a minor adaptation in the application's secret retrieval mechanism to directly query Key Vault using the managed identity, which is a standard security best practice.

Answer

Mount an Azure File Share volume for the output container and configure the application to write output files to a directory on that share. Store the connection string for the file share in a secure fashion using Key Vault and pass it as an environment variable.

Answer

Embed the storage account connection string directly into the Docker image during build time and rely on the container's environment to provide the output blob container name.

Answer

Set the storage account connection string as an environment variable in the ACI container group definition (YAML or ARM template) and have the application use it at runtime.

Question 3

You deploy a containerized application to Azure Container Instances (ACI). The application writes state to the /data directory. You need to ensure that if the container restarts, the data persists. Which type of volume mount should you use?

Accepted Answer

Azure Files share. Azure Files shares provide a fully managed SMB file share in the cloud that can be mounted to Azure Container Instances. When a container restarts, the data written to the /data directory persists because the share lives independently of the container lifecycle, ensuring state survives crashes or restarts. Azure Disk volumes also provide persistent storage for ACI and would similarly ensure data persistence across container restarts.

Answer

emptyDir volume

Answer

hostPath volume

Answer

Azure Disk volume

Question 4

You are deploying a containerized application to Azure App Service. The application consists of a web front-end and a background worker. You want to run both containers in the same App Service plan to minimize costs. The worker should scale independently from the web front-end. What should you do?

Accepted Answer

Deploy both containers in the same App Service plan using multiple containers.. To run both containers in the same App Service plan for cost minimization and allow independent scaling, you must deploy each container as a separate Azure App Service app within the same App Service plan. This allows each app (and thus each container) to be scaled independently based on its own load. Using Docker Compose (option B) or the multi-container feature in App Service scales all containers as a single unit, failing the independent scaling requirement. Option A (AKS) and Option D (ACI) deploy the worker outside the App Service plan, violating the cost minimization goal. None of the provided options perfectly describe this correct approach without ambiguity or contradiction.

Answer

Deploy the web front-end in App Service and the worker in Azure Kubernetes Service.

Answer

Use Docker Compose to run both containers in the same App Service plan.

Answer

Deploy the worker as a separate Azure Container Instance.

Question 5

You are designing a serverless application using Azure Functions. The application processes messages from Azure Service Bus. You need to ensure that processing is idempotent and that messages are not lost. Which THREE actions should you take?

Accepted Answer

Implement idempotency in the function logic.. Idempotency ensures that processing the same message multiple times produces the same result, which is critical for serverless applications where retries or duplicate deliveries can occur. Azure Functions can receive the same Service Bus message more than once due to transient failures or redelivery, so the function logic must handle duplicates safely, often by checking a unique message ID or using a deduplication store (Option B). To prevent message loss, using PeekLock mode with manual completion (Option C) ensures that a message is only removed from the queue after it has been successfully processed and explicitly completed. If the function fails, the message lock expires, and the message becomes available again for reprocessing. Finally, setting the max delivery count (Option E) on the Service Bus queue is crucial for handling 'poison messages.' After a configured number of failed delivery attempts, the message is automatically moved to a dead-letter queue, preventing infinite retries and ensuring that problematic messages are not lost but rather isolated for further investigation.

Answer

Process messages in batches to improve throughput.

Answer

Use the AutoComplete option to automatically mark messages as complete.

Question 6

Which TWO actions should you perform to configure autoscaling for an Azure App Service web app based on CPU usage?

Accepted Answer

Configure the minimum and maximum instance limits.. To configure autoscaling for an Azure App Service web app based on CPU usage, two key actions are required. First, you must configure the minimum and maximum instance limits (Option A). These limits define the operational range for scaling, preventing uncontrolled scaling (and costs) or scaling down too far. Second, you need to define a scale rule that triggers when CPU percentage exceeds a threshold (Option E). This rule specifies the metric (CPU usage), the condition (exceeds a threshold), and the action (scale out or in) that the autoscale engine should take within the defined instance limits.

Answer

Enable manual scaling and set the instance count to 3.

Answer

Set the default instance count to 1.

Answer

Create a scale rule based on a specific date and time.

Question 7

Which THREE features does Azure Container Instances (ACI) provide?

Accepted Answer

Assign a public IP address and DNS name label.. Azure Container Instances allows you to assign a public IP address and a DNS name label to a container group, enabling direct internet access to the container. This is configured at the container group level, and the DNS name label must be unique within the Azure region. ACI also supports mounting Azure Files shares as volumes for persistent storage and allows configuration of restart policies (Always, OnFailure, Never) for containers within a container group.

Answer

Integrate with Azure Virtual Network by default.

Answer

Run containers as nested containers (Docker-in-Docker).

Question 8

Which FOUR features are supported by Azure Container Apps? (Select four.)

Accepted Answer

Virtual network (VNet) injection.. Azure Container Apps supports event-driven scaling using KEDA, allowing containers to scale to zero and scale out rapidly based on real-time demand. It also supports blue-green deployments and traffic splitting through revisions, enabling controlled rollouts and A/B testing. Furthermore, Azure Container Apps has native integration with Dapr for building resilient, portable microservices. Finally, Azure Container Apps environments can be deployed into an existing virtual network (VNet) for network isolation and connectivity to other VNet resources.

Answer

Mounting Azure NetApp Files volumes.

Question 9

Which TWO conditions are required to use the 'Run from Package' feature in Azure App Service?

Accepted Answer

The package must be accessible via a URL if not deployed locally.. The 'Run from Package' feature in Azure App Service requires the deployment package to be a ZIP file (Option C). Additionally, the package must be accessible via a URL if it is not deployed locally (e.g., uploaded directly via the Azure portal or CLI). When using a remote URL, the package must be publicly accessible or secured with a SAS token, as App Service downloads it to the /home/data/SitePackages directory during startup. This ensures the app runs directly from the package without extracting it to the wwwroot folder.

Answer

The package must be stored in Azure Blob Storage.

Answer

The package size cannot exceed 500 MB.

Answer

The App Service must have a managed identity to access the package.

Question 10

The web app is connected to a GitHub repository via Continuous Deployment. You push a new commit to the 'main' branch, but the web app does not update. What is the most likely cause?

Accepted Answer

The GitHub webhook is not configured to trigger on push events.. The web app is configured for Continuous Deployment via GitHub, which relies on a webhook to notify Azure App Service of new commits. When a push event occurs on the 'main' branch, the webhook must be configured to trigger the deployment. If the webhook is not set to fire on push events, Azure will never receive the notification, and the app will not update despite the new commit.

Answer

The repository is Mercurial, not Git.

Answer

The deployment rollback is enabled and blocking new deployments.

Answer

The 'branch' property is set to 'main', but the actual branch is 'master'.

Question 11

Which THREE considerations are important when designing an Azure Function that uses Durable Functions for fan-out/fan-in pattern?

Accepted Answer

The orchestrator function must be deterministic.. The orchestrator function in Durable Functions must be deterministic because it replays execution history multiple times to recover state or handle async operations. Non-deterministic code (e.g., random numbers, current time) would produce different results on replay, breaking the reliable execution model. Orchestrator functions should also not perform I/O operations directly; instead, they should delegate these tasks to activity functions to ensure replayability and maintain state consistency. Lastly, Durable Functions rely heavily on Azure Storage for persisting orchestration state, history, and messages, making a configured storage account connection string (AzureWebJobsStorage) essential for their operation.

Answer

Orchestration history is stored in memory to reduce latency.

Answer

The orchestrator function should be triggered by an HTTP trigger directly.

Question 12

A company deploys a containerized application on Azure Kubernetes Service (AKS). They need to ensure high availability and disaster recovery across regions. Which THREE actions should they take?

Accepted Answer

Use Azure Front Door for global load balancing. The provided explanation for Pod Disruption Budgets (PDBs) incorrectly states their criticality for 'maintaining service continuity across regional failovers.' PDBs primarily ensure intra-cluster availability during voluntary disruptions, which is a local HA concern, not a direct cross-region DR mechanism.

Answer

Configure Pod Disruption Budgets

Answer

Enable Cluster Autoscaler

Question 13

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. Which TWO features should you enable to ensure the function processes events in order and exactly once?

Accepted Answer

Process events in batches. To process events in order and exactly once from Azure Event Hubs, two key features are checkpointing and processing events in batches. Event Hubs partitions provide ordering per partition. Checkpointing (C) is crucial as it allows the function to record and resume from the last successfully processed event offset, preventing duplicate processing on restarts or scaling, and ensuring ordered resumption within a partition. Processing events in batches (B), which is the default behavior for the Azure Functions Event Hubs trigger, allows for efficient consumption and checkpointing. When a batch is processed successfully, a single checkpoint can be recorded for the entire batch. This pattern, combined with checkpointing and idempotent processing in the function, contributes to achieving exactly-once processing by ensuring that either the entire batch is processed and checkpointed, or it is reprocessed. Session support is a feature of Azure Service Bus and does not apply to Event Hubs.

Answer

Durable Functions

Answer

Enable session support on Event Hubs and use the session-enabled trigger

Answer

Use a retry policy in the function

Question 14

You are deploying a web app to Azure App Service. You need to enable continuous deployment from a GitHub repository. Which TWO actions are required?

Accepted Answer

Set up a build provider like GitHub Actions or Kudu. B and C are correct. C is correct because the Deployment Center in Azure App Service is the primary interface for configuring continuous deployment. It allows you to select GitHub as your source control, authenticate, and specify the repository and branch. This action establishes the connection between your App Service and your GitHub repository, initiating the continuous deployment pipeline. B is correct because within the Deployment Center configuration, you must also select or set up a build provider (like GitHub Actions or Kudu). This provider is responsible for compiling your code, running tests (if configured), and deploying the built application to Azure App Service. Without a build provider, the source code cannot be transformed into a runnable application on App Service.

Answer

Create a new App Service plan

Answer

Enable Application Insights

Answer

Add a custom domain to the App Service

Question 15

You are developing a serverless application using Azure Functions. The function needs to scale to zero when idle and handle high traffic spikes. Which THREE features should you implement?

Accepted Answer

Use a Consumption hosting plan. A Consumption hosting plan is correct because it provides automatic scaling and can scale down to zero instances when the function is idle, meaning you only pay for execution time. This is essential for a serverless application that needs to handle high traffic spikes while minimizing costs during idle periods.
A queue trigger for processing is correct because it enables asynchronous processing, decoupling the function from the event source. When traffic spikes, messages are buffered in the queue, allowing the function to scale out automatically (on a Consumption plan) to process messages concurrently without dropping requests. This pattern is ideal for handling high traffic and ensuring reliability.
The built-in scaling controller is correct because it is the core mechanism within Azure Functions (especially on the Consumption plan) that automatically monitors event sources (like queues) and scales the function instances up or down, including scaling to zero when idle. By designing the solution to leverage this built-in feature, developers don't need to implement custom scaling logic, fulfilling the requirement for automatic scaling to handle spikes and scale to zero.

Answer

Enable the 'Always On' setting

Answer

Use a Premium hosting plan

Question 16

You are deploying a containerized application to Azure Container Instances (ACI). Which TWO actions should you take to ensure the container can securely access an Azure Key Vault?

Accepted Answer

Enable a managed identity for the container group. To securely access Azure Key Vault from Azure Container Instances, the recommended approach is to enable a managed identity for the container group. This allows the container to authenticate to Key Vault without requiring any credentials in the container image or code. The managed identity is integrated with Azure AD, and the container can request an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. This token authorizes requests to Key Vault, ensuring secrets are never exposed. Note that Azure Container Instances does not support mounting a volume directly from Key Vault; the volume mount option shown in option C is not available in ACI.

Answer

Pass secrets as environment variables

Answer

Mount a volume that maps to a Key Vault secret store

Answer

Register the container with an Azure AD application

Answer

Configure a custom DNS server

Question 17

Refer to the exhibit. You are deploying this ARM template to create a deployment slot for an Azure App Service. The template deploys successfully. However, the slot-specific app setting 'DEPLOYMENT_SLOT' is not visible in the Azure portal under the slot's Configuration > Application settings. What is the most likely cause?

Accepted Answer

The template does not set 'slotSticky' to true for the app setting. In ARM templates, app settings are made slot-specific (sticky) by explicitly listing them in the 'appSettingNames' property of a 'Microsoft.Web/sites/slots/config' resource with the name 'slotConfigNames'. Without this configuration, the setting is treated as a regular, non-sticky app setting. While it will still appear under the slot's Configuration > Application settings in the Azure portal, it will not be marked as a 'Deployment slot setting' and thus will not be pinned to the deployment slot during a swap.

Answer

Slot settings are not supported in ARM templates

Answer

Deployment slots have been deprecated for App Service

Answer

The app setting name must be prefixed with 'APPSETTING_'

Question 18

Which TWO options are valid ways to authenticate an Azure Functions app to Azure Storage when using a managed identity? (Choose two.)

Accepted Answer

Enable system-assigned managed identity on the function app and grant it the 'Storage Blob Data Contributor' role. Enabling a system-assigned managed identity on the function app allows it to authenticate to Azure Storage without storing credentials. Granting an appropriate RBAC role (e.g., 'Storage Blob Data Contributor' for blobs, 'Storage Queue Data Contributor' for queues) to that identity via Azure RBAC authorizes the function app to perform data operations using Azure AD tokens, which are automatically managed by the Azure platform. Similarly, creating a user-assigned managed identity, assigning it to the function app, and granting it the necessary RBAC role achieves the same goal for user-assigned identities.

Answer

Generate a shared access signature (SAS) token and include it in the connection string

Answer

Use the storage account access key in the connection string

Answer

Use the default AzureWebJobsStorage connection string from the function app settings

Question 19

Which TWO Azure services can be used to trigger an Azure Function when a new blob is added to an Azure Storage container? (Choose two.)

Accepted Answer

Azure Event Grid trigger. Azure Event Grid trigger enables an Azure Function to be invoked automatically when a new blob is created in a Storage account. Event Grid provides a reliable, low-latency event-driven architecture that supports blob created events, making it a valid trigger for this scenario. Additionally, the Azure Blob Storage trigger is a native Azure Function binding that directly monitors a specified Azure Storage container for new or updated blobs, automatically invoking the function when such an event occurs.

Answer

Azure Queue Storage trigger

Answer

Azure Cosmos DB trigger

Answer

HTTP trigger

Question 20

Which THREE factors should you consider when choosing between Azure Functions (Consumption plan) and Azure Container Instances for running a background job that processes messages from Azure Service Bus?

Accepted Answer

Scaling behavior (automatic vs. manual).. Azure Functions on the Consumption plan automatically scales out based on the number of incoming Service Bus messages, while Azure Container Instances require manual scaling or external orchestration (e.g., KEDA) to adjust the number of container groups. Functions also offer native, first-class triggers for Azure Service Bus, simplifying integration and event-driven processing, whereas ACI requires custom code within the container to poll the Service Bus or an external service to trigger it. Furthermore, Azure Functions Consumption plan uses a pay-per-execution cost model, ideal for intermittent workloads, while ACI charges per second for allocated CPU and memory, which can be less cost-effective for idle periods.

Answer

Ability to use custom base images.

Answer

Cold start latency.