AZ-204 Develop Azure compute solutions Practice Test 1 — 15 Questions

Question 1

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS termination. You need to configure these features. Which resource should you create alongside the container group?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Application Gateway. Azure Application Gateway provides Layer 7 load balancing with SSL/TLS termination and custom domain support. By associating a custom domain with the Application Gateway's frontend IP and uploading an SSL certificate, you can terminate HTTPS connections at the gateway and forward traffic to the container group over HTTP. This meets the requirement without exposing the container group directly.

Answer

Azure Front Door

Answer

Azure Container Registry

Answer

Azure DNS zone

Question 2

You have an Azure Function with a Service Bus queue trigger. The function processes messages that must be handled in order within each partition of the queue. You need to ensure that the function does not process multiple messages from the same partition concurrently, while still allowing parallel processing across different partitions. Which setting should you configure?

Answer

Set the batch size to 1 in the function configuration.

Answer

Set the maxConcurrentCallsPerSession to 1, or use a session-enabled queue and set maxConcurrentSessions to 1 if using sessionId.

Answer

Use a consumption plan, which automatically limits concurrency.

Answer

Use a queue trigger instead of a Service Bus trigger.

Question 3

You are deploying a batch processing application to Azure Container Instances (ACI). The application processes multiple files from an Azure Blob Storage container and writes results to another container. Each container instance processes a single file and then exits. The processing logic is written in a Docker image that reads input and output connection strings from environment variables. You need to configure the container group so that it writes the results to the output container durably and efficiently. The environment variables must be provided at runtime but must not be exposed in the ACI configuration. Which approach should you use?

Accepted Answer

Use a managed identity for the container group, grant the identity access to an Azure Key Vault secret that contains the storage account connection string. The application retrieves the secret at startup using the managed identity and then writes directly to Azure Blob Storage.. Option B is the most secure and recommended approach for handling sensitive information like storage account connection strings in Azure Container Instances. By using a managed identity, the container group can authenticate to Azure Key Vault without storing any credentials in its configuration. The application then retrieves the secret at runtime from Key Vault. This ensures the connection string is never exposed in the ACI configuration, meeting the security requirement. While the STEM states the application currently reads from environment variables, this approach necessitates a minor adaptation in the application's secret retrieval mechanism to directly query Key Vault using the managed identity, which is a standard security best practice.

Answer

Mount an Azure File Share volume for the output container and configure the application to write output files to a directory on that share. Store the connection string for the file share in a secure fashion using Key Vault and pass it as an environment variable.

Answer

Embed the storage account connection string directly into the Docker image during build time and rely on the container's environment to provide the output blob container name.

Answer

Set the storage account connection string as an environment variable in the ACI container group definition (YAML or ARM template) and have the application use it at runtime.

Question 4

You deploy a containerized application to Azure Container Instances (ACI). The application writes state to the /data directory. You need to ensure that if the container restarts, the data persists. Which type of volume mount should you use?

Accepted Answer

Azure Files share. Azure Files shares provide a fully managed SMB file share in the cloud that can be mounted to Azure Container Instances. When a container restarts, the data written to the /data directory persists because the share lives independently of the container lifecycle, ensuring state survives crashes or restarts. Azure Disk volumes also provide persistent storage for ACI and would similarly ensure data persistence across container restarts.

Answer

emptyDir volume

Answer

hostPath volume

Answer

Azure Disk volume

Question 5

A IoT command API runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) using the app's outbound IP addresses. It works by injecting the app's outbound traffic into the VNet via a delegated subnet, allowing the app to reach private APIs hosted inside the VNet without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 6

An Azure Functions IoT command API must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used?

Accepted Answer

Premium plan. The Premium plan (Elastic Premium EP) is the correct choice because it supports VNet integration for accessing resources inside a virtual network, allows execution durations up to 30 minutes (the Consumption plan caps at 10 minutes by default), and provides serverless scaling without requiring you to manage virtual machines. This plan also offers always-ready instances to reduce cold start latency, which is critical for IoT command APIs.

Answer

Azure Batch pool

Answer

Consumption plan

Answer

App Service Free tier

Question 7

You are deploying a containerized application to Azure Container Instances. The application requires a custom domain name and SSL/TLS termination. You need to configure these features. Which resource should you create alongside the container group?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy both containers in the same App Service plan using multiple containers.. To run both containers in the same App Service plan for cost minimization and allow independent scaling, you must deploy each container as a separate Azure App Service app within the same App Service plan. This allows each app (and thus each container) to be scaled independently based on its own load. Using Docker Compose (option B) or the multi-container feature in App Service scales all containers as a single unit, failing the independent scaling requirement. Option A (AKS) and Option D (ACI) deploy the worker outside the App Service plan, violating the cost minimization goal. None of the provided options perfectly describe this correct approach without ambiguity or contradiction.

Answer

Deploy the web front-end in App Service and the worker in Azure Kubernetes Service.

Answer

Use Docker Compose to run both containers in the same App Service plan.

Answer

Deploy the worker as a separate Azure Container Instance.

Question 8

You are designing a serverless application using Azure Functions. The application processes messages from Azure Service Bus. You need to ensure that processing is idempotent and that messages are not lost. Which THREE actions should you take?

Accepted Answer

Implement idempotency in the function logic.. Option B is correct because idempotency in the function logic ensures that if the same message is delivered more than once (which Service Bus can do under at-least-once delivery), reprocessing does not produce duplicate side effects, satisfying the requirement for idempotent processing. Option C is correct because PeekLock mode lets the function receive a message with a lock and only call Complete after successful processing, so a crash or failure before completion causes the lock to expire and the message to be redelivered rather than lost. Option E is correct because setting the max delivery count on the queue bounds retries and moves poison messages to the dead-letter queue after the limit is reached, preventing infinite retry loops while preserving the message for investigation. Option A is not required for idempotency or message durability; batching is a throughput optimization and can even complicate per-message completion semantics. Option D is incorrect because AutoComplete marks messages complete as soon as the function returns successfully, which can lose messages if the function fails after receiving but before fully processing, and it removes the explicit control needed for reliable completion.

Answer

Process messages in batches to improve throughput.

Answer

Use the AutoComplete option to automatically mark messages as complete.

Question 9

You are developing an Azure Logic App that processes files from an FTP server. The workflow must run every 10 minutes and process only new files. You need to ensure that files are not processed more than once. What should you use?

Accepted Answer

Use the FTP trigger 'When a file is added' with a recurrence of 10 minutes.. The 'When a file is added' FTP trigger in Azure Logic Apps automatically tracks processed files using a built-in 'trigger state' mechanism. When combined with a recurrence schedule (e.g., every 10 minutes), it ensures that only new files since the last run are processed, preventing duplicate processing without external state management.

Answer

Use the 'When a file is added' trigger and store processed file names in a SQL database.

Answer

Use the FTP trigger 'When a file is added or modified' with a recurrence of 10 minutes.

Answer

Use the Sliding Window trigger and set the window size to 10 minutes.

Question 10

You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?

Accepted Answer

Use the Microsoft.Identity.Web library to validate the token.. Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.

Answer

Configure the Azure Functions host to use Microsoft Entra ID authentication.

Answer

Use the Microsoft Authentication Library (MSAL) to validate the token.

Answer

Use Azure AD B2C to validate the token.

Question 11

You are designing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job is expected to run for up to 2 hours. You need to minimize costs. Which ACI configuration should you use?

Accepted Answer

Use a container group with a restart policy of 'OnFailure' or 'Never'.. Setting the restart policy to 'OnFailure' or 'Never' ensures that the container does not restart after the batch job completes, avoiding unnecessary compute charges. ACI bills per second of container runtime, so any idle or restarted container time directly increases cost. For a finite batch job, a restart policy that prevents automatic restarts is the most cost-effective choice.

Answer

Use GPU-enabled containers for faster processing.

Answer

Deploy the container group in a virtual network.

Answer

Use a container group with a restart policy of 'Always'.

Question 12

The web app is connected to a GitHub repository via Continuous Deployment. You push a new commit to the 'main' branch, but the web app does not update. What is the most likely cause?

Accepted Answer

The GitHub webhook is not configured to trigger on push events.. The web app is configured for Continuous Deployment via GitHub, which relies on a webhook to notify Azure App Service of new commits. When a push event occurs on the 'main' branch, the webhook must be configured to trigger the deployment. If the webhook is not set to fire on push events, Azure will never receive the notification, and the app will not update despite the new commit.

Answer

The repository is Mercurial, not Git.

Answer

The deployment rollback is enabled and blocking new deployments.

Answer

The 'branch' property is set to 'main', but the actual branch is 'master'.

Question 13

You deploy the above ARM template resource for a web app. The web app reads the connection string from the 'DefaultConnection' name. However, the web app fails to connect to the database with an error 'Login failed for user 'myuser'. What is the most likely cause?

Accepted Answer

The SQL server is configured to use Microsoft Entra authentication only, not SQL authentication.. The error 'Login failed for user 'myuser'' indicates that SQL authentication is failing. If the SQL server is configured to use Microsoft Entra authentication only, SQL logins are disabled, so the connection string using SQL authentication (user ID and password) will fail. This is the most likely cause.

Answer

The user ID does not have access to the database.

Answer

The connection string type should be 'SQLServer' instead of 'SQLAzure'.

Answer

The connection string is missing 'Trusted_Connection=True;'.

Question 14

You are designing a solution that uses Azure Functions to process events from Azure Event Hubs. Which TWO features should you enable to ensure the function processes events in order and exactly once?

Accepted Answer

Process events in batches. Option B (Process events in batches) is correct because the Event Hubs trigger delivers events to a function as an ordered batch from a single partition, and processing the batch as a unit preserves the partition's sequence order while allowing the function to commit progress for the whole batch. Option C (Implement checkpointing in the function) is correct because the Event Hubs trigger's checkpointing mechanism (storing offsets in the associated storage account) records which events have been successfully processed, so on restart or scale-out the function resumes after the last checkpoint and avoids reprocessing, which is how exactly-once processing is approximated. Option A (Durable Functions) is not required here because durable orchestrations address stateful workflow coordination, not Event Hubs partition ordering or offset checkpointing. Option D (session support) is not applicable because Event Hubs sessions are used for ordered processing of session-affiliated events, not for the standard Event Hubs trigger's exactly-once semantics. Option E (retry policy) only handles transient failures and does not by itself guarantee ordering or exactly-once delivery.

Answer

Durable Functions

Answer

Enable session support on Event Hubs and use the session-enabled trigger

Answer

Use a retry policy in the function

Question 15

You are designing a solution that uses Azure Functions to process messages from an Azure Service Bus queue. Which TWO configurations can improve the throughput of the function?

Accepted Answer

Set maxMessagesPerBatch to a higher value. Option B is correct because increasing maxMessagesPerBatch (the Service Bus trigger's maxMessageCount/batch size) lets each function invocation pull and process more queue messages at once, raising overall throughput. Option C is correct because lowering newBatchThreshold causes the host to dispatch a new function instance sooner (as soon as the in-flight count drops below the threshold), increasing parallelism and message consumption rate. Option A is wrong because maxDeliveryCount only controls how many times a message is retried before dead-lettering; it does not affect processing throughput. Option D is wrong because reducing maxMessagesPerBatch processes fewer messages per invocation, lowering throughput. Option E is wrong because maxEventBatchSize is an Event Hubs trigger setting, not a Service Bus queue trigger setting, so it does not apply here.

Answer

Set maxDeliveryCount to a higher value

Answer

Set maxMessagesPerBatch to a lower value

Answer

Set maxEventBatchSize to a higher value