AZ-204 Develop Azure compute solutions Practice Test 12 — 15 Questions

Question 1

You are developing a web app that runs on Azure App Service. The app needs to read a connection string from configuration. Which is the recommended approach to access the connection string in the app code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Environment.GetEnvironmentVariable("SQLAZURECONNSTR_MyConn"). Azure App Service automatically injects connection strings defined in the 'Connection strings' blade as environment variables with a specific prefix. For SQL Azure, the prefix is 'SQLAZURECONNSTR_', so the environment variable name becomes 'SQLAZURECONNSTR_MyConn'. Using Environment.GetEnvironmentVariable is the recommended way to retrieve these values at runtime, as they are securely stored and managed by the platform.

Answer

Call an HTTP endpoint on the App Service instance

Answer

Use Azure.Identity.DefaultAzureCredential and Key Vault

Answer

Read from appsettings.json using IConfiguration

Question 2

You have an Azure Function app that processes orders. The function uses a queue trigger from Azure Storage. Recent load tests show that the function is not scaling out fast enough under high load. What should you do to improve scaling?

Accepted Answer

Switch from Consumption plan to Premium plan. Switching to the Premium plan provides faster scale-out capabilities, including pre-warmed instances and more scalable infrastructure, which helps the function scale out more quickly under high load compared to the Consumption plan.

Answer

In the function code, increase the number of retries on failure

Answer

In host.json, increase the batchSize and increase the newBatchThreshold

Answer

In host.json, increase the batchSize and decrease the newBatchThreshold

Question 3

You are troubleshooting a containerized application running on Azure Kubernetes Service (AKS). The application logs indicate that it cannot connect to an Azure SQL Database using a managed identity. The pod is configured with a user-assigned managed identity. Which step is most likely missing?

Accepted Answer

The AKS cluster does not have the Azure AD Pod Identity add-on enabled. The AKS cluster requires the Azure AD Pod Identity add-on (or the newer Workload Identity) to enable pods to authenticate to Azure resources using managed identities. Without this add-on, the pod's user-assigned managed identity cannot be used to obtain tokens for connecting to Azure SQL Database, even if the identity is correctly assigned to the pod.

Answer

The Azure SQL Database firewall is blocking the pod IP

Answer

The pod's service account is not linked to the managed identity

Answer

The managed identity is not in the same Microsoft Entra ID tenant as the AKS cluster

Question 4

You are designing a solution that uses Azure Functions to process messages from an Azure Service Bus queue. Which TWO configurations can improve the throughput of the function?

Accepted Answer

Set maxMessagesPerBatch to a higher value. Increasing maxMessagesPerBatch allows the function to retrieve and process more messages in a single batch, reducing the overhead of multiple fetch operations. Decreasing newBatchThreshold makes the trigger fetch a new batch sooner when fewer messages remain, keeping the function busy and reducing idle time, which improves throughput.

Answer

Set maxDeliveryCount to a higher value

Answer

Set maxMessagesPerBatch to a lower value

Answer

Set maxEventBatchSize to a higher value

Question 5

Refer to the exhibit. You run this Azure CLI command to configure an Azure Web App for Containers. The web app fails to start, and the logs show 'unauthorized: authentication required'. What is the most likely cause?

Accepted Answer

The command did not include admin credentials or managed identity configuration. The Azure CLI command `az webapp config container set` without specifying `--docker-registry-server-user` and `--docker-registry-server-password` (or a managed identity configuration) means the web app cannot authenticate with a private container registry. The 'unauthorized: authentication required' error indicates the registry requires credentials, and the web app has none configured, so it fails to pull the image.

Answer

The image tag 'latest' does not exist

Answer

The web app is configured to use a deployment slot, but the slot is not specified

Answer

The --docker-registry-server-url is incorrect

Question 6

Refer to the exhibit. You have an HTTP-triggered Azure Function that writes the request body to a blob in the 'samples-workitems' container. The function runs successfully but does not create a blob. What is the most likely cause?

Accepted Answer

The storage account connection string is not set in the function app settings. The most likely cause is that the storage account connection string is not set in the function app settings. Azure Functions require the connection string for the storage account to be configured via the `AzureWebJobsStorage` app setting (or a custom connection setting referenced in the binding). Without it, the runtime cannot authenticate or communicate with Blob Storage, so the output binding silently fails to write the blob, even though the function executes successfully.

Answer

The container name 'samples-workitems' is invalid

Answer

The blob name pattern {rand-guid} is not supported

Answer

The blob output binding syntax is incorrect

Question 7

You are developing a background job that runs every hour on Azure App Service. The job must be resilient to restarts and should not affect the web app's performance. Which technology should you use?

Accepted Answer

WebJobs (triggered). WebJobs (triggered) are designed specifically for running background tasks on Azure App Service. They run as separate processes from the web app, ensuring they do not affect the web app's performance, and they are resilient to restarts because the Azure WebJobs SDK automatically handles restart and retry logic. This makes them the ideal choice for a scheduled hourly job that must survive App Service restarts.

Answer

A background thread in the web application

Answer

Azure Logic Apps

Answer

Azure Functions (Consumption plan)

Question 8

You have an Azure Function app that uses a Service Bus queue trigger. The function processes messages, but sometimes it takes longer than 5 minutes to process a single message. You notice that the message is processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the queue is shorter than the processing time. The most likely cause is that the lock duration on the Service Bus queue is shorter than the time required to process the message. When the lock expires, the message becomes visible to other consumers (or the same consumer on retry), causing it to be processed multiple times. The default lock duration for a Service Bus queue is 30 seconds, and if processing exceeds that, the message will be re-delivered.

Answer

The function's timeout is set to 5 minutes

Answer

The maxDeliveryCount is set too high

Answer

The queue has sessions enabled

Question 9

You are deploying a microservice to Azure Container Apps. The service requires a custom domain and SSL/TLS certificate. Which resource should you configure to meet these requirements?

Accepted Answer

Azure Container Apps environment with a custom domain and certificate attached. Azure Container Apps allows you to attach a custom domain and upload an SSL/TLS certificate directly at the environment level, which is the correct approach for securing a microservice with a custom domain. This configuration ensures that the Container App responds to HTTPS requests on your domain without needing an additional front-end service.

Answer

Azure Front Door with a custom domain

Answer

Azure API Management in front of the Container App

Answer

Azure Application Gateway with SSL termination

Question 10

You are developing a web application that runs on Azure App Service. The application needs to store session state. Which Azure service provides the best performance and reliability for session state storage?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis provides the best performance and reliability for session state storage because it is an in-memory data store with sub-millisecond latency, designed for high-throughput, low-latency scenarios like session caching. It supports session state providers natively in ASP.NET and ASP.NET Core, ensuring fast reads and writes for each user request without the overhead of disk I/O or network latency associated with other storage options.

Answer

Azure Table Storage

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 11

You have an Azure Function app that uses an Event Hubs trigger. The function processes events in batches. You notice that some events are being processed more than once. Which setting should you adjust to minimize duplicate processing?

Accepted Answer

Enable checkpointing in the function code. Checkpointing in Azure Event Hubs stores the offset of the last successfully processed event in a durable store (e.g., Azure Blob Storage). When the function restarts or scales, it resumes from that checkpoint, preventing reprocessing of already-handled events. Without checkpointing, the default behavior may start from the earliest offset or use the `latest` position, leading to duplicate processing.

Answer

Increase the maxRetries per event

Answer

Increase the event batch size

Answer

Decrease the prefetch count

Question 12

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job. The job must run only once a day and should not incur costs when idle. Which configuration should you use?

Accepted Answer

Use a scheduled job that creates a container group with restart policy Never and delete after completion. Azure Container Instances (ACI) supports a restart policy of 'Never' for one-off batch jobs, and you can orchestrate the creation and deletion of the container group using a scheduled job (e.g., Azure Logic Apps, Azure Functions, or a cron-based trigger). This ensures the container runs exactly once per day and incurs no cost when idle, as the container group is deleted after completion.

Answer

Use Azure Kubernetes Service with a node pool that scales to zero

Answer

Deploy a container group with a restart policy of Always

Answer

Use Azure Container Apps with scale-to-zero minimum replicas

Question 13

Your company develops a microservices application deployed to Azure Kubernetes Service (AKS). You need to enable secure communication between services using managed identities. Which Azure service should you use to manage the identities and access control for the pods?

Accepted Answer

Microsoft Entra Workload ID. Microsoft Entra Workload ID (formerly Azure AD Workload Identity) is the correct choice because it integrates with Kubernetes to automatically project an Azure AD-managed identity into each pod. This allows pods to authenticate to Azure resources (e.g., Key Vault, Storage) without managing secrets, using federated identity credentials that map a Kubernetes service account to an Azure AD application or user-assigned managed identity.

Answer

Azure Service Bus

Answer

Azure Key Vault

Answer

Azure Policy

Question 14

You are designing a serverless application using Azure Functions. The function must process messages from an Azure Service Bus queue. The processing time for each message can vary from a few seconds to several minutes. You need to minimize costs while ensuring that messages are processed in a timely manner. Which hosting plan should you recommend?

Accepted Answer

Premium plan. The Premium plan is correct because it supports long execution times (up to 60 minutes by default, configurable to unlimited), always-warm instances to avoid cold starts, and virtual network integration—all while providing predictable pricing and scaling. This meets the requirement of processing messages that can take several minutes without incurring the cold-start penalties or execution-time limits of the Consumption plan.

Answer

Container Instances plan

Answer

App Service plan

Answer

Consumption plan

Question 15

You need to deploy a web application to Azure App Service. The application requires a custom domain name and SSL/TLS certificate. You want to automate the deployment using Azure CLI. Which command should you use to upload the SSL certificate to the App Service?

Accepted Answer

az webapp config ssl upload. The `az webapp config ssl upload` command is the Azure CLI command used to upload an SSL/TLS certificate (in .pfx format) to an existing Azure App Service web app. This command binds the certificate to the app, enabling HTTPS for custom domains.

Answer

az appservice web config ssl upload

Answer

az appservice certificate import

Answer

az webapp certificate upload