AZ-204 Develop Azure compute solutions Practice Test 14 — 15 Questions

Question 1

You have an Azure Web App that uses Azure SQL Database. You need to securely connect to the database using Managed Identity. Which connection string setting should you use?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=myapp;. Option D is correct because it uses the 'Authentication=Active Directory Managed Identity' keyword, which tells the SQL client to acquire an access token from Azure AD via the managed identity endpoint. The 'User Id' is set to the name of the managed identity (the app's system-assigned or user-assigned identity), and no password is needed because the token is obtained automatically. This enables a passwordless, secure connection to Azure SQL Database without storing credentials.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myadmin;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Integrated Security=True;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;User Id=myuser@domain.com;Password=...;

Question 2

You are deploying a containerized application using Azure Kubernetes Service (AKS). You need to ensure that sensitive configuration data, such as API keys, is not stored in container images. Which Kubernetes resource should you use?

Accepted Answer

Secret. Option D is correct because Kubernetes Secrets are specifically designed to store sensitive data like API keys, connection strings, and passwords. They are stored in etcd as base64-encoded values (and can be encrypted at rest) and are injected into pods as environment variables or mounted as volumes, ensuring the sensitive data never resides in the container image.

Answer

Deployment

Answer

ConfigMap

Answer

PersistentVolume

Question 3

You are building a real-time dashboard that displays data from Azure Event Hubs. You need to aggregate events over a one-minute window and update the dashboard every minute. Which Azure service should you use?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is designed for real-time stream processing, allowing you to aggregate events from Azure Event Hubs over a one-minute tumbling window and output results to a dashboard or sink. It natively supports windowing functions (e.g., TumblingWindow, HoppingWindow) and can handle high-throughput, low-latency data streams, making it ideal for updating a dashboard every minute.

Answer

Azure Data Factory

Answer

Azure Analysis Services

Answer

Azure Logic Apps

Question 4

You are planning to migrate an on-premises application to Azure App Service. The application consists of a web frontend and a background worker that processes messages from a queue. Which TWO Azure services should you use to implement this solution?

Accepted Answer

Azure Functions. Azure Functions (C) is correct because it provides a serverless compute service that can be triggered by queue messages, making it ideal for the background worker that processes messages from a queue. Azure App Service (D) is correct because it hosts the web frontend, providing a fully managed platform for web applications with built-in scaling and load balancing.

Answer

Azure Kubernetes Service

Answer

Azure Batch

Answer

Azure Logic Apps

Question 5

You are designing a serverless application using Azure Functions that needs to read from an Azure Storage Blob, process the data, and write to Azure Cosmos DB. Which THREE bindings are required?

Accepted Answer

HTTP trigger. The HTTP trigger is correct because the question describes a serverless application that needs to be invoked to read from Blob Storage, process data, and write to Cosmos DB. An HTTP trigger allows the function to be started via an HTTP request, which is the typical entry point for such event-driven processing. Without a trigger, the function cannot execute; the HTTP trigger provides the necessary invocation mechanism.

Answer

Cosmos DB input binding

Answer

Timer trigger

Question 6

You are deploying an Azure App Service that must be accessible only from your corporate network via a VPN. You need to restrict inbound traffic. Which TWO actions should you take?

Accepted Answer

Deploy the App Service inside a VNet using an App Service Environment. Option B is correct because deploying the App Service inside a VNet using an App Service Environment (ASE) places the App Service on dedicated infrastructure that is fully integrated into your virtual network. This ensures that inbound traffic is only possible from within the VNet, which is accessible via your corporate VPN, effectively isolating the App Service from the public internet.

Answer

Use Azure Front Door with WAF

Answer

Configure a service endpoint

Answer

Enable VNet integration for the App Service

Question 7

You are developing a solution that processes orders. Each order must be processed exactly once, in the order it was received. You need to choose an Azure service that guarantees FIFO delivery and at-least-once processing. Which service should you use?

Accepted Answer

Azure Service Bus Queue with sessions. Azure Service Bus Queue with sessions is correct because it provides FIFO (first-in, first-out) delivery by grouping related messages into sessions, ensuring messages within a session are processed in order. The at-least-once processing guarantee is inherent to Service Bus queues, as messages are not removed until the receiver completes them, and they can be redelivered if the processing fails or times out.

Answer

Azure Event Hubs

Answer

Azure Event Grid

Answer

Azure Storage Queue

Question 8

A web app experiences intermittent high latency. You discover that the Azure SQL database is experiencing a high number of connection timeouts. The application uses Entity Framework Core with the default connection pooling settings. You need to improve database connection reliability without changing the application code. What should you do?

Accepted Answer

Set the Minimum Pool Size to 10 in the connection string.. Setting the Minimum Pool Size to 10 pre-creates a baseline of open connections in the pool, reducing the frequency of new connection creations during traffic spikes. This mitigates intermittent connection timeouts caused by the default pool starting empty and struggling to keep up with demand under high latency. Since the application uses Entity Framework Core with default pooling, this change is applied via the connection string without modifying code.

Answer

Increase the maximum pool size in the connection string.

Answer

Set the Connection Lifetime to 300 seconds.

Answer

Enable Multipool in the connection string.

Question 9

You deploy an Azure Function app that uses the Premium plan. The function processes messages from an Azure Service Bus queue. Under heavy load, some messages are processed multiple times. You need to ensure exactly-once processing without losing messages. What should you do?

Accepted Answer

Enable duplicate detection on the Service Bus queue.. Option A is correct because enabling duplicate detection on the Service Bus queue ensures that the Service Bus broker itself discards duplicate messages based on a user-defined time window. This prevents the function from processing the same message multiple times, even if the function host restarts or the message is re-delivered due to transient failures. Duplicate detection works by tracking the MessageId of each message and ignoring any subsequent message with the same MessageId within the detection window.

Answer

Use Peek-Lock mode instead of Receive and Delete.

Answer

Set the maxDeliveryCount to 1 on the queue.

Answer

Reduce the batch size in the function host.json.

Question 10

You are building a serverless API using Azure Functions. The API must authenticate requests using Microsoft Entra ID. You need to restrict access to users from a specific Microsoft Entra tenant only. What should you configure in the function app?

Accepted Answer

Set the 'Issuer URL' to the specific tenant's endpoint.. Option D is correct because setting the 'Issuer URL' to the specific tenant's endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) tells Azure Functions to validate that the token was issued by that exact tenant. This restricts access to users from that tenant only, as tokens from other tenants will fail issuer validation.

Answer

Set the 'Allowed Token Audiences' to the application ID.

Answer

Enable 'Require Authentication' and set the action to 'Login with Microsoft Entra ID'.

Answer

Set the 'Client ID' to the application ID.

Question 11

You develop a containerized application that runs on Azure Container Instances (ACI). The application needs to securely access Azure SQL Database using a connection string. You want to minimize administrative effort and avoid storing secrets in the container image. What should you do?

Accepted Answer

Enable managed identity for the container group and use Microsoft Entra authentication to Azure SQL.. Option C is correct because enabling a managed identity for the container group allows the application to authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure Active Directory) without storing any secrets. The application requests an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, then uses that token to connect to Azure SQL. This eliminates the need to manage connection strings or secrets, minimizing administrative effort and keeping secrets out of the container image.

Answer

Embed the connection string in the container image as a configuration file.

Answer

Store the connection string in an environment variable in the container group.

Answer

Mount a volume from Azure Key Vault using a secret volume.

Question 12

You host a web application on Azure App Service using multiple deployment slots (production and staging). After swapping staging into production, users report errors. You need to ensure that the staging slot is warmed up before swapping and that any errors during swap cause an automatic rollback. What should you configure?

Accepted Answer

Enable auto swap and configure a custom warm-up path.. Option B is correct because enabling auto swap with a custom warm-up path ensures the staging slot is fully warmed up before the swap occurs, and if the warm-up fails or the application returns errors during the swap, Azure App Service automatically rolls back to the previous slot. This directly addresses the requirement for both pre-swap warm-up and automatic rollback on errors.

Answer

Configure deployment slot settings to be sticky.

Answer

Use swap with preview and complete the swap after verification.

Answer

Configure manual swap and run a warm-up script before swapping.

Question 13

You are building a solution that processes real-time telemetry from IoT devices. The telemetry data must be ingested, processed with minimal latency, and stored in Azure Blob Storage for long-term analytics. You need to choose the serverless compute service that is best suited for this scenario. What should you use?

Accepted Answer

Azure Functions with Event Hubs trigger. Azure Functions with an Event Hubs trigger is the best choice because it provides a serverless, event-driven compute model that can process high-throughput telemetry data with minimal latency. The Event Hubs trigger scales automatically based on the number of partitions and events, ensuring real-time processing, and the output can directly write to Azure Blob Storage for long-term analytics.

Answer

Azure Batch with Event Hubs input

Answer

Azure Logic Apps with Event Hubs connector

Answer

Azure WebJobs with Event Hubs SDK

Question 14

You deploy an Azure Function app that runs on the Consumption plan. The function writes logs to Application Insights. You notice that some log entries are missing during periods of high load. You need to ensure that all logs are captured without significantly increasing cost. What should you do?

Accepted Answer

Adjust the sampling rate in the Application Insights configuration to 100%.. Under high load, Application Insights uses adaptive sampling by default to reduce data volume, which can cause log entries to be dropped. Adjusting the sampling rate to 100% in the Application Insights configuration ensures all telemetry data is captured, while still running on the Consumption plan, which does not significantly increase cost because the function app itself scales and you only pay for execution time and resources used.

Answer

Change the function app to the Premium plan to get more CPU and memory.

Answer

Create a separate Application Insights resource for the function app.

Answer

Disable sampling in the function's host.json.

Question 15

You are designing a microservices solution using Azure Container Apps. One service must be exposed externally via HTTPS, while others should only be accessible within the environment. You need to configure networking for this scenario. What should you do?

Accepted Answer

Configure each container app's ingress: set the external service to 'External' and the internal services to 'Internal'.. Option C is correct because Azure Container Apps allows you to control ingress at the individual container app level. Setting the external service's ingress to 'External' makes it reachable from the internet via HTTPS, while setting internal services to 'Internal' restricts access to only within the Container Apps environment, using the internal FQDN. This provides the required isolation without needing separate environments or complex network policies.

Answer

Enable external ingress at the environment level and use network policies to restrict access.

Answer

Deploy the external service in a different environment and use an internal load balancer.

Answer

Use a Dapr sidecar to route requests between services.