AZ-204 Develop Azure compute solutions Practice Test 17 — 15 Questions

Question 1

Which TWO actions can you perform using Azure Container Registry (ACR) tasks?

Accepted Answer

Schedule a task to patch base images. ACR Tasks support both scheduled and trigger-based workflows, so option A is correct: you can create a task with a cron schedule (az acr task create --schedule) to periodically rebuild and patch base images when upstream base layers change. Option B is also correct because ACR Tasks can be configured with a source trigger on a Git repository (az acr task create --context <git-repo> --source-trigger-enabled true) so that a commit automatically triggers a container image build. Option C is not an ACR Task action — importing images from another registry is done with the separate az acr import command, not a task. Option D is incorrect because ACR Tasks build and push images to a registry; deployment to AKS is handled by Kubernetes manifests, Helm, or GitOps tooling, not by ACR Tasks. Option E is incorrect because vulnerability scanning in ACR is provided by Microsoft Defender for Containers (or third-party integrations), not by ACR Tasks themselves.

Answer

Import images from another registry

Answer

Deploy images to AKS

Answer

Automatically scan images for vulnerabilities

Question 2

Which THREE are benefits of using Azure Logic Apps compared to Azure Functions for workflow orchestration?

Accepted Answer

Native connectors to hundreds of services. Option A is correct because Logic Apps ships with hundreds of built-in managed connectors (e.g., Office 365, Dynamics 365, SAP, Salesforce, SQL) that let you integrate services declaratively without writing authentication or client code. Option B is correct because Logic Apps runs on a durable, stateful workflow engine that persists run history and checkpoints each action, so workflows can run for days or months and resume after failures, unlike the stateless, time-limited execution model typical of Azure Functions. Option D is correct because Logic Apps provides a visual, drag-and-drop designer in the Azure portal and VS Code for building and editing workflows, which Functions does not offer for orchestration. Option C is not correct because Azure Functions is the better choice for custom code logic, since it lets you write arbitrary C#, JavaScript, Python, etc., whereas Logic Apps is oriented toward declarative connector-based orchestration. Option E is not correct because Logic Apps generally costs more per execution than Functions, and Functions' consumption plan is typically cheaper for high-volume, short-lived processing.

Answer

Better suited for custom code logic

Answer

Lower cost for high-volume processing

Question 3

Which THREE are valid ways to authenticate an Azure Functions app to an Azure Service Bus namespace?

Accepted Answer

Using an Azure AD token obtained via DefaultAzureCredential. DefaultAzureCredential from the Azure Identity library can authenticate to Azure Service Bus using Microsoft Entra ID tokens. This credential chain attempts multiple authentication sources (environment variables, managed identity, Visual Studio, etc.) to obtain a token, which is then used to authorize requests to the Service Bus namespace via Azure RBAC.

Answer

Using a client certificate

Answer

Using a SAS key stored in code

Question 4

Your organization runs a critical e-commerce application on Azure App Service. The application uses a Standard App Service plan with three instances. During a flash sale, traffic spikes cause some requests to fail with HTTP 503 errors. The operations team reports that the app's CPU usage reaches 95% during spikes. You need to ensure the application remains responsive without manual intervention. The solution must minimize cost while handling unpredictable traffic patterns. You evaluate the following options: A) Enable autoscale to scale out based on CPU usage threshold of 70%, with a maximum of 10 instances. B) Change the App Service plan to Premium v3 and enable zone redundancy. C) Implement a queue-based load leveling pattern using Azure Queue Storage and a background process. D) Use Azure Front Door with a Web Application Firewall (WAF) policy to distribute traffic. Which option should you recommend?

Accepted Answer

Enable autoscale to scale out based on CPU usage threshold of 70%, with a maximum of 10 instances.. Enabling autoscale on the Standard App Service plan allows the application to automatically scale out from 3 to up to 10 instances when CPU exceeds 70%, handling traffic spikes without manual intervention. This minimizes cost by only adding instances when needed, and the Standard plan supports autoscale natively, making it the most cost-effective solution for unpredictable traffic patterns.

Answer

Use Azure Front Door with a Web Application Firewall (WAF) policy to distribute traffic.

Answer

Implement a queue-based load leveling pattern using Azure Queue Storage and a background process.

Answer

Change the App Service plan to Premium v3 and enable zone redundancy.

Question 5

Your company develops a multi-tenant SaaS application hosted on Azure Kubernetes Service (AKS). Each tenant has isolated compute resources. You need to ensure that no single tenant can consume all cluster resources and affect others. You also want to optimize resource utilization by packing pods efficiently. You evaluate the following approaches: A) Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing. B) Deploy each tenant to a separate AKS cluster. C) Use Azure Policy to enforce pod resource limits. D) Use a service mesh to control traffic between tenants. Which approach should you recommend?

Accepted Answer

Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing.. Namespace resource quotas per tenant provide hard limits on compute resources (CPU, memory) and object counts, preventing any single tenant from exhausting cluster resources. The Kubernetes scheduler then efficiently packs pods within those quotas, optimizing utilization without manual intervention. This approach balances isolation and resource efficiency in a multi-tenant AKS environment.

Answer

Use a service mesh to control traffic between tenants.

Answer

Use Azure Policy to enforce pod resource limits.

Answer

Deploy each tenant to a separate AKS cluster.

Question 6

Your company runs a critical web application on Azure App Service (Windows) that experiences intermittent high CPU usage. The application uses the Standard tier with auto-scaling based on CPU percentage. During auto-scale events, there is a delay of several minutes before new instances become available, causing temporary performance degradation. You need to reduce the latency of scaling out. What should you do?

Accepted Answer

Enable the 'Always On' setting in the App Service application settings.. The 'Always On' setting prevents the App Service from being unloaded after periods of inactivity, which reduces the cold-start latency when new instances are added during auto-scale events. Without 'Always On', idle instances may be recycled, causing delays of several minutes as the application re-initializes on new VMs.

Answer

Configure auto-scaling to use HTTP queue length as the metric.

Answer

Upgrade the App Service plan to the Premium tier.

Answer

Change the auto-scale metric to memory percentage instead of CPU.

Question 7

You are developing a serverless application using Azure Functions that processes order messages from an Azure Service Bus queue. Each order message is approximately 64 KB in size. The function must process messages in order and exactly once. The current implementation uses a Service Bus trigger with batch processing enabled. You notice that occasionally duplicate messages are processed. You need to ensure exactly-once processing while maintaining message ordering. What should you do?

Accepted Answer

Enable sessions on the Service Bus queue and update the function trigger to use sessions.. Enabling sessions on the Service Bus queue and using a session-enabled trigger guarantees message ordering and exactly-once processing. Sessions group related messages into a logical sequence, and the Service Bus trigger locks the entire session, ensuring that messages within a session are processed in order and that no other consumer can process the same session concurrently. This prevents duplicate processing while maintaining the required ordering.

Answer

Disable batch processing in the function trigger and process messages one at a time.

Answer

Increase the lock duration on the Service Bus queue to 5 minutes.

Answer

Set the maxDeliveryCount property on the queue to 1.

Question 8

You are designing a background job processing solution using Azure Batch. The job runs a large number of tasks that are CPU-intensive and require access to large input files stored in Azure Blob Storage. You need to minimize the time to process all tasks while controlling costs. Which THREE actions should you take?

Accepted Answer

Mount Azure Blob Storage as a file system using blobfuse to allow tasks to access files directly.. Mounting Azure Blob Storage as a file system using blobfuse allows tasks to directly access large input files without downloading them first, reducing data transfer time and eliminating local disk bottlenecks. This is critical for CPU-intensive tasks that need fast, concurrent access to shared data, minimizing overall processing time.

Answer

Set the task slots per VM to 1 to avoid contention.

Answer

Use a pool of small-sized VMs (e.g., Standard_A1_v2) to minimize cost per node.

Question 9

You are developing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job runs for approximately 30 minutes and requires access to a configuration file stored in Azure Files. You need to ensure the container instance can access the file share securely without using a public endpoint. Which TWO actions should you take?

Accepted Answer

Mount the Azure Files share using the storage account name and key.. Mounting an Azure Files share using the storage account name and key is a supported method in Azure Container Instances. This approach uses the SMB protocol to directly attach the file share to the container, providing access to the configuration file without requiring a public endpoint. The storage account key is passed securely as part of the container group configuration, and the mount is handled internally within the Azure infrastructure.

Answer

Use a managed identity assigned to the container group to authenticate to the storage account.

Answer

Use a shared access signature (SAS) token to mount the file share.

Answer

Enable the storage account's firewall to allow access from the container group's public IP.

Question 10

You are creating an Azure Functions app that uses a Blob Storage trigger to process new files. The function must process files only when they are completely written (i.e., no ongoing writes). You need to avoid processing partially written files. Which TWO configurations should you consider?

Accepted Answer

Check the blob's 'LastModified' timestamp in the function code to verify no recent changes.. Option B is correct because inspecting the blob's LastModified timestamp (and comparing it against the current time or a prior poll) lets the function confirm the blob has not been modified recently, which is a standard way to detect that writing has finished before processing. Option C is correct because a timer-triggered function that lists blobs and only processes those whose size has remained stable across polls avoids the race condition inherent in BlobTrigger, which can fire while a blob is still being written. Options A, D, and E are not valid: BatchSize applies to batching/parallelism of trigger invocations and does not guarantee a blob is fully written; there is no LeaseBlob property on the BlobTrigger binding; and ScanBlob is not a real BlobTrigger binding property.

Answer

Increase the 'BatchSize' to reduce the frequency of trigger evaluations.

Answer

Use the 'BlobTrigger' with the 'LeaseBlob' property set to 'True'.

Answer

Set the 'ScanBlob' property to 'True' in the trigger binding.

Question 11

Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). One of the microservices is a web API that processes user uploads and stores them in Azure Blob Storage. The API is stateless and scales horizontally. You need to implement authentication and authorization for the API using Microsoft Entra ID. The API should validate tokens issued by Entra ID and allow only users with the 'Files.Upload' scope. You need to configure the API's code and AKS deployment accordingly. Which approach should you use?

Accepted Answer

Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.. Microsoft Entra ID pod identity allows you to assign a managed identity to the pod, which the API can use to authenticate with Microsoft Entra ID. The Microsoft.Identity.Web library simplifies token validation and scope checking in ASP.NET Core applications, enabling the API to validate tokens issued by Entra ID and enforce the 'Files.Upload' scope. This approach aligns with the stateless, horizontally scalable nature of the microservice and avoids managing secrets.

Answer

Store the storage account access keys in the API configuration and validate requests using shared access signatures.

Answer

Configure the API to use client certificate authentication instead of tokens.

Answer

Expose the API through Azure API Management (APIM) and configure APIM to validate tokens and check scope.

Question 12

You are designing a serverless application using Azure Functions that processes high-volume events from Azure Event Hubs. The events are then written to Azure Cosmos DB. The function must guarantee at-least-once delivery and be resilient to failures. The Cosmos DB account uses the SQL API and is configured with a single write region. You need to design the function to handle transient failures when writing to Cosmos DB without losing events. What should you do?

Accepted Answer

Use the Cosmos DB output binding with built-in retry policy and configure the trigger to checkpoint only after successful writes.. Using the Cosmos DB output binding with its built-in retry policy automatically handles transient failures by retrying writes. By configuring the Event Hubs trigger to checkpoint only after a successful write, you ensure that events are not acknowledged until they are durably stored in Cosmos DB, guaranteeing at-least-once delivery and resilience to failures.

Answer

Increase the Event Hubs trigger's batch size to reduce the number of writes.

Answer

Implement a poison message queue to store failed events and reprocess them later.

Answer

In the function code, manually write to Cosmos DB and then manually checkpoint the Event Hubs partition.

Question 13

Your company runs a web application on Azure App Service that uses a custom domain. The application must be accessible only via HTTPS. You have already uploaded an SSL certificate for the custom domain. However, users can still access the site via HTTP. You need to enforce HTTPS redirection. What should you do?

Accepted Answer

Enable the 'HTTPS Only' setting in the App Service's TLS/SSL settings blade.. The 'HTTPS Only' setting in the App Service's TLS/SSL settings blade enforces that all incoming requests are redirected from HTTP to HTTPS at the platform level, before any application code runs. Since you have already uploaded an SSL certificate, enabling this setting ensures that users cannot access the site via HTTP, meeting the requirement without modifying application code.

Answer

Set the 'Minimum TLS Version' to 1.2.

Answer

Add a rewrite rule in the web.config file to redirect HTTP to HTTPS.

Answer

Configure the App Service to require client certificates.

Question 14

You are deploying a containerized application on Azure Container Instances (ACI) that needs to run as a background job every hour. The job processes data from an Azure SQL Database and sends a report via email. You need to minimize costs while ensuring the job runs reliably on schedule. The job takes about 10 minutes to complete. What should you do?

Accepted Answer

Create an Azure Logic App with a recurrence trigger that starts the container group using the 'Start Container Group' action, and stop it after completion.. It uses Azure Logic Apps with a recurrence trigger to start the container group only when needed, and stops it after the job completes. This minimizes costs by avoiding continuous running charges for the container, while the Logic App itself incurs minimal execution cost. The job's 10-minute duration fits well within the 1-hour recurrence window, ensuring reliable scheduling without idle compute time.

Answer

Use Azure Batch with a job schedule to run the container as a task.

Answer

Deploy the container on a single Azure virtual machine and schedule it using Windows Task Scheduler.

Answer

Use an Azure Function with a timer trigger that uses the Azure Container Instances SDK to start the container group.

Question 15

Your company uses Azure App Service to host a web application that requires periodic database maintenance. The maintenance tasks are time-consuming and must run outside of peak hours. You need to schedule these tasks to run automatically at 2:00 AM every Sunday. The tasks should be implemented as an Azure Function that runs in the same App Service plan to reduce costs. What should you do?

Accepted Answer

Create a separate Azure Function App in the same App Service plan and configure a timer trigger.. Creating a separate Azure Function App and hosting it on the *same existing dedicated App Service Plan* (e.g., Basic, Standard, Premium) allows the Azure Function to run using the existing compute resources. This directly meets the requirement to run in the 'same App Service plan to reduce costs' by leveraging existing infrastructure. A timer trigger is the appropriate mechanism to schedule the function to run automatically at 2:00 AM every Sunday. This option also fulfills the requirement that the tasks 'should be implemented as an Azure Function'.

Option A is incorrect because deploying to a Consumption plan would create a *separate* Function App resource with a serverless billing model, which does not align with the 'in the same App Service plan' requirement for cost reduction in the context of an existing dedicated App Service plan.

Option C is incorrect because, while WebJobs are suitable for background tasks and can share an App Service plan, they are not Azure Functions. The STEM explicitly requires the tasks to be implemented as an Azure Function.

Option D is incorrect because Azure Logic Apps are a separate service, incurring separate costs, and do not fulfill the requirement to implement the task 'as an Azure Function' and run it 'in the same App Service plan' for cost reduction.

Answer

Deploy the maintenance code as an Azure Function in the Consumption plan and configure a timer trigger.

Answer

Add a WebJob to the App Service that uses a scheduled trigger to run the maintenance code.

Answer

Use Azure Logic Apps with a recurrence trigger to call the web application's maintenance endpoint.