AZ-204 Develop Azure compute solutions Practice Test 2 — 15 Questions

Question 1

You are deploying a containerized application to Azure Container Instances (ACI). Which TWO actions should you take to ensure the container can securely access an Azure Key Vault?

Accepted Answer

Enable a managed identity for the container group. To securely access Azure Key Vault from Azure Container Instances, the recommended approach is to enable a managed identity for the container group. This allows the container to authenticate to Key Vault without requiring any credentials in the container image or code. The managed identity is integrated with Azure AD, and the container can request an access token from the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. This token authorizes requests to Key Vault, ensuring secrets are never exposed. Note that Azure Container Instances does not support mounting a volume directly from Key Vault; the volume mount option shown in option C is not available in ACI.

Answer

Pass secrets as environment variables

Answer

Mount a volume that maps to a Key Vault secret store

Answer

Register the container with an Azure AD application

Answer

Configure a custom DNS server

Question 2

Refer to the exhibit. You are deploying this ARM template to create a deployment slot for an Azure App Service. The template deploys successfully. However, the slot-specific app setting 'DEPLOYMENT_SLOT' is not visible in the Azure portal under the slot's Configuration > Application settings. What is the most likely cause?

Accepted Answer

The template does not set 'slotSticky' to true for the app setting. In ARM templates, app settings are made slot-specific (sticky) by explicitly listing them in the 'appSettingNames' property of a 'Microsoft.Web/sites/slots/config' resource with the name 'slotConfigNames'. Without this configuration, the setting is treated as a regular, non-sticky app setting. While it will still appear under the slot's Configuration > Application settings in the Azure portal, it will not be marked as a 'Deployment slot setting' and thus will not be pinned to the deployment slot during a swap.

Answer

Slot settings are not supported in ARM templates

Answer

Deployment slots have been deprecated for App Service

Answer

The app setting name must be prefixed with 'APPSETTING_'

Question 3

Which TWO options are valid ways to authenticate an Azure Functions app to Azure Storage when using a managed identity? (Choose two.)

Accepted Answer

Enable system-assigned managed identity on the function app and grant it the 'Storage Blob Data Contributor' role. Enabling a system-assigned managed identity on the function app allows it to authenticate to Azure Storage without storing credentials. Granting an appropriate RBAC role (e.g., 'Storage Blob Data Contributor' for blobs, 'Storage Queue Data Contributor' for queues) to that identity via Azure RBAC authorizes the function app to perform data operations using Azure AD tokens, which are automatically managed by the Azure platform. Similarly, creating a user-assigned managed identity, assigning it to the function app, and granting it the necessary RBAC role achieves the same goal for user-assigned identities.

Answer

Generate a shared access signature (SAS) token and include it in the connection string

Answer

Use the storage account access key in the connection string

Answer

Use the default AzureWebJobsStorage connection string from the function app settings

Question 4

Which TWO Azure services can be used to trigger an Azure Function when a new blob is added to an Azure Storage container? (Choose two.)

Accepted Answer

Azure Event Grid trigger. Azure Event Grid trigger enables an Azure Function to be invoked automatically when a new blob is created in a Storage account. Event Grid provides a reliable, low-latency event-driven architecture that supports blob created events, making it a valid trigger for this scenario. Additionally, the Azure Blob Storage trigger is a native Azure Function binding that directly monitors a specified Azure Storage container for new or updated blobs, automatically invoking the function when such an event occurs.

Answer

Azure Queue Storage trigger

Answer

Azure Cosmos DB trigger

Answer

HTTP trigger

Question 5

Which THREE factors should you consider when choosing between Azure Functions (Consumption plan) and Azure Container Instances for running a background job that processes messages from Azure Service Bus?

Accepted Answer

Scaling behavior (automatic vs. manual).. Azure Functions on the Consumption plan automatically scales out based on the number of incoming Service Bus messages, while Azure Container Instances require manual scaling or external orchestration (e.g., KEDA) to adjust the number of container groups. Functions also offer native, first-class triggers for Azure Service Bus, simplifying integration and event-driven processing, whereas ACI requires custom code within the container to poll the Service Bus or an external service to trigger it. Furthermore, Azure Functions Consumption plan uses a pay-per-execution cost model, ideal for intermittent workloads, while ACI charges per second for allocated CPU and memory, which can be less cost-effective for idle periods.

Answer

Ability to use custom base images.

Answer

Cold start latency.

Question 6

Refer to the exhibit. You have an Azure App Service that uses the authentication settings shown. Users report that they are repeatedly prompted to sign in even after authenticating. What is the most likely cause?

Accepted Answer

The 'loginParameters' does not include 'offline_access'.. The most likely cause is that the 'loginParameters' does not include 'offline_access'. For Azure App Service Authentication (Easy Auth) to maintain a user's session without repeated sign-ins, it needs to be able to refresh the access token silently. This requires a refresh token, which is only issued by Azure AD if the 'offline_access' scope is explicitly requested during the initial login. Without this scope, no refresh token is provided, and once the access token expires (typically after 1 hour), the user is prompted to sign in again.

Answer

The 'allowedAudiences' is missing the App Service URL.

Answer

The 'issuer' URL is incorrect; it should be a tenant-specific endpoint.

Answer

No 'tokenRefreshEndpoint' is configured for session management.

Question 7

Which THREE considerations are important when designing a solution using Azure Functions with a Consumption plan for a latency-sensitive application?

Accepted Answer

Cold start latency may impact initial requests.. A is correct because Azure Functions on the Consumption plan can experience cold starts when a function app is idle or after scaling down to zero instances. During a cold start, the runtime must load the function host, load dependencies, and execute the function code, which adds latency that can be unacceptable for latency-sensitive applications. This delay occurs because the Consumption plan does not keep instances warm when there is no traffic.
B is correct because Azure Functions on the Consumption plan have a default execution timeout of 5 minutes, which can be configured up to a maximum of 10 minutes. For latency-sensitive applications, if a task requires longer processing, this hard limit is a critical design consideration, potentially requiring a different architecture (e.g., Durable Functions, or a different hosting plan).
C is correct because while the Consumption plan scales dynamically, the scaling process is not instantaneous. When traffic increases rapidly, it takes some time for new instances to be provisioned and initialized. During this scaling period, requests might queue or experience increased latency until enough instances are available, leading to latency spikes that can be problematic for latency-sensitive applications.

Answer

Always-on feature must be enabled to avoid cold starts.

Answer

Pre-warmed instances can be configured to reduce latency.

Question 8

You are deploying an Azure App Service that must be accessible only from your corporate network via a VPN. You need to restrict inbound traffic. Which TWO actions should you take?

Accepted Answer

Deploy the App Service inside a VNet using an App Service Environment. {"B":"Deploying the App Service inside a VNet using an App Service Environment (ASE) places the App Service on dedicated infrastructure that is fully integrated into your virtual network. If an *external* ASE is used, it still has a public endpoint. To ensure access is *only* from your corporate network via VPN, you must then configure IP address restrictions (Option E) on the App Service or Network Security Groups on the ASE subnet to allow only traffic from your corporate VPN's egress IP address. An *internal* ASE (ILB ASE) would inherently provide this isolation without needing additional IP restrictions on the App Service itself for public internet access."}

Answer

Use Azure Front Door with WAF

Answer

Configure a service endpoint

Answer

Enable VNet integration for the App Service

Question 9

You are developing a solution that processes orders. Each order must be processed exactly once, in the order it was received. You need to choose an Azure service that guarantees FIFO delivery and at-least-once processing. Which service should you use?

Accepted Answer

Azure Service Bus Queue with sessions. Azure Service Bus Queue with sessions is correct because it provides FIFO (first-in, first-out) delivery by grouping related messages into sessions, ensuring messages within a session are processed in order. The at-least-once processing guarantee is inherent to Service Bus queues, as messages are not removed until the receiver completes them, and they can be redelivered if the processing fails or times out.

Answer

Azure Event Hubs

Answer

Azure Event Grid

Answer

Azure Storage Queue

Question 10

You are developing a background job that runs every hour to process data from an Azure SQL database and send notifications via SendGrid. The job must be serverless and cost-effective, and must automatically retry on failure. Which TWO options meet the requirements?

Accepted Answer

Azure Functions with Timer trigger. Azure Functions with a Timer trigger is correct because it provides a serverless, cost-effective compute model that runs on a schedule (e.g., every hour) without managing infrastructure. It integrates with Azure SQL via built-in bindings or custom code and supports sending notifications (e.g., via SendGrid SDK). Automatic retry on failure is supported through the host's retry policy or by implementing custom retry logic in code, meeting the requirements for a background job. Azure Logic Apps with a Recurrence trigger is also correct as it offers a serverless, low-code/no-code workflow solution that can be triggered on a schedule. It has built-in connectors for Azure SQL Database and SendGrid, and inherently supports automatic retry policies for actions, making it suitable for reliable background processing.

Answer

Azure Virtual Machine with a scheduled task

Answer

Azure Batch with a schedule

Answer

Azure WebJobs with TimerTrigger

Question 11

You are building a serverless API using Azure Functions. The API must be secured with OAuth 2.0 and must support both user authentication and application permissions. You need to configure the function app appropriately. Which TWO steps should you take?

Accepted Answer

Expose scopes and app roles in the Microsoft Entra ID app registration.. Registering the function app in Microsoft Entra ID (D) is the foundational step, as any application interacting with Entra ID for authentication and authorization must first be registered. Once registered, exposing scopes (for delegated permissions/user authentication) and app roles (for application permissions) in that Entra ID app registration (A) is crucial. These definitions allow the API to specify what permissions it offers, enabling it to support both user authentication and application permissions via OAuth 2.0 tokens.

Answer

Use Azure AD v1.0 endpoints.

Answer

Configure authentication via the 'Authentication' blade in the portal.

Answer

Enable Azure App Service built-in authentication (EasyAuth).

Question 12

Which TWO actions can you perform using Azure Container Registry (ACR) tasks?

Accepted Answer

Schedule a task to patch base images. ACR Tasks supports automated patching of base images through the 'base image update' trigger. When a base image in a public or private registry is updated, ACR Tasks can automatically rebuild any container images that depend on it, ensuring security patches are applied without manual intervention. This is configured via the `--base-image-trigger-enabled` flag in the `az acr task create` command. Additionally, ACR Tasks can be configured to automatically build container images when code is committed to a Git repository (e.g., GitHub, Azure Repos) using a Git commit trigger, which is specified via the `--context` parameter pointing to the repository.

Answer

Import images from another registry

Answer

Deploy images to AKS

Answer

Automatically scan images for vulnerabilities

Question 13

Which THREE are benefits of using Azure Logic Apps compared to Azure Functions for workflow orchestration?

Accepted Answer

Native connectors to hundreds of services. Azure Logic Apps provides over 400 prebuilt connectors to services like Office 365, Dynamics 365, Salesforce, and SQL Server, enabling rapid integration without writing any code (Option A). This native connector ecosystem is a key differentiator from Azure Functions, which requires custom code to interact with external services via SDKs or HTTP calls. Logic Apps are also designed for long-running, stateful workflows with built-in checkpointing and retry policies, making them ideal for complex orchestrations without requiring developers to manage state explicitly (Option B). Additionally, Logic Apps offer a rich visual designer for drag-and-drop workflow creation, simplifying the design and understanding of complex processes compared to the code-first approach of Azure Functions (Option D).

Answer

Better suited for custom code logic

Answer

Lower cost for high-volume processing

Question 14

You are deploying a critical web application on Azure App Service that must handle sudden traffic spikes. The application stores session data in memory. You need to ensure session state is preserved across scale-out events. Which THREE actions should you take?

Accepted Answer

Enable sticky sessions (ARR affinity) in the App Service configuration.. To preserve session state across scale-out events when the application initially stores data in memory, multiple strategies can be employed:
1.  **Enable sticky sessions (ARR affinity)**: This ensures that all requests from a client session are routed to the same App Service instance. While it helps preserve *in-memory* session state by maintaining client-instance affinity, it does not make the session resilient to instance restarts or failures.
2.  **Configure the application to use Azure Cache for Redis for session state**: This is a robust solution where session data is moved from individual instance memory to a shared, external, high-performance cache. All App Service instances can access the same session data, ensuring preservation across scale-out, instance failures, and restarts.
3.  **Use a SQL Server session state provider to store session data**: Similar to Redis, this involves moving session data to a shared, external SQL Server database. This provides a persistent and shared store for session state, making it accessible to all instances and resilient to individual instance issues.

Answer

Disable ARR affinity to allow any instance to handle requests.

Answer

Set the session state mode to 'InProc' in the web.config.

Question 15

You are developing a serverless application using Azure Functions. The application processes orders from a queue and writes results to Azure Cosmos DB. You need to ensure that the function scales out automatically to handle sudden spikes in order volume. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the function app to use the Premium plan with Always Ready instances enabled.. The Premium plan supports Always Ready instances, which pre-warm a specified number of instances to eliminate cold start latency and ensure the function can handle sudden spikes in order volume without delay. This is critical for serverless applications that require consistent performance under load. Deploying to an App Service plan with multiple instances pre-allocated also ensures that a specified number of function instances are always running, eliminating cold start latency and providing immediate capacity to handle sudden spikes. App Service plans can also be configured with auto-scaling rules to automatically add or remove instances based on demand, further supporting automatic scale-out.

Answer

Use the Consumption plan with a max instance count of 200.

Answer

Implement a retry policy in the queue trigger to handle throttling.

Answer

Set the function's WEBSITE_MAX_DYNAMIC_APPLICATION_SCALE_OUT app setting to 500.