AZ-204 Develop Azure compute solutions Practice Test 5 — 15 Questions

Question 1

A document rendering job hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot allows the new version of the app to be fully initialized and validated via health checks before traffic is routed to it. The swap operation in Azure App Service moves the production traffic to the staging slot without any downtime, as the slots share the same front-end and the swap is atomic. This directly addresses the 502 errors caused by incomplete deployments and ensures zero-downtime release with validation.

Answer

Deploy directly to production during business hours

Answer

Disable health checks

Answer

Restart the App Service plan before each deployment

Question 2

A Kubernetes-based IoT command API on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Option C is correct because attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role enables Azure AD-based authentication without storing credentials in Kubernetes secrets. The kubelet on each node uses its managed identity to obtain an ACR access token via Azure AD, allowing secure image pulls. This approach eliminates the need for manual password management and follows security best practices for Azure-integrated workloads.

Answer

Use an App Service deployment slot

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Question 3

A booking backend uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' or 'Return HTTP 401 Unauthorized'. This is enforced at the App Service platform layer, meaning the function trigger code never runs for unauthenticated requests, which is exactly the requirement.

Answer

Application Insights sampling

Answer

Deployment slots

Answer

Function timeout

Question 4

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Answer

Blob lifecycle management

Answer

Timer trigger only

Answer

Azure Policy remediation

Question 5

A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Grant the identity permission to read the required secrets. Option C is correct because granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 6

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution durations up to 30 minutes (unlike the Consumption plan's 10-minute default), and provides serverless scaling without requiring you to manage virtual machines or add custom operational scripts. It is the only plan that combines these capabilities for a long-running, VNet-connected function.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 7

A workflow must process 500 customer records in parallel and then aggregate all results into a single summary report. The team wants to use Azure Durable Functions so the orchestration state is durable and the solution can resume after a Function App restart. Which Durable Functions pattern matches this requirement?

Accepted Answer

Fan-out/fan-in: start 500 activity functions in parallel with Task.WhenAll inside the orchestrator, then aggregate all returned results. Option A is correct because the fan-out/fan-in pattern in Durable Functions is specifically designed to execute multiple activity functions in parallel using Task.WhenAll inside an orchestrator, then aggregate their results. This matches the requirement to process 500 customer records concurrently and produce a single summary report, while the orchestration state is durably persisted and can resume after a Function App restart.

Answer

Function chaining: call each activity function sequentially, collecting each result before starting the next

Answer

Async HTTP API: start the workflow with an HTTP trigger, return a 202 with a status URL, and have the client poll for completion

Answer

Monitor: use a Durable timer loop that checks a status table every 60 seconds until all records are marked processed

Question 8

Configuration values that control whether a new checkout experience is enabled must be changeable without redeploying the App Service application. The team uses ASP.NET Core. Which Azure service provides the correct combination of runtime configuration reload and feature flag management?

Accepted Answer

Azure App Configuration with the feature management library enabled for ASP.NET Core. Azure App Configuration with the feature management library for ASP.NET Core provides a centralized, managed service that supports dynamic configuration reload without restarting the application and built-in feature flag management. The feature management library integrates with the .NET Core configuration system, allowing feature flags to be evaluated and toggled at runtime via the `IFeatureManager` interface, with automatic refresh based on a configurable cache expiration. This meets the requirement of changing the checkout experience without redeploying the App Service.

Answer

App Service Application Settings with the flag stored as an environment variable

Answer

An ARM template parameter file stored in the application's repository

Answer

An Azure DevOps pipeline variable referenced during the build stage

Question 9

The internal API team is deploying a containerized .NET API that receives sporadic requests — sometimes none for hours, then bursts of activity. Cost is a priority. The team wants the container to stop running when idle and start automatically when a request arrives, with no server management overhead. Which Azure service is the best fit?

Accepted Answer

Azure Container Apps with scale-to-zero enabled on the HTTP ingress. Azure Container Apps with scale-to-zero enabled on the HTTP ingress is the best fit because it allows the container to scale down to zero replicas when idle, automatically stopping the container to save costs, and scales back up to handle incoming HTTP requests with no server management overhead. This serverless platform abstracts Kubernetes infrastructure, meeting the team's requirement for minimal operational burden and cost efficiency.

Answer

Azure Kubernetes Service with the cluster autoscaler set to a minimum node count of zero

Answer

Azure App Service on a B1 (Basic) plan with Always On disabled

Answer

Azure Virtual Machine Scale Sets with scheduled scaling to zero instances overnight

Question 10

Images are uploaded to a high-volume Blob Storage account. An Azure Function with a Blob Storage trigger processes each new image. The team has observed processing delays of up to 10 minutes on accounts with large numbers of containers and blobs. They need processing to start within seconds of upload. What should the developer change?

Accepted Answer

Replace the Blob Storage trigger with an Event Grid trigger and create a Blob Created event subscription that targets the Function's endpoint. Option A is correct because Event Grid provides near-real-time event delivery (typically under 1 second) for Blob Created events, eliminating the polling latency inherent in the Blob Storage trigger. The Blob Storage trigger polls Azure Storage logs for new blobs, which can cause delays of up to 10 minutes in high-volume accounts with many containers and blobs. By switching to an Event Grid trigger, the function is invoked directly via HTTP webhook as soon as the blob is created, meeting the requirement for processing to start within seconds.

Answer

Switch to a Timer trigger that runs every 30 seconds and lists newly created blobs via the SDK

Answer

Use a Queue Storage trigger and write blob metadata to the queue from the upload client

Answer

Move the Function to a Premium plan, which uses a dedicated worker and eliminates Blob trigger polling delays

Question 11

An App Service application uses a staging deployment slot connected to a staging database and a production slot connected to a production database. Both use an app setting called 'DbConnectionString'. After a slot swap, the production slot starts using the staging database connection string. What configuration change prevents this?

Accepted Answer

Mark the 'DbConnectionString' app setting as a deployment slot setting (sticky) so it remains bound to its slot across all swaps. Option A is correct because marking the 'DbConnectionString' app setting as a deployment slot setting (also called a sticky setting) ensures that the setting remains bound to its slot during a swap. When a slot swap occurs, Azure App Service automatically moves non-sticky app settings and connection strings to the target slot, but sticky settings are excluded from the swap and stay with their original slot. This prevents the production slot from accidentally picking up the staging database connection string after the swap.

Answer

Store the connection string in Azure Key Vault and reference it via a Key Vault reference in both slots

Answer

Use different app setting names for each slot (e.g., 'StagingDbConnectionString' and 'ProductionDbConnectionString') and swap code manually

Answer

Disable slot swaps and use a CI/CD pipeline to deploy directly to production instead

Question 12

Arrange the steps to deploy an Azure App Service using Azure CLI in the correct order.

Question 13

Arrange the steps to implement Azure Functions with a Cosmos DB trigger in the correct order.

Question 14

Match each Azure service to its primary purpose.

Question 15

Match each Azure security feature to its function.