AZ-204 Develop Azure compute solutions Practice Test 6 — 15 Questions

Question 1

A Durable Functions workflow for a booking backend must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is designed for scenarios where multiple independent tasks must execute in parallel, and the workflow must wait for all results before proceeding. In Durable Functions, this is implemented using `Task.WhenAll()` to fan out activity function calls and then aggregate their results, which matches the requirement of calling five independent activities and continuing only after all results are available.

Answer

Monitor pattern

Answer

Human interaction

Answer

Function chaining

Question 2

An Azure Container Instance running a webhook processor requires a password at startup. The password must not be visible in the portal or container logs. What should be used?

Accepted Answer

Secure environment variable. Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and they are not visible in the Azure portal or container logs. This ensures the password is available to the container at startup without exposing it through the portal interface or log output, meeting the security requirement.

Answer

Container command-line argument

Answer

Public blob containing the password

Answer

Plain environment variable

Question 3

A report export service hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot and then swapping with production ensures zero-downtime because the swap operation warms up the target slot (staging) before routing traffic to it. The health check validation before swap confirms the new release is stable, preventing 502 errors from reaching users. This approach leverages Azure App Service deployment slots, which support traffic routing and warm-up during swap.

Answer

Deploy directly to production during business hours

Answer

Restart the App Service plan before each deployment

Answer

Disable health checks

Question 4

A Kubernetes-based image resize worker on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role eliminates the need to store registry passwords in Kubernetes secrets. This leverages Azure AD managed identities for secure, password-less authentication, where the AKS cluster's kubelet uses its managed identity to authenticate with ACR via Azure Resource Manager tokens. The AcrPull role assignment authorizes the identity to pull images, ensuring credentials are never exposed in manifests or secrets.

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Answer

Use an App Service deployment slot

Question 5

A checkout API uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the authentication provider at the App Service platform level. This ensures that the HTTP trigger function only receives requests with valid tokens, without requiring custom authorization logic in the function code.

Answer

Deployment slots

Answer

Application Insights sampling

Answer

Function timeout

Question 6

A long-running claims processing function must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpoints (via event sourcing), and replay-safe orchestration, which are essential for a long-running claims processing function that must handle thousands of independent files reliably. The orchestrator function manages state and execution flow, automatically saving progress and allowing replay from checkpoints in case of failures, ensuring exactly-once processing semantics.

Answer

Timer trigger only

Answer

Azure Policy remediation

Answer

Blob lifecycle management

Question 7

A document rendering job in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Enable a managed identity for the web app. A managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings. This is the foundational step for secure, identity-based access to Key Vault.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 8

An Azure Functions IoT command API must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used?

Accepted Answer

Premium plan. The Premium plan (Elastic Premium EP) is the correct choice because it supports VNet integration for accessing resources inside a virtual network, allows execution durations up to 30 minutes (the Consumption plan caps at 10 minutes by default), and provides serverless scaling without requiring you to manage virtual machines. This plan also offers always-ready instances to reduce cold start latency, which is critical for IoT command APIs.

Answer

Azure Batch pool

Answer

Consumption plan

Answer

App Service Free tier

Question 9

A containerized booking backend deployed to Azure Container Apps must scale to zero when idle and scale out based on queue length. What should the developer configure?

Accepted Answer

A KEDA-based scale rule for the queue trigger. KEDA (Kubernetes Event-Driven Autoscaling) is natively integrated with Azure Container Apps to enable event-driven scaling. By configuring a KEDA-based scale rule with an Azure Queue Storage trigger, the container app can scale to zero replicas when the queue is empty and scale out based on the queue length, meeting the requirement for idle scaling and queue-driven scaling.

Answer

A manual replica count only

Answer

An Availability Set

Answer

An Azure Front Door health probe

Question 10

A web app for a webhook processor needs separate staging and production environments. The team must warm up the new version before swapping traffic. Which App Service feature should be used?

Accepted Answer

Deployment slots. Deployment slots are the correct feature because they enable separate staging and production environments within the same App Service plan, allowing you to warm up the new version in a staging slot before performing a zero-downtime swap with the production slot. This directly supports the requirement for traffic swapping after warm-up, which is a core capability of slot-swapping in Azure App Service.

Answer

Backup and restore

Answer

App Service access restrictions

Answer

Always On only

Question 11

An Azure Functions report export service processes Service Bus messages. The function sometimes fails after partially completing work. Which two practices improve correctness?

Accepted Answer

Use dead-letter handling for repeatedly failing messages. Azure Functions can use dead-letter handling to isolate messages that repeatedly fail processing, preventing them from blocking the queue and allowing investigation without data loss. This is a standard pattern for Service Bus triggered functions to manage poison messages gracefully.

Answer

Store connection strings in source code

Answer

Disable retries for all messages

Question 12

A image resize worker runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) over the Microsoft backbone network. It uses a delegated subnet in the VNet to assign the app a network interface in the VNet, allowing it to reach private APIs without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 13

A Durable Functions workflow for a checkout API must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is correct because Durable Functions provides the `CallActivityAsync` method in parallel to invoke multiple independent activity functions simultaneously, and the `Task.WhenAll` pattern waits for all results before proceeding. This matches the requirement to call five independent activities and continue only after all results are available, which is the exact definition of fan-out/fan-in.

Answer

Human interaction

Answer

Function chaining

Answer

Monitor pattern

Question 14

An Azure Container Instance running a claims processing function requires a password at startup. The password must not be visible in the portal or container logs. What should be used?

Accepted Answer

Secure environment variable. Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and are never exposed in the Azure portal, container logs, or to other users. This ensures the password remains confidential while being available to the container at startup, meeting the requirement of not being visible in the portal or logs.

Answer

Plain environment variable

Answer

Public blob containing the password

Answer

Container command-line argument

Question 15

A document rendering job hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot allows the new version of the app to be fully initialized and validated via health checks before traffic is routed to it. The swap operation in Azure App Service moves the production traffic to the staging slot without any downtime, as the slots share the same front-end and the swap is atomic. This directly addresses the 502 errors caused by incomplete deployments and ensures zero-downtime release with validation.

Answer

Deploy directly to production during business hours

Answer

Disable health checks

Answer

Restart the App Service plan before each deployment