AZ-204 Develop Azure compute solutions Practice Test 7 — 15 Questions

Question 1

A Kubernetes-based IoT command API on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role enables Azure AD-based authentication without storing credentials in Kubernetes secrets. The kubelet on each node uses its managed identity to obtain an ACR access token via Azure AD, allowing secure image pulls. This approach eliminates the need for manual password management and follows security best practices for Azure-integrated workloads.

Answer

Use an App Service deployment slot

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Question 2

A booking backend uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' or 'Return HTTP 401 Unauthorized'. This is enforced at the App Service platform layer, meaning the function trigger code never runs for unauthenticated requests, which is exactly the requirement.

Answer

Application Insights sampling

Answer

Deployment slots

Answer

Function timeout

Question 3

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Answer

Blob lifecycle management

Answer

Timer trigger only

Answer

Azure Policy remediation

Question 4

A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Grant the identity permission to read the required secrets. Granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 5

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution durations up to 30 minutes (unlike the Consumption plan's 10-minute default), and provides serverless scaling without requiring you to manage virtual machines or add custom operational scripts. It is the only plan that combines these capabilities for a long-running, VNet-connected function.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 6

A workflow must process 500 customer records in parallel and then aggregate all results into a single summary report. The team wants to use Azure Durable Functions so the orchestration state is durable and the solution can resume after a Function App restart. Which Durable Functions pattern matches this requirement?

Accepted Answer

Fan-out/fan-in: start 500 activity functions in parallel with Task.WhenAll inside the orchestrator, then aggregate all returned results. The fan-out/fan-in pattern in Durable Functions is specifically designed to execute multiple activity functions in parallel using Task.WhenAll inside an orchestrator, then aggregate their results. This matches the requirement to process 500 customer records concurrently and produce a single summary report, while the orchestration state is durably persisted and can resume after a Function App restart.

Answer

Function chaining: call each activity function sequentially, collecting each result before starting the next

Answer

Async HTTP API: start the workflow with an HTTP trigger, return a 202 with a status URL, and have the client poll for completion

Answer

Monitor: use a Durable timer loop that checks a status table every 60 seconds until all records are marked processed

Question 7

Configuration values that control whether a new checkout experience is enabled must be changeable without redeploying the App Service application. The team uses ASP.NET Core. Which Azure service provides the correct combination of runtime configuration reload and feature flag management?

Accepted Answer

Azure App Configuration with the feature management library enabled for ASP.NET Core. Azure App Configuration with the feature management library for ASP.NET Core provides a centralized, managed service that supports dynamic configuration reload without restarting the application and built-in feature flag management. The feature management library integrates with the .NET Core configuration system, allowing feature flags to be evaluated and toggled at runtime via the `IFeatureManager` interface, with automatic refresh based on a configurable cache expiration. This meets the requirement of changing the checkout experience without redeploying the App Service.

Answer

App Service Application Settings with the flag stored as an environment variable

Answer

An ARM template parameter file stored in the application's repository

Answer

An Azure DevOps pipeline variable referenced during the build stage

Question 8

The internal API team is deploying a containerized .NET API that receives sporadic requests — sometimes none for hours, then bursts of activity. Cost is a priority. The team wants the container to stop running when idle and start automatically when a request arrives, with no server management overhead. Which Azure service is the best fit?

Accepted Answer

Azure Container Apps with scale-to-zero enabled on the HTTP ingress. Azure Container Apps with scale-to-zero enabled on the HTTP ingress is the best fit because it allows the container to scale down to zero replicas when idle, automatically stopping the container to save costs, and scales back up to handle incoming HTTP requests with no server management overhead. This serverless platform abstracts Kubernetes infrastructure, meeting the team's requirement for minimal operational burden and cost efficiency.

Answer

Azure Kubernetes Service with the cluster autoscaler set to a minimum node count of zero

Answer

Azure App Service on a B1 (Basic) plan with Always On disabled

Answer

Azure Virtual Machine Scale Sets with scheduled scaling to zero instances overnight

Question 9

Images are uploaded to a high-volume Blob Storage account. An Azure Function with a Blob Storage trigger processes each new image. The team has observed processing delays of up to 10 minutes on accounts with large numbers of containers and blobs. They need processing to start within seconds of upload. What should the developer change?

Accepted Answer

Replace the Blob Storage trigger with an Event Grid trigger and create a Blob Created event subscription that targets the Function's endpoint. Event Grid provides near-real-time event delivery (typically under 1 second) for Blob Created events, eliminating the polling latency inherent in the Blob Storage trigger. The Blob Storage trigger polls Azure Storage logs for new blobs, which can cause delays of up to 10 minutes in high-volume accounts with many containers and blobs. By switching to an Event Grid trigger, the function is invoked directly via HTTP webhook as soon as the blob is created, meeting the requirement for processing to start within seconds.

Answer

Switch to a Timer trigger that runs every 30 seconds and lists newly created blobs via the SDK

Answer

Use a Queue Storage trigger and write blob metadata to the queue from the upload client

Answer

Move the Function to a Premium plan, which uses a dedicated worker and eliminates Blob trigger polling delays

Question 10

An App Service application uses a staging deployment slot connected to a staging database and a production slot connected to a production database. Both use an app setting called 'DbConnectionString'. After a slot swap, the production slot starts using the staging database connection string. What configuration change prevents this?

Accepted Answer

Mark the 'DbConnectionString' app setting as a deployment slot setting (sticky) so it remains bound to its slot across all swaps. Marking the 'DbConnectionString' app setting as a deployment slot setting (also called a sticky setting) ensures that the setting remains bound to its slot during a swap. When a slot swap occurs, Azure App Service automatically moves non-sticky app settings and connection strings to the target slot, but sticky settings are excluded from the swap and stay with their original slot. This prevents the production slot from accidentally picking up the staging database connection string after the swap.

Answer

Store the connection string in Azure Key Vault and reference it via a Key Vault reference in both slots

Answer

Use different app setting names for each slot (e.g., 'StagingDbConnectionString' and 'ProductionDbConnectionString') and swap code manually

Answer

Disable slot swaps and use a CI/CD pipeline to deploy directly to production instead

Question 11

Arrange the steps to deploy an Azure App Service using Azure CLI in the correct order.

Accepted Answer

Create resource group, then App Service plan, then web app, then deploy code, then verify. To deploy an App Service, first create a resource group, then an App Service plan, then the web app, deploy code, and finally verify.

Answer

Create App Service plan, then resource group, then web app, then deploy code, then verify

Answer

Create resource group, then web app, then App Service plan, then deploy code, then verify

Answer

Deploy code, then resource group, then App Service plan, then web app, then verify

Question 12

Arrange the steps to implement Azure Functions with a Cosmos DB trigger in the correct order.

Accepted Answer

Create Cosmos DB, then create Function App, then add trigger binding, then write code, then test.. First create Cosmos DB, then Function App, add trigger binding, write code, test.

Answer

Create Function App, then create Cosmos DB, then add trigger binding, then write code, then test.

Answer

Create Cosmos DB, then create Function App, then write code, then add trigger binding, then test.

Answer

Create Cosmos DB, then create Function App, then add trigger binding, then test, then write code.

Question 13

Match each Azure service to its primary purpose.

Accepted Answer

Azure Functions: Run event-driven code without managing servers. The correct matches are: Azure Functions for serverless event-driven code, Azure App Service for hosting web apps/APIs, Azure Logic Apps for workflow automation, and Azure Cosmos DB for globally distributed NoSQL database. Common confusions involve swapping the purposes of Azure Functions and Azure App Service.

Answer

Azure Functions: Host web applications, REST APIs, and mobile backends

Answer

Azure App Service: Run event-driven code without managing servers

Question 14

Match each Azure security feature to its function.

Accepted Answer

Azure Security Center: Unified security management and threat protection across hybrid cloud workloads. Azure Security Center provides unified security management and threat protection; Azure Sentinel is a cloud-native SIEM/SOAR; Azure Key Vault safeguards keys and secrets; Azure Active Directory manages identity and access. Common confusions include mixing Security Center with Sentinel or Sentinel with Azure AD.

Answer

Azure Security Center: Cloud-native SIEM and SOAR solution

Answer

Azure Sentinel: Identity and access management service

Question 15

You are developing a solution that processes orders from an e-commerce website. The order processing logic is CPU-intensive and can take up to 30 seconds per order. You need to ensure that the web front-end remains responsive and that orders are processed reliably. What should you use?

Accepted Answer

Add orders to Azure Queue Storage and process them using a background worker role.. Azure Queue Storage provides a reliable, asynchronous message-passing mechanism that decouples the CPU-intensive order processing from the web front-end. By adding orders to a queue and processing them with a background worker (e.g., a WebJob or Worker Role), the web front-end remains responsive, and the queue ensures at-least-once delivery and durability, even if the worker fails or restarts.

Answer

Use Azure WebJobs to process orders in the same App Service plan.

Answer

Use Azure Service Bus Queues with sessions for order processing.

Answer

Use Azure Functions with Durable Functions to manage order processing state.