AZ-204 Develop Azure compute solutions Practice Test 7 — 15 Questions

Question 1

A web app for a webhook processor needs separate staging and production environments. The team must warm up the new version before swapping traffic. Which App Service feature should be used?

Accepted Answer

Deployment slots. Deployment slots are the correct feature because they enable separate staging and production environments within the same App Service plan, allowing you to warm up the new version in a staging slot before performing a zero-downtime swap with the production slot. This directly supports the requirement for traffic swapping after warm-up, which is a core capability of slot-swapping in Azure App Service.

Answer

Backup and restore

Answer

App Service access restrictions

Answer

Always On only

Question 2

An Azure Functions report export service processes Service Bus messages. The function sometimes fails after partially completing work. Which two practices improve correctness?

Accepted Answer

Use dead-letter handling for repeatedly failing messages. Azure Functions can use dead-letter handling to isolate messages that repeatedly fail processing, preventing them from blocking the queue and allowing investigation without data loss. This is a standard pattern for Service Bus triggered functions to manage poison messages gracefully.

Answer

Store connection strings in source code

Answer

Disable retries for all messages

Question 3

A image resize worker runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?

Accepted Answer

Regional VNet integration. Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) over the Microsoft backbone network. It uses a delegated subnet in the VNet to assign the app a network interface in the VNet, allowing it to reach private APIs without exposing them to the public internet.

Answer

Azure CDN custom domain

Answer

Application Gateway path routing

Answer

Private Endpoint for the web app only

Question 4

A Durable Functions workflow for a checkout API must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

Accepted Answer

Fan-out/fan-in. The fan-out/fan-in pattern is correct because Durable Functions provides the `CallActivityAsync` method in parallel to invoke multiple independent activity functions simultaneously, and the `Task.WhenAll` pattern waits for all results before proceeding. This matches the requirement to call five independent activities and continue only after all results are available, which is the exact definition of fan-out/fan-in.

Answer

Human interaction

Answer

Function chaining

Answer

Monitor pattern

Question 5

An Azure Container Instance running a claims processing function requires a password at startup. The password must not be visible in the portal or container logs. What should be used?

Accepted Answer

Secure environment variable. Secure environment variables in Azure Container Instances are encrypted at rest and in transit, and are never exposed in the Azure portal, container logs, or to other users. This ensures the password remains confidential while being available to the container at startup, meeting the requirement of not being visible in the portal or logs.

Answer

Plain environment variable

Answer

Public blob containing the password

Answer

Container command-line argument

Question 6

A document rendering job hosted on App Service returns intermittent 502 errors during deployment. The team wants zero-downtime release with validation before traffic moves. What should be implemented?

Accepted Answer

Deploy to a staging slot, validate health, then swap. Deploying to a staging slot allows the new version of the app to be fully initialized and validated via health checks before traffic is routed to it. The swap operation in Azure App Service moves the production traffic to the staging slot without any downtime, as the slots share the same front-end and the swap is atomic. This directly addresses the 502 errors caused by incomplete deployments and ensures zero-downtime release with validation.

Answer

Deploy directly to production during business hours

Answer

Disable health checks

Answer

Restart the App Service plan before each deployment

Question 7

A Kubernetes-based IoT command API on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?

Accepted Answer

Attach the ACR to AKS or grant the kubelet managed identity AcrPull. Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role enables Microsoft Entra ID-based authentication without storing credentials in Kubernetes secrets. The kubelet on each node uses its managed identity to obtain an ACR access token via Microsoft Entra ID, allowing secure image pulls. This approach eliminates the need for manual password management and follows security best practices for Azure-integrated workloads.

Answer

Use an App Service deployment slot

Answer

Store the ACR admin password in every deployment manifest

Answer

Make the container registry public

Question 8

A booking backend uses Azure Functions with HTTP triggers. The developer wants to reject unauthenticated calls before function code executes. Which feature should be configured?

Accepted Answer

App Service Authentication / Easy Auth with Microsoft Entra ID. App Service Authentication (Easy Auth) with Microsoft Entra ID allows the developer to reject unauthenticated calls before the function code executes by configuring the 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' or 'Return HTTP 401 Unauthorized'. This is enforced at the App Service platform layer, meaning the function trigger code never runs for unauthenticated requests, which is exactly the requirement.

Answer

Application Insights sampling

Answer

Deployment slots

Answer

Function timeout

Question 9

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

Accepted Answer

Durable Functions orchestrator. Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Answer

Blob lifecycle management

Answer

Timer trigger only

Answer

Azure Policy remediation

Question 10

A report export service in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Grant the identity permission to read the required secrets. Granting the managed identity permission to read secrets in Key Vault via Azure RBAC or access policies ensures that the App Service can authenticate without storing any secrets in configuration. This follows the principle of least privilege and eliminates the risk of credential leakage from app settings or connection strings.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 11

An Azure Functions image resize worker must run for up to 30 minutes and uses a VNet integration feature. The team wants serverless scaling without managing virtual machines. Which hosting plan should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Premium plan. The Premium plan is correct because it supports VNet integration, allows execution durations up to 30 minutes (unlike the Consumption plan's 10-minute default), and provides serverless scaling without requiring you to manage virtual machines or add custom operational scripts. It is the only plan that combines these capabilities for a long-running, VNet-connected function.

Answer

App Service Free tier

Answer

Azure Batch pool

Answer

Consumption plan

Question 12

A workflow must process 500 customer records in parallel and then aggregate all results into a single summary report. The team wants to use Azure Durable Functions so the orchestration state is durable and the solution can resume after a Function App restart. Which Durable Functions pattern matches this requirement?

Accepted Answer

Fan-out/fan-in: start 500 activity functions in parallel with Task.WhenAll inside the orchestrator, then aggregate all returned results. The fan-out/fan-in pattern in Durable Functions is specifically designed to execute multiple activity functions in parallel using Task.WhenAll inside an orchestrator, then aggregate their results. This matches the requirement to process 500 customer records concurrently and produce a single summary report, while the orchestration state is durably persisted and can resume after a Function App restart.

Answer

Function chaining: call each activity function sequentially, collecting each result before starting the next

Answer

Async HTTP API: start the workflow with an HTTP trigger, return a 202 with a status URL, and have the client poll for completion

Answer

Monitor: use a Durable timer loop that checks a status table every 60 seconds until all records are marked processed

Question 13

Configuration values that control whether a new checkout experience is enabled must be changeable without redeploying the App Service application. The team uses ASP.NET Core. Which Azure service provides the correct combination of runtime configuration reload and feature flag management?

Accepted Answer

Azure App Configuration with the feature management library enabled for ASP.NET Core. Azure App Configuration with the feature management library for ASP.NET Core provides a centralized, managed service that supports dynamic configuration reload without restarting the application and built-in feature flag management. The feature management library integrates with the .NET Core configuration system, allowing feature flags to be evaluated and toggled at runtime via the `IFeatureManager` interface, with automatic refresh based on a configurable cache expiration. This meets the requirement of changing the checkout experience without redeploying the App Service.

Answer

App Service Application Settings with the flag stored as an environment variable

Answer

An ARM template parameter file stored in the application's repository

Answer

An Azure DevOps pipeline variable referenced during the build stage

Question 14

The internal API team is deploying a containerized .NET API that receives sporadic requests — sometimes none for hours, then bursts of activity. Cost is a priority. The team wants the container to stop running when idle and start automatically when a request arrives, with no server management overhead. Which Azure service is the best fit?

Accepted Answer

Azure Container Apps with scale-to-zero enabled on the HTTP ingress. Azure Container Apps with scale-to-zero enabled on the HTTP ingress is the best fit because it allows the container to scale down to zero replicas when idle, automatically stopping the container to save costs, and scales back up to handle incoming HTTP requests with no server management overhead. This serverless platform abstracts Kubernetes infrastructure, meeting the team's requirement for minimal operational burden and cost efficiency.

Answer

Azure Kubernetes Service with the cluster autoscaler set to a minimum node count of zero

Answer

Azure App Service on a B1 (Basic) plan with Always On disabled

Answer

Azure Virtual Machine Scale Sets with scheduled scaling to zero instances overnight

Question 15

Images are uploaded to a high-volume Blob Storage account. An Azure Function with a Blob Storage trigger processes each new image. The team has observed processing delays of up to 10 minutes on accounts with large numbers of containers and blobs. They need processing to start within seconds of upload. What should the developer change?

Accepted Answer

Replace the Blob Storage trigger with an Event Grid trigger and create a Blob Created event subscription that targets the Function's endpoint. Event Grid provides near-real-time event delivery (typically under 1 second) for Blob Created events, eliminating the polling latency inherent in the Blob Storage trigger. The Blob Storage trigger polls Azure Storage logs for new blobs, which can cause delays of up to 10 minutes in high-volume accounts with many containers and blobs. By switching to an Event Grid trigger, the function is invoked directly via HTTP webhook as soon as the blob is created, meeting the requirement for processing to start within seconds.

Answer

Switch to a Timer trigger that runs every 30 seconds and lists newly created blobs via the SDK

Answer

Use a Queue Storage trigger and write blob metadata to the queue from the upload client

Answer

Move the Function to a Premium plan, which uses a dedicated worker and eliminates Blob trigger polling delays