AZ-204 Develop Azure compute solutions Practice Test 7 — 15 Questions

Question 1

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to securely store configuration settings such as database connection strings and API keys. The solution must minimize administrative overhead and automatically rotate keys. What should they use?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver.. Option B is correct because Azure Key Vault with the Secrets Store CSI driver allows you to mount secrets as volumes or environment variables in AKS pods without exposing them in plaintext or requiring manual rotation. The CSI driver synchronizes secrets from Key Vault to a Kubernetes volume, and Key Vault supports automatic key rotation policies, minimizing administrative overhead while ensuring security.

Answer

Store secrets as Kubernetes Secrets objects with base64 encoding.

Answer

Use Azure App Configuration with feature flags.

Answer

Store secrets as environment variables in the container's deployment YAML.

Question 2

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Option D is correct because implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 3

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and DNS name label. The container must restart automatically if it exits unexpectedly. Which configuration should you use?

Accepted Answer

Set restart policy to Always and assign a DNS name label.. Option D is correct because setting the restart policy to Always ensures the container automatically restarts if it exits unexpectedly, which is the required behavior. Assigning a DNS name label to the container group makes it accessible via a public IP address and a fully qualified domain name (FQDN) in the format ..azurecontainer.io, meeting the requirement for a public IP address and DNS name label.

Answer

Deploy the container into an Azure Virtual Network.

Answer

Set restart policy to Never and configure a public IP.

Answer

Set restart policy to OnFailure and use a private IP address.

Question 4

You are developing an Azure Logic App that processes files from an FTP server. The workflow must run every 10 minutes and process only new files. You need to ensure that files are not processed more than once. What should you use?

Accepted Answer

Use the FTP trigger 'When a file is added or modified' with a recurrence of 10 minutes.. Option C is correct because the 'When a file is added or modified' FTP trigger in Azure Logic Apps automatically tracks processed files using a built-in 'trigger state' mechanism. When combined with a recurrence schedule (e.g., every 10 minutes), it ensures that only new or modified files since the last run are processed, preventing duplicate processing without external state management.

Answer

Use the FTP trigger 'When a file is added' with a recurrence of 10 minutes.

Answer

Use the 'When a file is added' trigger and store processed file names in a SQL database.

Answer

Use the Sliding Window trigger and set the window size to 10 minutes.

Question 5

A company runs an ASP.NET Core web app on Azure App Service. They need to implement health checks that monitor the app's dependencies, such as a database and an external API. The health endpoint should return a 200 status if all dependencies are healthy, a 503 if any dependency is unhealthy, and a 400 if the request is malformed. Which approach should you take?

Accepted Answer

Implement custom health checks using the ASP.NET Core Health Checks middleware.. Option A is correct because the ASP.NET Core Health Checks middleware allows you to implement custom health checks that monitor specific dependencies like a database and an external API. You can configure the middleware to return a 200 OK status when all checks pass, a 503 Service Unavailable when any check fails, and a 400 Bad Request for malformed requests by using the appropriate response writer and status code mapping.

Answer

Use the ASP.NET Core Diagnostics middleware to generate a health page.

Answer

Configure Application Insights availability tests.

Answer

Use the built-in health check endpoint in Azure App Service.

Question 6

You are developing an Azure Functions app that uses Durable Functions to orchestrate a long-running workflow. The workflow involves calling multiple external APIs. You need to ensure that the orchestration can survive a function app restart. Which feature should you use?

Accepted Answer

Use the default checkpointing and replay mechanism.. Option A is correct because Durable Functions inherently use a checkpointing and replay mechanism to persist the orchestration state to a storage backend (Azure Storage queues, tables, and blobs). This ensures that after a function app restart, the orchestrator function can replay from the last checkpoint, restoring the exact execution context and continuing the workflow without data loss.

Answer

Log orchestration state to Application Insights.

Answer

Implement retry policies on the activity functions.

Answer

Set a high timeout on the orchestration.

Question 7

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Option D is correct because managed identity (system-assigned or user-assigned) allows ACI to authenticate to ACR without storing credentials, by granting the identity 'AcrPull' role. Option A is wrong because admin account requires username/password in the configuration. Option B is wrong because SAS tokens are not supported for ACR authentication in ACI. Option C is wrong because service principal requires storing credentials in the container group.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.

Question 8

You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?

Accepted Answer

Use the Microsoft.Identity.Web library to validate the token.. Option C is correct because Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.

Answer

Configure the Azure Functions host to use Microsoft Entra ID authentication.

Answer

Use the Microsoft Authentication Library (MSAL) to validate the token.

Answer

Use Azure AD B2C to validate the token.

Question 9

You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?

Accepted Answer

Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.. Option C is correct because Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.

Answer

Configure Azure Front Door to terminate SSL and forward traffic to App Service.

Answer

Use an App Service Managed Certificate for the custom domain.

Answer

Export the certificate from Key Vault as a PFX file and upload it to App Service.

Question 10

Which TWO actions should you perform to configure autoscaling for an Azure App Service web app based on CPU usage?

Accepted Answer

Configure the minimum and maximum instance limits.. Option A is correct because autoscaling in Azure App Service requires you to define the minimum and maximum instance limits to control the scaling range. These limits ensure the web app scales out or in within a safe boundary, preventing runaway costs or performance degradation. Without setting these limits, the autoscale engine cannot determine the operational range for scaling actions.

Answer

Enable manual scaling and set the instance count to 3.

Answer

Set the default instance count to 1.

Answer

Create a scale rule based on a specific date and time.

Question 11

Which THREE features does Azure Container Instances (ACI) provide?

Accepted Answer

Assign a public IP address and DNS name label.. Option B is correct because Azure Container Instances allows you to assign a public IP address and a DNS name label to a container group, enabling direct internet access to the container. This is configured at the container group level, and the DNS name label must be unique within the Azure region.

Answer

Integrate with Azure Virtual Network by default.

Answer

Run containers as nested containers (Docker-in-Docker).

Question 12

Which TWO options are valid ways to scale an Azure Functions app running on the Premium plan?

Accepted Answer

Configure pre-warmed instances to reduce cold start.. Option B is correct because pre-warmed instances in the Premium plan reduce cold start latency by keeping a specified number of instances always loaded and ready to handle requests. Option C is correct because the Premium plan allows you to set both minimum and maximum instance counts, giving you control over baseline capacity and scaling limits. These settings are configured in the function app's scale settings and are not available in the Consumption plan.

Answer

Disable scale-to-zero to keep instances always warm.

Answer

Scale out based on the length of a storage queue.

Answer

Set the scale mode to 'Automatic' with no configuration.

Question 13

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

Accepted Answer

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.. Option A is correct because the ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer

Configures the App Service to require authentication for cross-origin requests.

Answer

Enables CORS for all origins by setting allowedOrigins to a wildcard.

Answer

Blocks all cross-origin requests because supportCredentials is false.

Question 14

You are reviewing the ARM template for an App Service. What is the effect of the 'alwaysOn' property set to true?

Accepted Answer

The app will stay loaded in memory to avoid cold starts.. Setting 'alwaysOn' to true in an Azure App Service ARM template ensures that the app is kept loaded in memory even when there is no incoming traffic. This prevents the app from being unloaded after a period of inactivity, which eliminates cold starts on subsequent requests. Cold starts occur when the app process is recycled or unloaded, causing a delay as the runtime and application code are reloaded.

Answer

The app will enable health checks at /health.

Answer

The app will scale out to multiple instances automatically.

Answer

The app will be redeployed whenever the code changes.

Question 15

You find the above ARM template for an App Service. What is a security concern with this configuration?

Accepted Answer

The password is passed as a parameter and may be exposed in deployment logs.. Option A is correct because the connection string includes the password as a parameter, which may be stored in plain text in the ARM template parameters file or deployment history. Option B is wrong because the connection string uses SQLAzure type, which is correct. Option C is wrong because the connection string is encrypted at rest in App Service, but the issue is at deployment time. Option D is wrong because the connection string is stored in App Service configuration, not in source code, but the ARM template exposes the password.

Answer

The connection string is stored in the source code.

Answer

The connection string type should be 'Custom' instead of 'SQLAzure'.

Answer

The connection string is not encrypted at rest.