AZ-204 Develop Azure compute solutions Practice Test 8 — 15 Questions

Question 1

You are building a serverless application using Azure Functions. The function processes large CSV files uploaded to Azure Blob Storage. Each file can be up to 100 MB. The function must parse the file and insert each row into a SQL database. You need to minimize cold start latency and ensure the function can handle the processing within the default timeout. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a dedicated App Service plan with Always On enabled.. A Dedicated App Service plan with Always On enabled eliminates cold starts by keeping the function host loaded continuously, and it provides a default timeout of 30 minutes (configurable up to 230 minutes), which is sufficient for processing 100 MB CSV files. The Consumption plan has a default timeout of 5 minutes (max 10 minutes), which may not be enough for large file processing, and it suffers from cold starts. The Premium plan reduces cold starts with pre-warmed instances but is not necessary when a Dedicated plan with Always On is more cost-effective and meets the requirements.

Answer

Use the Premium plan with pre-warmed instances.

Answer

Use Durable Functions to split processing into smaller chunks.

Answer

Use the Consumption plan and increase the function timeout to 10 minutes.

Question 2

You are deploying a web application to Azure App Service. The application needs to read configuration settings that vary by deployment environment (development, staging, production). You want to minimize application changes and leverage Azure services. What should you use?

Accepted Answer

Use Azure App Service application settings.. Azure App Service application settings are the correct choice because they are natively supported by the App Service platform, allowing you to define key-value pairs that are injected as environment variables at runtime. This approach requires no application code changes, as the settings are automatically available via standard configuration APIs (e.g., `Environment.GetEnvironmentVariable` in .NET or `process.env` in Node.js), and you can configure different values per deployment slot (e.g., development, staging, production) without redeploying the application.

Answer

Use Azure Key Vault secrets for configuration values.

Answer

Use Azure DevOps variable groups and inject them at build time.

Answer

Use Azure App Configuration with feature flags.

Question 3

You are developing a microservices application on Azure Kubernetes Service (AKS). One of the services needs to securely access Azure SQL Database without storing connection strings in the application code. You need to use managed identities. What should you do?

Accepted Answer

Enable Azure AD Pod Identity and assign a managed identity to the pod.. Azure AD Pod Identity allows you to assign an Azure Active Directory (Azure AD) managed identity directly to a pod in AKS. The pod can then use that identity to authenticate to Azure SQL Database without storing any connection strings or secrets in the code. This is the recommended approach for pod-level managed identity access to Azure resources.

Answer

Store the connection string in Azure Key Vault and use the Key Vault FlexVolume driver.

Answer

Use the AKS cluster's managed identity to access Azure SQL.

Answer

Create a service principal and use its credentials in the pod.

Question 4

You are designing a solution that uses Azure Container Instances (ACI) to run a batch job that processes images. The job is triggered by a message in Azure Queue Storage. Each image takes about 5 minutes to process. You need to ensure that the container runs only when there are messages in the queue and scales automatically. What should you use?

Accepted Answer

Use Azure Logic Apps with a Container Instances connector.. Azure Logic Apps provides a serverless workflow that can be triggered by a queue message (via the Azure Queue Storage connector) and then use the Container Instances connector to start a container group. This ensures the container runs only when messages are present and scales automatically by creating a new container instance per message, matching the requirement for event-driven, on-demand execution without idle costs.

Answer

Use Azure Functions with a custom container and queue trigger.

Answer

Use Azure Batch to process the images in a pool of VMs.

Answer

Deploy the image processing job as a pod in Azure Kubernetes Service.

Question 5

You are developing an API using Azure API Management (APIM). The API is backed by an Azure Function that processes requests. You need to implement caching for responses that are expensive to compute. The cache should expire after 10 minutes. What should you configure in APIM?

Accepted Answer

Add a cache-lookup and cache-store policy to the API operation.. Azure API Management (APIM) provides built-in caching policies—`cache-lookup` and `cache-store`—that can be applied directly to an API operation. These policies cache the response from the backend (the Azure Function) and respect the `cache-control` header or a specified duration, such as 10 minutes, without requiring an external cache. This is the simplest and most direct way to implement response caching for expensive-to-compute operations within APIM.

Answer

Configure Azure Redis Cache as an external cache in APIM.

Answer

Implement response caching in the Azure Function code.

Answer

Use Azure Front Door to cache responses.

Question 6

You are developing an application that runs on Azure App Service. The application needs to store session state. The session state must be shared across multiple instances of the app and survive restarts. You need to choose a session state provider. What should you use?

Accepted Answer

Use Azure Redis Cache as a session state provider.. Azure Redis Cache provides a distributed, in-memory data store that can be shared across multiple instances of an App Service application and persists data through restarts. It is the recommended session state provider for Azure App Service when high availability and scalability are required, as it stores session data externally from the application's memory.

Answer

Use Azure Table Storage for session state.

Answer

Use a SQL Database to store session data.

Answer

Use the in-memory session state provider.

Question 7

You are developing a web application that allows users to upload images. The application runs on Azure App Service. You need to ensure that uploaded images are stored in Azure Blob Storage and that the application remains responsive. What should you use?

Accepted Answer

Generate a SAS token for the user to upload directly to Blob Storage.. Generating a SAS token allows the user's browser to upload images directly to Azure Blob Storage without routing the data through the App Service. This keeps the web application responsive by offloading the upload workload to Azure Storage, avoiding blocking the App Service's limited HTTP request threads and reducing latency.

Answer

Upload the image to the App Service and then copy it to Blob Storage.

Answer

Use Azure Files for image storage.

Answer

Make the Blob container public for anonymous uploads.

Question 8

You are developing a solution that uses Azure Functions to process events from Azure Event Grid. The function must handle events reliably. Which TWO options should you implement?

Accepted Answer

Enable retry policy on the Event Grid subscription.. Event Grid subscriptions support automatic retry policies that can be configured to retry event delivery on transient failures, ensuring reliable processing. Option D is correct because a dead-letter destination (e.g., a storage blob) captures events that cannot be delivered after exhausting retries, preventing data loss and enabling later analysis.

Answer

Use Durable Functions for orchestration.

Answer

Implement manual checkpointing in the function code.

Answer

Use a queue trigger instead of an Event Grid trigger.

Question 9

You are developing a web application that will be deployed to Azure App Service. You need to configure automatic scaling based on CPU usage. Which TWO settings should you configure?

Accepted Answer

Configure a scale in condition based on CPU percentage.. Configuring a scale-in condition based on CPU percentage allows the App Service plan to automatically reduce the number of instances when CPU usage drops below a defined threshold, which is essential for cost optimization. Option E is correct because configuring a scale-out condition based on CPU percentage enables the platform to automatically add instances when CPU usage exceeds a threshold, ensuring the application can handle increased load. Together, these two settings define the autoscale rules that react to CPU metrics, which is the core requirement for CPU-based automatic scaling.

Answer

Configure authentication for the scaling endpoint.

Answer

Set the minimum and maximum instance count.

Answer

Set the Always On setting to On.

Question 10

You are deploying an Azure Functions app using ARM template. The exhibit shows a portion of the template. You notice that the AzureWebJobsStorage connection string includes the account key directly. What is the MOST important security concern?

Accepted Answer

The storage account key is exposed in the template, which could be compromised.. Embedding the storage account key directly in an ARM template exposes a long-lived secret in plaintext. If the template is stored in source control, shared, or logged, the key can be compromised, granting an attacker full access to the storage account. This violates the principle of least privilege and security best practices for infrastructure as code.

Answer

The FUNCTIONS_WORKER_RUNTIME is set to dotnet-isolated, which is outdated.

Answer

The storage account name is hardcoded in the connection string.

Answer

The connection string does not use HTTPS.

Question 11

You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?

Accepted Answer

The container image logs environment variables at startup, exposing the secure variable.. The `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.

Answer

The --secure-environment-variables flag is misspelled.

Answer

The --secure-environment-variables flag is not supported for ACI.

Answer

The DB_PASSWORD value contains special characters that were not escaped.

Question 12

You are reviewing an ARM template snippet for an Azure App Service. The exhibit shows the site configuration. You need to ensure that the app supports WebSocket connections for a real-time feature. Which setting must be added?

Accepted Answer

Add 'webSocketsEnabled': true to siteConfig.. The 'webSocketsEnabled' property in the siteConfig of an Azure App Service ARM template explicitly enables WebSocket protocol support. WebSocket connections require a persistent, full-duplex communication channel over a single TCP connection, which is not enabled by default in Azure App Service. Setting this property to true allows the app to handle real-time features like chat or live notifications.

Answer

Set alwaysOn to false.

Answer

Set http20Enabled to false.

Answer

Change ftpsState to AllAllowed.

Question 13

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to securely store configuration settings such as database connection strings and API keys. The solution must minimize administrative overhead and automatically rotate keys. What should they use?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver.. Azure Key Vault with the Secrets Store CSI driver allows you to mount secrets as volumes or environment variables in AKS pods without exposing them in plaintext or requiring manual rotation. The CSI driver synchronizes secrets from Key Vault to a Kubernetes volume, and Key Vault supports automatic key rotation policies, minimizing administrative overhead while ensuring security.

Answer

Store secrets as Kubernetes Secrets objects with base64 encoding.

Answer

Use Azure App Configuration with feature flags.

Answer

Store secrets as environment variables in the container's deployment YAML.

Question 14

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 15

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and DNS name label. The container must restart automatically if it exits unexpectedly. Which configuration should you use?

Accepted Answer

Set restart policy to Always and assign a DNS name label.. Setting the restart policy to Always ensures the container automatically restarts if it exits unexpectedly, which is the required behavior. Assigning a DNS name label to the container group makes it accessible via a public IP address and a fully qualified domain name (FQDN) in the format ..azurecontainer.io, meeting the requirement for a public IP address and DNS name label.

Answer

Deploy the container into an Azure Virtual Network.

Answer

Set restart policy to Never and configure a public IP.

Answer

Set restart policy to OnFailure and use a private IP address.