AZ-204 Develop Azure compute solutions Practice Test 9 — 15 Questions

Question 1

You are developing an Azure Logic App that processes files from an FTP server. The workflow must run every 10 minutes and process only new files. You need to ensure that files are not processed more than once. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the FTP trigger 'When a file is added' with a recurrence of 10 minutes.. The 'When a file is added' FTP trigger in Azure Logic Apps automatically tracks processed files using a built-in 'trigger state' mechanism. When combined with a recurrence schedule (e.g., every 10 minutes), it ensures that only new files since the last run are processed, preventing duplicate processing without external state management.

Answer

Use the 'When a file is added' trigger and store processed file names in a SQL database.

Answer

Use the FTP trigger 'When a file is added or modified' with a recurrence of 10 minutes.

Answer

Use the Sliding Window trigger and set the window size to 10 minutes.

Question 2

A company runs an ASP.NET Core web app on Azure App Service. They need to implement health checks that monitor the app's dependencies, such as a database and an external API. The health endpoint should return a 200 status if all dependencies are healthy, a 503 if any dependency is unhealthy, and a 400 if the request is malformed. Which approach should you take?

Accepted Answer

Implement custom health checks using the ASP.NET Core Health Checks middleware.. The ASP.NET Core Health Checks middleware allows you to implement custom health checks that monitor specific dependencies like a database and an external API. You can configure the middleware to return a 200 OK status when all checks pass, a 503 Service Unavailable when any check fails, and a 400 Bad Request for malformed requests by using the appropriate response writer and status code mapping.

Answer

Use the ASP.NET Core Diagnostics middleware to generate a health page.

Answer

Configure Application Insights availability tests.

Answer

Use the built-in health check endpoint in Azure App Service.

Question 3

You are developing an Azure Functions app that uses Durable Functions to orchestrate a long-running workflow. The workflow involves calling multiple external APIs. You need to ensure that the orchestration can survive a function app restart. Which feature should you use?

Accepted Answer

Use the default checkpointing and replay mechanism.. Durable Functions inherently use a checkpointing and replay mechanism to persist the orchestration state to a storage backend (Azure Storage queues, tables, and blobs). This ensures that after a function app restart, the orchestrator function can replay from the last checkpoint, restoring the exact execution context and continuing the workflow without data loss.

Answer

Log orchestration state to Application Insights.

Answer

Implement retry policies on the activity functions.

Answer

Set a high timeout on the orchestration.

Question 4

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Enabling a managed identity for the container group and assigning the AcrPull role allows Azure Container Instances to authenticate to Azure Container Registry using Azure AD without storing any credentials in the container group definition. The managed identity is automatically authenticated by Azure, and ACR supports token exchange via Azure AD, so ACI can pull the image securely without embedding secrets.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.

Question 5

You are building a serverless API using Azure Functions with an HTTP trigger. The API must authenticate requests using Microsoft Entra ID (formerly Azure AD). You need to validate the token in the function code. Which component should you use?

Accepted Answer

Use the Microsoft.Identity.Web library to validate the token.. Microsoft.Identity.Web is the recommended library for integrating Azure Functions with Microsoft Entra ID. It provides built-in token validation, including signature verification, issuer validation, and audience checking, by leveraging the same middleware used in ASP.NET Core. This library simplifies the process of validating JWT tokens issued by Microsoft Entra ID without requiring manual token parsing or validation logic.

Answer

Configure the Azure Functions host to use Microsoft Entra ID authentication.

Answer

Use the Microsoft Authentication Library (MSAL) to validate the token.

Answer

Use Azure AD B2C to validate the token.

Question 6

You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?

Accepted Answer

Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.. Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.

Answer

Configure Azure Front Door to terminate SSL and forward traffic to App Service.

Answer

Use an App Service Managed Certificate for the custom domain.

Answer

Export the certificate from Key Vault as a PFX file and upload it to App Service.

Question 7

Which TWO options are valid ways to scale an Azure Functions app running on the Premium plan?

Accepted Answer

Configure pre-warmed instances to reduce cold start.. Pre-warmed instances in the Premium plan reduce cold start latency by keeping a specified number of instances always loaded and ready to handle requests. Option C is correct because the Premium plan allows you to set both minimum and maximum instance counts, giving you control over baseline capacity and scaling limits. These settings are configured in the function app's scale settings and are not available in the Consumption plan.

Answer

Disable scale-to-zero to keep instances always warm.

Answer

Scale out based on the length of a storage queue.

Answer

Set the scale mode to 'Automatic' with no configuration.

Question 8

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

Accepted Answer

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.. The ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer

Configures the App Service to require authentication for cross-origin requests.

Answer

Enables CORS for all origins by setting allowedOrigins to a wildcard.

Answer

Blocks all cross-origin requests because supportCredentials is false.

Question 9

You are reviewing the ARM template for an App Service. What is the effect of the 'alwaysOn' property set to true?

Accepted Answer

The app will stay loaded in memory to avoid cold starts.. Setting 'alwaysOn' to true in an Azure App Service ARM template ensures that the app is kept loaded in memory even when there is no incoming traffic. This prevents the app from being unloaded after a period of inactivity, which eliminates cold starts on subsequent requests. Cold starts occur when the app process is recycled or unloaded, causing a delay as the runtime and application code are reloaded.

Answer

The app will enable health checks at /health.

Answer

The app will scale out to multiple instances automatically.

Answer

The app will be redeployed whenever the code changes.

Question 10

You find the above ARM template for an App Service. What is a security concern with this configuration?

Accepted Answer

The password is passed as a parameter and may be exposed in deployment logs.. When a password is passed as an ARM template parameter, its value can be captured in deployment logs (e.g., Azure Activity Logs or PowerShell verbose output) if the parameter is not marked as 'secureString'. This exposes sensitive credentials to anyone with log access, violating security best practices. In contrast, using a secureString parameter encrypts the value and masks it in logs.

Answer

The connection string is stored in the source code.

Answer

The connection string type should be 'Custom' instead of 'SQLAzure'.

Answer

The connection string is not encrypted at rest.

Question 11

You are deploying a containerized application to Azure Container Instances. The application requires writing temporary files to a local filesystem. You need to ensure that the files persist if the container restarts. What should you do?

Accepted Answer

Mount an Azure Files share as a volume in the container group.. Azure Container Instances (ACI) supports mounting Azure Files shares as volumes. When a container restarts, its writable layer is ephemeral and lost, but an Azure Files share persists independently. By mounting the share, temporary files written to the mount point survive container restarts, meeting the persistence requirement.

Answer

Use the container's writable layer to store files.

Answer

Use Azure Blob Storage and mount it as a volume.

Answer

Configure a Docker volume in the container image.

Question 12

Your Azure Functions app uses a consumption plan and processes messages from an Azure Service Bus queue. You notice that message processing takes up to 10 minutes, and some messages are being processed multiple times. What is the most likely cause?

Accepted Answer

The lock duration on the Service Bus queue is shorter than the processing time.. The default lock duration for a Service Bus queue is 30 seconds, which is far shorter than the 10-minute processing time. When the lock expires, the message becomes visible to other consumers, causing duplicate processing. While Azure Functions attempts to automatically renew the message lock during processing, this auto-renewal has a maximum duration (default 5 minutes). Since the processing time (10 minutes) exceeds this duration, the lock will eventually expire, leading to the message becoming available for re-delivery.

Answer

The max delivery count for the queue is set too low.

Answer

The function host is configured with a low maximum instance count.

Answer

The function does not handle poison messages correctly.

Question 13

Which TWO actions should you take to enable a user-assigned managed identity for an Azure App Service web app?

Accepted Answer

Create the managed identity resource in Microsoft Entra ID.. A user-assigned managed identity is a standalone Azure resource created in Microsoft Entra ID (formerly Azure AD). It must exist as an identity resource before it can be assigned to any Azure service, including an App Service web app. This identity is then tied to a specific tenant and can be used by multiple Azure resources.

Answer

Configure the identity in each deployment slot separately.

Answer

Store the identity's client ID in an app setting.

Answer

Create the managed identity in the same resource group as the web app.

Question 14

You are developing an Azure Function that runs on a Consumption plan. The function needs to process a large file uploaded to Azure Blob Storage. The processing is CPU-intensive and may take up to 30 minutes. What should you use to implement the function?

Accepted Answer

Configure the function app to use a Premium plan to allow longer execution times.. Azure Functions on a Consumption plan have a maximum execution timeout of 10 minutes (or 5 minutes by default). For CPU-intensive processing that may take up to 30 minutes, you must use a Premium plan, which supports unlimited execution duration (subject to the functionTimeout setting, which can be set up to 60 minutes by default and up to unlimited if configured). The Premium plan also provides dedicated instances and pre-warmed workers, which are suitable for long-running, resource-intensive workloads.

Answer

Use a blob trigger and set the batchSize to 1 to avoid timeouts.

Answer

Set the functionTimeout in host.json to 30 minutes on the Consumption plan.

Answer

Create an orchestrator function using Durable Functions to manage the processing.

Question 15

You deploy the above ARM template. Later, you update the web app's code by deploying a new ZIP package to Azure Blob Storage and updating the WEBSITE_RUN_FROM_PACKAGE setting with the new package URL. However, the web app continues to run the old code. What is the most likely cause?

Accepted Answer

The value '1' indicates the package is from local storage, not an external URL.. When the WEBSITE_RUN_FROM_PACKAGE app setting is set to '1', it tells Azure App Service to use a local package stored in the site's wwwroot folder. To use an external package from Azure Blob Storage, the setting must be set to the full URL of the blob (with a SAS token if private). Keeping the value as '1' means the service ignores the new blob URL and continues to run the old local package.

Answer

The app setting name is misspelled. It should be 'WEBSITE_RUN_FROM_ZIP'.

Answer

The setting requires a value of '0' to enable external packages.

Answer

The ARM template uses an incorrect apiVersion.