AZ-204 Develop Azure compute solutions Practice Test 9 — 15 Questions

Question 1

You are deploying an Azure Functions app using ARM template. The exhibit shows a portion of the template. You notice that the AzureWebJobsStorage connection string includes the account key directly. What is the MOST important security concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage account key is exposed in the template, which could be compromised.. Embedding the storage account key directly in an ARM template exposes a long-lived secret in plaintext. If the template is stored in source control, shared, or logged, the key can be compromised, granting an attacker full access to the storage account. This violates the principle of least privilege and security best practices for infrastructure as code.

Answer

The FUNCTIONS_WORKER_RUNTIME is set to dotnet-isolated, which is outdated.

Answer

The storage account name is hardcoded in the connection string.

Answer

The connection string does not use HTTPS.

Question 2

You are creating an Azure Container Instance using the Azure CLI command shown in the exhibit. The container needs to connect to a SQL database. After running the command, you notice that the DB_PASSWORD environment variable is visible in the container's logs. What is the most likely reason?

Accepted Answer

The container image logs environment variables at startup, exposing the secure variable.. The `--secure-environment-variables` flag in Azure CLI for Azure Container Instances does not prevent the values from being logged by the container itself. The flag only masks the values in the Azure portal and CLI output, but if the container image explicitly logs environment variables at startup (e.g., via a startup script or application code), the secure variable will be exposed in the container logs. The issue is not with Azure's handling but with the container image's behavior.

Answer

The --secure-environment-variables flag is misspelled.

Answer

The --secure-environment-variables flag is not supported for ACI.

Answer

The DB_PASSWORD value contains special characters that were not escaped.

Question 3

You are reviewing an ARM template snippet for an Azure App Service. The exhibit shows the site configuration. You need to ensure that the app supports WebSocket connections for a real-time feature. Which setting must be added?

Accepted Answer

Add 'webSocketsEnabled': true to siteConfig.. The 'webSocketsEnabled' property in the siteConfig of an Azure App Service ARM template explicitly enables WebSocket protocol support. WebSocket connections require a persistent, full-duplex communication channel over a single TCP connection, which is not enabled by default in Azure App Service. Setting this property to true allows the app to handle real-time features like chat or live notifications.

Answer

Set alwaysOn to false.

Answer

Set http20Enabled to false.

Answer

Change ftpsState to AllAllowed.

Question 4

A company deploys a microservices application on Azure Kubernetes Service (AKS). They need to securely store configuration settings such as database connection strings and API keys. The solution must minimize administrative overhead and automatically rotate keys. What should they use?

Accepted Answer

Use Azure Key Vault with the Secrets Store CSI driver.. Azure Key Vault with the Secrets Store CSI driver allows you to mount secrets as volumes or environment variables in AKS pods without exposing them in plaintext or requiring manual rotation. The CSI driver synchronizes secrets from Key Vault to a Kubernetes volume, and Key Vault supports automatic key rotation policies, minimizing administrative overhead while ensuring security.

Answer

Store secrets as Kubernetes Secrets objects with base64 encoding.

Answer

Use Azure App Configuration with feature flags.

Answer

Store secrets as environment variables in the container's deployment YAML.

Question 5

You are developing an Azure Functions app that processes orders. Each order triggers a function that writes to Azure Cosmos DB. You notice occasional throttling (429 errors) from Cosmos DB during peak hours. The function app uses the Consumption plan. What is the most cost-effective way to reduce throttling?

Accepted Answer

Implement retry logic with exponential backoff in the function code.. Implementing retry logic with exponential backoff is the most cost-effective way to handle transient 429 errors from Cosmos DB. The Azure Cosmos DB SDK already includes built-in retry policies, but custom retry logic in the function code can be tuned to match the workload, allowing the function to wait and retry during peak throttling without incurring additional costs from scaling or increasing throughput.

Answer

Increase the provisioned throughput (RU/s) of the Cosmos DB container.

Answer

Upgrade the function app to the Premium plan for dedicated instances.

Answer

Increase the function app's instance count by scaling out.

Question 6

You need to deploy a containerized application to Azure Container Instances (ACI) with a public IP address and DNS name label. The container must restart automatically if it exits unexpectedly. Which configuration should you use?

Accepted Answer

Set restart policy to Always and assign a DNS name label.. Setting the restart policy to Always ensures the container automatically restarts if it exits unexpectedly, which is the required behavior. Assigning a DNS name label to the container group makes it accessible via a public IP address and a fully qualified domain name (FQDN) in the format ..azurecontainer.io, meeting the requirement for a public IP address and DNS name label.

Answer

Deploy the container into an Azure Virtual Network.

Answer

Set restart policy to Never and configure a public IP.

Answer

Set restart policy to OnFailure and use a private IP address.

Question 7

A company runs an ASP.NET Core web app on Azure App Service. They need to implement health checks that monitor the app's dependencies, such as a database and an external API. The health endpoint should return a 200 status if all dependencies are healthy, a 503 if any dependency is unhealthy, and a 400 if the request is malformed. Which approach should you take?

Accepted Answer

Implement custom health checks using the ASP.NET Core Health Checks middleware.. The ASP.NET Core Health Checks middleware allows you to implement custom health checks that monitor specific dependencies like a database and an external API. You can configure the middleware to return a 200 OK status when all checks pass, a 503 Service Unavailable when any check fails, and a 400 Bad Request for malformed requests by using the appropriate response writer and status code mapping.

Answer

Use the ASP.NET Core Diagnostics middleware to generate a health page.

Answer

Configure Application Insights availability tests.

Answer

Use the built-in health check endpoint in Azure App Service.

Question 8

You are developing an Azure Functions app that uses Durable Functions to orchestrate a long-running workflow. The workflow involves calling multiple external APIs. You need to ensure that the orchestration can survive a function app restart. Which feature should you use?

Accepted Answer

Use the default checkpointing and replay mechanism.. Durable Functions inherently use a checkpointing and replay mechanism to persist the orchestration state to a storage backend (Azure Storage queues, tables, and blobs). This ensures that after a function app restart, the orchestrator function can replay from the last checkpoint, restoring the exact execution context and continuing the workflow without data loss.

Answer

Log orchestration state to Application Insights.

Answer

Implement retry policies on the activity functions.

Answer

Set a high timeout on the orchestration.

Question 9

You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?

Accepted Answer

Enable managed identity for the container group and assign the AcrPull role.. Enabling a managed identity for the container group and assigning the AcrPull role allows Azure Container Instances to authenticate to Azure Container Registry using Microsoft Entra ID without storing any credentials in the container group definition. The managed identity is automatically authenticated by Azure, and ACR supports token exchange via Microsoft Entra ID, so ACI can pull the image securely without embedding secrets.

Answer

Generate a SAS token for the ACR and use it in the image registry credential.

Answer

Create a service principal with AcrPull role and pass its credentials.

Answer

Use the ACR admin account and provide the credentials in the container group.

Question 10

You need to deploy an Azure App Service web app that uses a custom domain (www.contoso.com) and SSL/TLS certificate. The certificate is stored in Azure Key Vault. What should you use to bind the certificate to the App Service?

Accepted Answer

Import the certificate from Key Vault into App Service using the 'Key Vault Certificate' option.. Azure App Service supports direct integration with Azure Key Vault to import a certificate using the 'Key Vault Certificate' option. This allows you to bind an SSL/TLS certificate stored in Key Vault to your custom domain without manually exporting or managing the PFX file, ensuring secure and seamless certificate lifecycle management.

Answer

Configure Azure Front Door to terminate SSL and forward traffic to App Service.

Answer

Use an App Service Managed Certificate for the custom domain.

Answer

Export the certificate from Key Vault as a PFX file and upload it to App Service.

Question 11

Which TWO actions should you perform to configure autoscaling for an Azure App Service web app based on CPU usage?

Accepted Answer

Configure the minimum and maximum instance limits.. Option A is correct because autoscaling requires you to set the minimum and maximum instance limits, which define the boundary of the instance count that the autoscale engine can scale between. Option E is correct because the scenario specifically requires scaling based on CPU usage, so you must define a scale rule with a metric trigger that fires when CPU percentage exceeds a chosen threshold. Option B is incorrect because manual scaling fixes the instance count and does not provide automatic, metric-driven scaling. Option C is incorrect because setting a default instance count does not by itself create an autoscale policy or CPU-based rule. Option D is incorrect because a date/time-based rule is a schedule-based trigger, not a CPU-usage-based trigger.

Answer

Enable manual scaling and set the instance count to 3.

Answer

Set the default instance count to 1.

Answer

Create a scale rule based on a specific date and time.

Question 12

Which THREE features does Azure Container Instances (ACI) provide?

Accepted Answer

Assign a public IP address and DNS name label.. Option B is correct because ACI containers can be exposed directly to the internet by assigning a public IP address and an optional DNS name label (FQDN) via the --dns-name-label parameter, enabling external access without a load balancer. Option C is correct because ACI supports mounting Azure Files shares as volumes using the azureFile volume type, allowing persistent storage to be attached to container groups. Option D is correct because ACI lets you configure restart policies (Always, OnFailure, or Never) to control whether containers in a container group are restarted when they terminate. Option A is incorrect because ACI containers are not integrated with an Azure Virtual Network by default; VNet integration requires explicit configuration via network profiles and is only supported for Linux container groups. Option E is incorrect because ACI does not support running nested containers (Docker-in-Docker), as it does not provide the privileged mode or Docker daemon access required for that scenario.

Answer

Integrate with Azure Virtual Network by default.

Answer

Run containers as nested containers (Docker-in-Docker).

Question 13

Which TWO options are valid ways to scale an Azure Functions app running on the Premium plan?

Accepted Answer

Configure pre-warmed instances to reduce cold start.. Pre-warmed instances in the Premium plan reduce cold start latency by keeping a specified number of instances always loaded and ready to handle requests. Option C is correct because the Premium plan allows you to set both minimum and maximum instance counts, giving you control over baseline capacity and scaling limits. These settings are configured in the function app's scale settings and are not available in the Consumption plan.

Answer

Disable scale-to-zero to keep instances always warm.

Answer

Scale out based on the length of a storage queue.

Answer

Set the scale mode to 'Automatic' with no configuration.

Question 14

You find the above ARM template snippet in a deployment. What is the effect of this configuration on the App Service?

Accepted Answer

Allows cross-origin requests from app.contoso.com and portal.contoso.com without credentials.. The ARM template snippet sets `allowedOrigins` to specific domains (`app.contoso.com` and `portal.contoso.com`) and `supportCredentials` to `false`. This configuration allows cross-origin requests from those two origins but does not include credentials (cookies, HTTP authentication, or client-side certificates) in the requests, as per the CORS specification.

Answer

Configures the App Service to require authentication for cross-origin requests.

Answer

Enables CORS for all origins by setting allowedOrigins to a wildcard.

Answer

Blocks all cross-origin requests because supportCredentials is false.

Question 15

You are reviewing the ARM template for an App Service. What is the effect of the 'alwaysOn' property set to true?

Accepted Answer

The app will stay loaded in memory to avoid cold starts.. Setting 'alwaysOn' to true in an Azure App Service ARM template ensures that the app is kept loaded in memory even when there is no incoming traffic. This prevents the app from being unloaded after a period of inactivity, which eliminates cold starts on subsequent requests. Cold starts occur when the app process is recycled or unloaded, causing a delay as the runtime and application code are reloaded.

Answer

The app will enable health checks at /health.

Answer

The app will scale out to multiple instances automatically.

Answer

The app will be redeployed whenever the code changes.