AZ-204 Develop for Azure storage — 20 Questions

Question 1

You design an application that writes millions of small sensor readings (each ~100 bytes) to Azure Blob Storage. The data is appended to files every minute and after 7 days it is archived for compliance. You need to minimize write costs and storage costs. Which blob type and tier strategy should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Append blobs with Hot tier and a lifecycle rule to move to Archive after 7 days.. Append blobs are optimized for append operations, making them ideal for continuously adding small sensor readings without rewriting existing data, which minimizes write costs. Moving the blobs to the Archive tier after 7 days via a lifecycle rule reduces storage costs for compliance data, as Archive is the lowest-cost tier for infrequently accessed data.

Answer

Block blobs with Hot tier and a lifecycle rule to move to Cool after 7 days.

Answer

Page blobs with Premium tier.

Answer

Append blobs with Cool tier and no lifecycle rule.

Question 2

You need to store large files that are written once and then frequently read for the first 30 days. After 30 days, the files are rarely accessed (once or twice per year) but must remain available for 5 years. You want to minimize storage costs. Which storage tier and lifecycle management rule should you apply?

Accepted Answer

Hot tier with a lifecycle rule to move to Cool after 30 days. The Hot tier is optimized for frequent reads, and the lifecycle rule moves data to the Cool tier after 30 days when access drops, balancing performance and cost. After 30 days, the files are rarely accessed, so moving them to Cool (not Archive) keeps them available for occasional reads without the high retrieval costs and latency of Archive. This minimizes storage costs while meeting the 5-year retention requirement.

Answer

Cool tier with a lifecycle rule to move to Archive after 30 days

Answer

Hot tier with a lifecycle rule to move to Archive after 30 days

Answer

Archive tier with a lifecycle rule to move to Cool after 30 days

Question 3

You need to store billions of small log entries (each ~200 bytes) generated from multiple IoT devices. The logs are written in chronological order and are rarely updated. You need to run queries that scan large ranges of data by timestamp each day. You want to maximize write throughput and minimize storage costs. Which Azure Storage solution should you choose?

Accepted Answer

Azure Table Storage with a partition key combining device ID and date, and row key as timestamp.. Azure Table Storage is ideal for this scenario because it supports high-volume, low-cost storage of structured log data with efficient range queries. By using a partition key of device ID combined with date, you distribute writes across partitions for high throughput, while the row key as timestamp enables fast, server-side range scans over chronological data without the overhead of a separate index.

Answer

Azure Cosmos DB SQL API with a collection partitioned by timestamp.

Answer

Azure Blob Storage with append blobs and a custom index for timestamp queries.

Answer

Azure SQL Database with a clustered columnstore index.

Question 4

You are developing an IoT solution that stores device metadata (device ID, location, firmware version, last seen timestamp) in Azure Table Storage. Each device has a unique DeviceId and a Timestamp. You need to design the PartitionKey and RowKey to optimize query performance for the following query: Retrieve all firmware versions for devices in a specific city that were last seen within the last 24 hours. The query must be efficient (partition scan minimized). Which key design is most appropriate?

Accepted Answer

PartitionKey = City, RowKey = Inverted timestamp (e.g., DateTime.MaxValue.Ticks - Timestamp.Ticks). City as the PartitionKey groups all devices for a city in one partition. Use a zero-padded, fixed-length inverted timestamp such as (DateTime.MaxValue.Ticks - Timestamp.Ticks).ToString("D19") as the RowKey; this makes more recent timestamps sort as smaller RowKey values. To retrieve the last 24 hours efficiently, query the city partition for RowKey values between the inverted current timestamp (lower bound) and the inverted timestamp 24 hours ago (upper bound) — i.e., RowKey >= inverted(now) and RowKey <= inverted(now - 24h). Azure Table Storage can then perform a partitioned range scan instead of scanning all devices in the city.

Answer

PartitionKey = City, RowKey = DeviceId_Timestamp (e.g., "device123_2023-10-01T12:00:00")

Answer

PartitionKey = DeviceId, RowKey = Timestamp

Answer

PartitionKey = City, RowKey = DeviceId

Question 5

You need to store small binary blobs (average 50 KB) that are accessed very frequently for a short period, then never accessed again. The total volume is high. Which storage tier is most cost-effective for the initial upload?

Accepted Answer

Hot. The Hot tier is the most cost-effective for the initial upload because it is optimized for frequent access and low latency, and for small blobs (average 50 KB) that are accessed very frequently for a short period, the per-GB storage cost is higher than Cool or Cold, but the access cost (per-operation charges) is significantly lower. Since the blobs are never accessed again after the short period, the high access frequency during that period makes Hot the cheapest option when considering total cost (storage + access operations), as Cool/Cold tiers would incur much higher per-read operation costs that outweigh their lower storage costs.

Answer

Cool

Answer

Cold

Answer

Archive

Question 6

Match each Azure Storage access tier to its description.

Accepted Answer

Hot: Optimized for data that is accessed frequently, highest storage cost, lowest access cost.. Azure Blob Storage access tiers include Hot, Cool, Cold, and Archive. Hot is optimized for frequently accessed data and has the highest storage cost but the lowest access cost (Option A). Cool is optimized for infrequently accessed data stored for at least 30 days (Option C). Cold is optimized for infrequently accessed data stored for at least 90 days (Option E). Archive is optimized for rarely accessed data stored for at least 180 days (Option F). Therefore the correct options are A, C, E, and F.

Answer

Hot: Optimized for data that is infrequently accessed and stored for at least 30 days.

Answer

Cool: Optimized for rarely accessed data stored for at least 180 days.

Question 7

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.. Both options A and C are valid methods to ensure the Azure Function only processes image files. Option A uses an Event Grid trigger with filtering on the 'content-type' property, which allows the function to only run for blobs with image content types. Option C checks the content type inside the function and ignores non-image blobs, which also works but runs the function for all blobs. Option B is incorrect because blob triggers do not have a 'filter' property for extensions. Option D is incorrect because the blob trigger's path pattern does not filter by extension; the function triggers for any blob in the container regardless of the file extension.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.

Question 8

You are creating an Azure function that uses an output binding to write messages to an Azure Storage Queue. The function must ensure that messages are not lost if the function fails after writing to the queue. Which approach should you use?

Accepted Answer

Use the queue output binding with a queue trigger input binding in the same function.. Using a queue output binding together with a queue trigger input binding leverages the Azure Functions runtime's transactional behavior. When a function has a queue trigger, the incoming message is kept in the queue until the function completes successfully. If the function fails after writing to the output queue (e.g., a crash or exception), the output binding write is rolled back (not committed), and the input message is not deleted from the source queue. This ensures no message is lost: the output message is never written if the function fails, and the input message remains for retry. Without the queue trigger, if the function were triggered by another source (e.g., HTTP), a failure after the output write could still result in the output message being committed (since the function completes), but the context of the operation might be lost. The queue trigger input binding provides the necessary atomicity for this specific scenario.

Answer

Use a separate queue client SDK to write messages and handle errors manually.

Answer

Write to the queue directly in the function code and rely on the function's retry policy.

Answer

Use a durable function to orchestrate the writing and processing.

Question 9

Which THREE of the following are valid methods for authenticating to Azure Blob Storage?

Accepted Answer

Shared access signature (SAS) token. Option B (Shared access signature (SAS) token) is correct because a SAS is a URI-embedded, delegated credential that grants scoped, time-limited access to Blob Storage resources without exposing the account key. Option C (Shared Key (storage account key)) is correct because Blob Storage natively supports Shared Key authorization, where requests are signed with the storage account access key using HMAC-SHA256. Option D (Microsoft Entra ID authentication (RBAC)) is correct because Azure Blob Storage supports Microsoft Entra ID (Microsoft Entra ID) authentication with OAuth 2.0 bearer tokens, and access is then governed by Azure RBAC roles such as Storage Blob Data Reader/Contributor. Option A (Connection string with account key) is not a distinct authentication method here because a connection string merely packages the account name and key (or SAS) and ultimately resolves to Shared Key or SAS authentication, so it is not counted as a separate valid method. Option E (Client certificate authentication) does not belong because Blob Storage does not support client certificate authentication for data-plane access; certificate-based credentials are used for service principals in Microsoft Entra ID, not directly against the Blob endpoint.

Answer

Connection string with account key

Answer

Client certificate authentication

Question 10

Which TWO of the following are correct about Azure Cosmos DB consistency levels?

Accepted Answer

Strong consistency is available in all Azure regions.. Option B is correct because Strong consistency is offered in all Azure regions, including all public, sovereign, and government cloud regions, so it is universally available as a consistency level choice. Option C is correct because Session consistency is the default consistency level for newly created Azure Cosmos DB accounts, providing read-your-own-writes guarantees within a session. Option A is incorrect because Strong consistency actually provides the lowest availability (and highest latency) among the five levels, since it requires synchronous replication across all replicas before acknowledging writes. Option D is incorrect because Bounded staleness is not the default; it is a configurable level with a defined staleness window. Option E is incorrect because Eventual consistency is the weakest level and is not the default for new accounts.

Answer

Strong consistency provides the highest availability.

Answer

Bounded staleness consistency is the default consistency level.

Answer

Eventual consistency is the default consistency level for all new Cosmos DB accounts.

Question 11

You are developing a solution that uses Azure Table Storage to store time-series data. You need to query data for a specific device within a time range efficiently. Which two properties should you use as the PartitionKey and RowKey?

Accepted Answer

PartitionKey = deviceId, RowKey = timestamp. Using deviceId as the PartitionKey ensures all data for a specific device is stored in the same partition, enabling efficient point queries. Using timestamp as the RowKey allows range queries within a time range for that device, as RowKey is sorted lexicographically within a partition. Option A is incorrect because using timestamp as PartitionKey scatters data across partitions, requiring cross-partition queries. Option B is incorrect for the same reason, and also the RowKey is not optimized for range queries. Option D is incorrect because using reverse timestamp as RowKey does not improve range query efficiency over timestamp directly.

Answer

PartitionKey = timestamp, RowKey = reverse deviceId

Answer

PartitionKey = timestamp, RowKey = deviceId

Answer

PartitionKey = deviceId, RowKey = reverse timestamp

Question 12

You are designing a solution to store large amounts of log data that will be queried infrequently but must be retained for regulatory purposes for 7 years. The logs are append-only and do not need to be modified. You need to choose a cost-effective storage option. Which three Azure capabilities should you consider? (Choose three.)

Accepted Answer

Azure Blob Storage lifecycle management policy. Option B (Azure Blob Storage lifecycle management policy) is correct because lifecycle rules can automatically transition append-only log blobs to cooler tiers and eventually delete them after the 7-year retention period, minimizing manual management and cost. Option C (Azure Blob Storage with Cool access tier) is correct because infrequently queried logs are a textbook fit for the Cool tier, which offers lower storage cost than Hot while still supporting immediate access for occasional regulatory queries. Option E (Azure Blob Storage immutability policy) is correct because a time-based retention or legal-hold immutability policy enforces WORM protection, ensuring the append-only logs cannot be modified or deleted during the 7-year regulatory retention window. Option A (soft delete) is not appropriate as a primary design choice because it is a data-protection feature for recovering accidentally deleted blobs, not a cost-effective long-term retention or tiering mechanism. Option D (Azure Table Storage) is not suitable because it is a NoSQL key-attribute store with size and query limitations, not an object storage service designed for large append-only log archives with tiering and immutability controls.

Answer

Azure Blob Storage soft delete

Answer

Azure Table Storage

Question 13

Refer to the exhibit. You run the Azure CLI command to check if blob encryption is enabled for a storage account. The command returns 'false'. However, you know that Azure Storage encrypts all data at rest by default. What is the explanation?

Accepted Answer

The property 'encryption.services.blob.enabled' refers to customer-managed key encryption, not the default encryption. The property 'encryption.services.blob.enabled' in the Azure CLI command 'az storage account show --query "encryption.services.blob.enabled"' returns 'true' for all Azure Storage accounts. This is because encryption for data at rest (using Microsoft-managed keys) is always enabled by default for the blob service and cannot be disabled. This property indicates that the blob service has encryption enabled, not whether customer-managed keys (CMK) are in use. To determine if CMK is configured, one would typically check the 'encryption.keySource' property, which would be 'Microsoft.Keyvault' if CMK is active, or 'Microsoft.Storage' if Microsoft-managed keys are in use. Therefore, the stem's premise that the command returns 'false' is incorrect, and the original explanation's assertion that 'encryption.services.blob.enabled' refers specifically to CMK is also incorrect.

Answer

The storage account was created with Azure Disk Encryption instead

Answer

The command is querying the wrong property; use 'encryption.requireInfrastructureEncryption'

Answer

The storage account is in a region that does not support encryption

Question 14

Which TWO actions should you take to ensure data durability for a storage account using LRS? (Choose two.)

Accepted Answer

Enable soft delete for blobs.. Enabling soft delete for blobs (A) is correct because it retains deleted blob data for a configurable retention period, allowing recovery from accidental deletion or overwrites, which directly protects data durability at the object level. Enabling blob versioning (C) is also correct because it automatically preserves previous versions of a blob whenever it is modified or deleted, so earlier states can be restored and data loss from overwrites is prevented. Together, soft delete and versioning provide object-level protection within an LRS storage account. Assigning RBAC roles (B) only controls authorization and does not protect data from deletion or corruption, so it does not ensure durability. Changing replication to GRS (D) would improve geo-redundancy but is a replication change rather than an action to ensure durability for the existing LRS account, and the question specifies LRS. Configuring network firewall rules (E) restricts network access but does not protect stored data from loss, so it is not a durability measure.

Answer

Assign RBAC roles to users.

Answer

Change replication to GRS.

Answer

Configure network firewall rules.

Question 15

A healthcare application stores patient diagnostic images in Azure Blob Storage. The images are accessed by radiologists worldwide. You need to reduce latency for image retrieval while maintaining security and compliance. Which TWO actions should you take?

Accepted Answer

Enable Azure CDN or Azure Front Door with caching rules.. Option B is correct because Azure CDN or Azure Front Door caches blob content at edge points of presence (POPs) worldwide, so radiologists retrieve images from the nearest edge location instead of the origin storage account, directly reducing retrieval latency while HTTPS/TLS and token-based access preserve security and compliance. Option D is correct because Azure Front Door with a Private Link origin connects to the storage account over the Microsoft backbone using a private endpoint, keeping traffic off the public internet and enabling caching plus WAF and compliance controls for globally distributed, secure image delivery. Option A is not correct because Premium Block Blob storage improves performance and IOPS for the storage tier itself but does not place content closer to worldwide users, so it does not address global retrieval latency. Option C is not correct because RA-GRS provides geo-replication for read access in a secondary region but does not cache content at edge locations, so latency improvements are limited and it is not the intended global acceleration mechanism. Option E is not correct because lifecycle management deletes blobs after reading, which would destroy diagnostic images and violate healthcare retention and compliance requirements rather than reduce latency.

Answer

Upgrade to Premium Block Blob storage.

Answer

Enable read-access geo-redundant storage (RA-GRS).

Answer

Use Blob Storage lifecycle management to delete blobs after reading.

Question 16

You are developing a web application that stores user session data in Azure Redis Cache. The application experiences high traffic and you need to ensure that session data is not lost if the cache is restarted. Which feature should you enable?

Accepted Answer

Redis persistence (RDB or AOF). To prevent session data loss when the cache restarts, you must enable Redis persistence. This feature periodically saves the cache data to a storage account, allowing the data to be restored after a restart. Clustering, geo-replication, and private endpoints address scalability, disaster recovery, and security, respectively, but not data durability on restart.

Answer

Geo-replication

Answer

Clustering

Answer

Azure Private Endpoint

Question 17

You are developing an application that uses Azure Blob Storage. You need to implement a retry policy for transient failures when uploading blobs. The application uses the Azure.Storage.Blobs SDK. You want to configure the retry options to use exponential backoff with a maximum of 5 retries and a base delay of 2 seconds. Which code segment should you use?

Accepted Answer

var options = new BlobClientOptions(BlobClientOptions.ServiceVersion.V2021_12_02); options.Retry.MaxRetries = 5; options.Retry.Delay = TimeSpan.FromSeconds(2); options.Retry.Mode = RetryMode.Exponential;. To configure exponential backoff with a base delay of 2 seconds and 5 retries, you must set the Retry.Mode to RetryMode.Exponential, Retry.MaxRetries to 5, and Retry.Delay to 2 seconds. The BlobClientOptions class exposes these properties. The other options either use incorrect properties (NetworkTimeout) or set the wrong mode (Fixed), or omit the mode entirely, which may default to exponential but is not explicit. The correct code segment explicitly configures all required settings.

Answer

var options = new BlobClientOptions(); options.Retry.MaxRetries = 5; options.Retry.NetworkTimeout = TimeSpan.FromSeconds(2); options.Retry.Mode = RetryMode.Exponential;

Answer

var options = new BlobClientOptions(); options.Retry.MaxRetries = 5; options.Retry.Delay = TimeSpan.FromSeconds(2); options.Retry.Mode = RetryMode.Fixed;

Answer

var options = new BlobClientOptions(); options.Retry.MaxRetries = 5; options.Retry.Delay = TimeSpan.FromSeconds(2); options.Retry.MaxDelay = TimeSpan.FromSeconds(10);

Question 18

A company stores archival data in Azure Blob Storage. The data is accessed only a few times per year, and retrieval can take up to 15 hours. Which blob access tier minimizes storage costs while meeting these requirements?

Accepted Answer

Archive tier. The Archive tier is the correct choice because it is designed for data that is rarely accessed (a few times per year) and has a retrieval latency of up to 15 hours, which matches the requirement. It offers the lowest storage cost among Azure Blob Storage tiers, making it optimal for long-term archival data where infrequent access and delayed retrieval are acceptable.

Answer

Hot tier

Answer

Cool tier

Answer

Premium tier

Question 19

You are building a serverless application that needs to react to insertions and updates in an Azure Cosmos DB container. You want to process these changes using an Azure Function. Which trigger should you configure for the function?

Accepted Answer

Cosmos DB trigger. A Cosmos DB trigger is the correct choice because it is specifically designed to react to changes in a Cosmos DB container by leveraging the change feed. The Azure Function runtime polls the change feed for inserts and updates, invoking the function with batches of documents as they occur. This provides a native, serverless integration without needing additional services.

Answer

Blob trigger

Answer

Event Grid trigger

Answer

Service Bus trigger

Question 20

You are developing an application that writes logs to Azure Blob Storage. Each log entry is small (less than 1 KB) and you need to store millions of entries per day. You want to minimize storage costs and maximize write throughput. Which blob type should you use?

Accepted Answer

Append blobs.. Append blobs are optimized for append operations, making them ideal for logging scenarios where each log entry is appended to the blob. They provide high throughput for write-heavy, sequential append workloads and are cost-effective because they use the same block blob pricing but avoid the overhead of managing individual blocks for each small entry.

Answer

Block blobs with a high block size.

Answer

Page blobs.

Answer

Block blobs with a low block size.