AZ-204 Develop for Azure storage Practice Test 10 — 15 Questions

Question 1

Your application uses Azure Blob Storage to store images. You need to automatically move blobs older than 30 days to the Cool tier and delete blobs older than 365 days. What should you implement?

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to cooler tiers (e.g., Cool) after a specified number of days and delete them after a different number of days. This is the native, cost-effective, and fully managed solution for automating tier transitions and deletions based on blob age, without requiring external compute or orchestration services.

Answer

Azure Automation runbook on a schedule

Answer

Azure Logic Apps with recurrence trigger

Answer

Azure Event Grid subscription with blob created event

Question 2

You need to grant a user the ability to read and write blobs in a specific container for 24 hours. The solution must use delegated access without exposing the storage account key. What should you use?

Accepted Answer

User delegation shared access signature (SAS). A user delegation SAS is secured with Microsoft Entra ID credentials and is the only SAS type that uses delegated authorization without exposing the storage account key. It allows you to grant granular, time-limited access (e.g., 24 hours) to a specific container for read and write operations, meeting the requirement exactly.

Answer

Storage account access key

Answer

Account shared access signature (SAS)

Answer

Service shared access signature (SAS)

Question 3

You want to ensure that data in an Azure Storage account is replicated across multiple Azure regions to protect against regional outages. Which replication option should you choose?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within a primary region using LRS, then asynchronously replicates to a secondary region hundreds of miles away. This ensures data survives a complete regional outage because the secondary copy is available for read or write access after a failover, meeting the requirement for cross-region protection.

Answer

Locally-redundant storage (LRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Zone-redundant storage (ZRS)

Question 4

Your application uses Azure Queue Storage to process orders. Occasionally, messages are not processed and remain in the queue. You need to ensure that messages are automatically retried after a specified time if they are not deleted. What should you configure?

Accepted Answer

Set the message visibility timeout to a small value. Setting the message visibility timeout to a small value ensures that if a message is not deleted after processing (i.e., the worker fails or crashes), the message becomes visible again in the queue after the short timeout. This allows other queue consumers to retry processing the message automatically. The visibility timeout controls how long a message is hidden from other consumers after being dequeued, and a small value reduces the delay before a retry occurs.

Answer

Configure a dead-letter queue

Answer

Enable queue storage logging

Answer

Increase the message time-to-live (TTL)

Question 5

You need to upload a large file (10 GB) to Azure Blob Storage with the ability to pause and resume the upload. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload block blobs in parallel. Uploading a large file (10 GB) to Azure Blob Storage with pause/resume capability requires breaking the file into blocks and uploading them in parallel using the Azure Storage SDK. The SDK supports block blob operations, allowing you to track progress, retry failed blocks, and resume from the last committed block. A single Put Blob operation cannot handle files larger than 5 GB, and neither the Azure Portal nor AzCopy with /SyncCopy provides programmatic pause/resume control.

Answer

Use a single Put Blob operation

Answer

Use the Azure Portal to upload the file

Answer

Use AzCopy with the /SyncCopy parameter

Question 6

You are developing a .NET 8 application that stores customer data in Azure Blob Storage. The application uses the Azure.Storage.Blobs SDK. You need to ensure that the blob containers are created only if they do not already exist. Which method should you call?

Accepted Answer

CreateIfNotExistsAsync. The `CreateIfNotExistsAsync` method is the correct choice because it atomically checks for the existence of the blob container and creates it only if it does not already exist, returning a Boolean indicating whether creation occurred. This aligns with the requirement to avoid errors when the container already exists, without requiring a separate existence check.

Answer

ExistsAsync

Answer

DeleteIfExistsAsync

Answer

CreateAsync

Question 7

You need to grant access to a blob stored in Azure Blob Storage for 30 minutes to a user who does not have an Azure account. Which security mechanism should you use?

Accepted Answer

Shared Access Signature (SAS) token. A Shared Access Signature (SAS) token is the correct choice because it provides delegated, time-limited access to a specific blob resource without requiring the user to have an Azure account. You can set the token's expiry to 30 minutes, granting temporary access via a URI that includes the necessary authentication parameters. This mechanism is designed for scenarios where you need to grant granular, time-bound access to external users or clients.

Answer

Azure RBAC roles

Answer

Storage account access keys

Answer

Managed identity

Question 8

Your company uses Azure File Sync to sync on-premises file shares to Azure Files. You notice that some files are not syncing to Azure. You need to diagnose the issue with minimal administrative effort. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor provides the Azure File Sync monitoring blade, which offers pre-built metrics and alerts for sync health, file-level errors, and sync session status. This allows you to diagnose sync failures with minimal administrative effort by directly viewing sync group health, per-server sync status, and error codes without needing to configure additional log queries or workbooks.

Answer

Microsoft Sentinel

Answer

Azure Storage Insights

Answer

Azure Log Analytics

Question 9

You are designing a solution to store large amounts of unstructured data that is accessed infrequently (once a quarter). You need to minimize storage costs. Which Azure storage tier should you use?

Accepted Answer

Cool. The Cool tier is designed for data that is accessed infrequently (about once a quarter) and stored for at least 30 days, offering lower storage costs than Hot while still providing low-latency access. Since the data is unstructured and accessed only quarterly, Cool balances cost and availability without the long retrieval time or minimum storage duration of Archive.

Answer

Cold

Answer

Hot

Answer

Archive

Question 10

You are developing an application that writes blobs to Azure Blob Storage. The application requires high throughput and must handle transient failures. You need to implement a retry policy. Which approach should you use?

Accepted Answer

Configure the retry policy in the Azure.Storage.Blobs SDK. The Azure.Storage.Blobs SDK provides built-in retry policies (e.g., ExponentialRetry, FixedRetry) that handle transient failures automatically with configurable delays, retry counts, and backoff strategies. This is the recommended approach because it integrates directly with the SDK's client pipeline, respects service throttling, and avoids blocking threads or reinventing error handling logic.

Answer

Use a circuit breaker pattern

Answer

Implement a custom retry loop with Thread.Sleep

Answer

Generate a SAS token with a long expiry

Question 11

You need to enable client-side encryption for data stored in Azure Blob Storage. The encryption keys must be managed by your organization using Azure Key Vault. What should you use?

Accepted Answer

Azure Storage client-side encryption library with Key Vault. Client-side encryption requires the application to encrypt data before uploading it to Azure Blob Storage, and the Azure Storage client-side encryption library integrates with Azure Key Vault to allow your organization to manage the encryption keys. This approach ensures that the storage service never has access to the plaintext data or the keys, meeting the requirement for client-side encryption with customer-managed keys.

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Answer

Azure Storage service-side encryption with customer-managed keys

Question 12

You are migrating an on-premises application to Azure. The application uses a network file share (NFS) to store files. You need to minimize code changes. Which Azure storage service should you use?

Accepted Answer

Azure Files. Azure Files provides fully managed file shares in the cloud that support the Server Message Block (SMB) protocol and the Network File System (NFS) protocol. Since your on-premises application already uses an NFS share, migrating to Azure Files with NFS support allows you to mount the share directly with minimal code changes, as the application can continue to use the same file system semantics and NFS client calls.

Answer

Azure Disk Storage

Answer

Azure Blob Storage

Answer

Azure Queue Storage

Question 13

You need to store millions of small JSON documents (each less than 1 KB) that are accessed by key. The data is read-heavy and requires low-latency access. Which Azure storage solution should you use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it provides single-digit millisecond latency for point reads by key, supports automatic indexing of JSON documents, and offers a globally distributed, multi-model database service. For millions of small JSON documents accessed by key in a read-heavy workload, Cosmos DB's throughput-provisioned model and consistency levels optimize for low-latency access at scale.

Answer

Azure Files

Answer

Azure Table Storage

Answer

Azure Blob Storage

Question 14

You are developing an application that uses Azure Queue Storage. The application processes messages and must ensure that a message is not lost if the processing fails. Which visibility timeout setting should you use?

Accepted Answer

Set a short visibility timeout like 30 seconds. Setting a short visibility timeout (e.g., 30 seconds) ensures that if message processing fails, the message becomes visible again quickly for retry, preventing permanent loss. Azure Queue Storage uses a visibility timeout to hide a dequeued message from other consumers; if the processing fails and the message is not deleted, it reappears after the timeout expires. A short timeout balances retry speed with processing time, avoiding indefinite hiding that could lead to message loss if the consumer crashes.

Answer

Set visibility timeout to 1 hour

Answer

Set visibility timeout to infinite

Answer

Set visibility timeout to 0 seconds

Question 15

Which TWO of the following are valid approaches to secure access to Azure Blob Storage?

Accepted Answer

Use a Shared Access Signature (SAS) token. Option A is correct because a Shared Access Signature (SAS) is a signed URI token that grants time-limited, scoped, and permission-specific delegated access to Blob Storage resources (containers, blobs, or specific operations like read/write) without exposing the storage account keys. Option C is correct because Azure RBAC roles such as Storage Blob Data Contributor (and Storage Blob Data Reader/Owner) grant Microsoft Entra ID identities fine-grained, least-privilege access to blob data at the management and data-plane level, which is the recommended modern approach for securing Blob Storage. Option B is not a valid access-control mechanism for Blob Storage itself — Azure Front Door is a global HTTP load balancer/CDN that can front a storage endpoint but does not authenticate or authorize blob access. Option D is incorrect because embedding storage account keys in client code exposes full administrative credentials to anyone who obtains the code, violating security best practices. Option E is incorrect because enabling public blob access allows anonymous unauthenticated reads of blobs, which directly weakens rather than secures access.

Answer

Use Azure Front Door to restrict access

Answer

Embed storage account keys in client code

Answer

Enable public blob access