AZ-204 Develop for Azure storage Practice Test 11 — 15 Questions

Question 1

Which TWO of the following are valid reasons to use Azure Table Storage instead of Azure Cosmos DB?

Accepted Answer

Simpler API and no need for throughput provisioning. Azure Table Storage offers a simpler REST API based on OData and does not require explicit throughput provisioning (RU/s). In contrast, Azure Cosmos DB requires you to configure request units per second for each container, which adds operational complexity. For simple key-value workloads, Table Storage's pay-per-query model with no reserved capacity is more straightforward.

Answer

Global distribution with multi-master writes

Answer

Lower latency and higher throughput

Answer

Support for complex queries with indexing

Question 2

Refer to the exhibit. You have an Azure Storage account with a blob container named container1. The container's public access level is set to Blob (anonymous read access for blobs only). You attempt to assign the custom role defined in the JSON using Azure PowerShell. The role assignment fails. What is the most likely reason?

Accepted Answer

The condition StringEquals expects publicAccess to be 'none', but the container has Blob (anonymous) access.. C is correct because the custom role includes a condition that uses the `StringEquals` operator to check that the `publicAccess` property of the container is set to `'none'`. Since `container1` has public access level set to `Blob (anonymous read access for blobs only)`, the condition evaluates to false, causing the role assignment to fail. Azure role assignments with conditions require all specified conditions to be met; otherwise, the assignment is rejected.

Answer

The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is not a valid action.

Answer

The principal ID is invalid.

Answer

The resource scope is incorrectly formatted.

Question 3

Refer to the exhibit. You run the Get-AzStorageAccount cmdlet and see the output above. You need to enable the hierarchical namespace feature for this storage account. What should you do first?

Accepted Answer

Delete the storage account and create a new one with -EnableHierarchicalNamespace $true.. The hierarchical namespace feature (which enables Azure Data Lake Storage Gen2) cannot be enabled on an existing storage account; it must be set at creation time. Therefore, you must delete the current account and create a new one with the `-EnableHierarchicalNamespace $true` parameter. Option D is correct because it follows this immutable requirement.

Answer

Change the replication to LRS.

Answer

Set the -EnableHierarchicalNamespace parameter to true on the existing account.

Answer

Change the access tier to Hot.

Question 4

Your company, Contoso Ltd., operates a global e-commerce platform. The platform stores product images in Azure Blob Storage. Currently, the images are stored in a single storage account in the West US region. The application uses HTTP to download images. Users in Europe report slow load times. You need to reduce latency for European users. The solution must minimize costs and administrative overhead. You also need to ensure that images are served over HTTPS. You have the following requirements: 1) Users in Europe must have low-latency access. 2) The solution must be cost-effective. 3) The solution must not require changes to the application code. 4) Images must be served over HTTPS. Which course of action should you recommend?

Accepted Answer

Create an Azure CDN profile and add a CDN endpoint that points to the storage account. Enable HTTPS on the CDN endpoint.. Azure CDN provides a global, distributed network of edge servers that cache content closer to users, reducing latency for European users without requiring application code changes. Enabling HTTPS on the CDN endpoint ensures images are served securely over HTTPS, meeting the requirement. This solution is cost-effective as it uses a pay-as-you-go model and minimizes administrative overhead by leveraging a managed service.

Answer

Use Azure Front Door with the storage account as a backend.

Answer

Create a secondary storage account in Europe and use asynchronous replication. Update the application to use the secondary endpoint for European users.

Answer

Enable geo-redundant storage (GRS) on the storage account.

Question 5

You are developing a solution that uploads large files to Azure Blob Storage. Users report that uploads fail after 4 minutes. You need to ensure uploads can complete successfully. What should you do?

Accepted Answer

Increase the client-side timeout value in the upload request.. The default client-side timeout for Azure Blob Storage uploads is 4 minutes. When uploading large files, the operation may exceed this timeout, causing the upload to fail. Increasing the client-side timeout value in the upload request extends the allowed duration, ensuring the upload completes successfully.

Answer

Enable soft delete and versioning on the blob container.

Answer

Use premium block blob storage accounts.

Answer

Increase the storage account scale limit.

Question 6

Your application stores user-generated content in Azure Blob Storage. You need to implement a shared access signature (SAS) that allows users to upload files to a specific container but not read or delete. The SAS must be valid for one hour. Which type of SAS should you use?

Accepted Answer

Service SAS. A Service SAS is the correct choice because it allows you to delegate access to a specific Azure Blob Storage resource (in this case, a container) with granular permissions. You can generate a Service SAS scoped to the container with only the 'Create' and 'Write' permissions (no 'Read' or 'Delete'), and set its expiry to one hour. This meets the requirement of allowing uploads while preventing reads or deletes.

Answer

Account SAS

Answer

Stored access policy

Answer

User delegation SAS

Question 7

You are designing a disaster recovery plan for a storage account containing critical data. The storage account is in the West US region. You need to ensure that if West US becomes unavailable, read access to the data is still possible with minimal latency. The data must be replicated asynchronously. Which replication strategy should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is the correct choice because it provides asynchronous replication to a secondary region (paired region) and enables read access to the secondary endpoint even if the primary region fails. This meets the requirement for minimal latency read access during a West US outage, as RA-GRS allows reading from the secondary region while data is asynchronously replicated.

Answer

Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Question 8

Your application writes temperature data to Azure Table Storage every second. You have noticed that queries for the latest readings are slower than expected. What is the most likely cause?

Accepted Answer

The PartitionKey is not being used in the query filter.. In Azure Table Storage, queries that do not include the PartitionKey in the filter result in a full table scan, which is significantly slower than a point query that uses both PartitionKey and RowKey. Since the application writes data every second, the latest readings likely have a timestamp-based RowKey, but without filtering by PartitionKey, the query must scan all partitions, causing poor performance.

Answer

The storage account access tier is set to Cool.

Answer

The table name is too long.

Answer

The application is using an outdated version of the Azure Storage SDK.

Question 9

You are developing a web application that uses Azure Files shares for storing user documents. Users complain that they sometimes see stale file listings. The application uses the SMB protocol. What should you do to ensure the file listing is always current?

Accepted Answer

Set the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0 on clients.. The SMB protocol caches directory listings on the client side to improve performance. By setting the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0, you disable this caching, forcing the client to always fetch the latest directory listing from the Azure file share. This ensures that users see current file listings instead of stale cached data.

Answer

Enable soft delete for the file share.

Answer

Switch to using REST API for file listings.

Answer

Disable CDN caching for the storage account.

Question 10

Your company has a storage account with a hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to authorize an application to write data to a specific container using a managed identity. The application runs on an Azure VM with a system-assigned managed identity. Which role assignment should you use?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role on the container to the managed identity.. The 'Storage Blob Data Contributor' role grants read, write, and delete permissions to blob data at the container scope. For Azure Data Lake Storage Gen2 with a hierarchical namespace, this role provides the necessary ACL-based access for a managed identity to write data to a specific container, without granting control plane permissions.

Answer

Assign the 'Contributor' role on the storage account to the managed identity.

Answer

Assign the 'Storage Blob Data Reader' role on the container to the managed identity.

Answer

Assign the 'Owner' role on the storage account to the managed identity.

Question 11

You are building a solution that needs to process large CSV files uploaded to Azure Blob Storage. Each file can be up to 1 GB. You want to minimize processing time and cost. Which approach should you recommend?

Accepted Answer

Use Azure Data Factory to copy the data from Blob Storage to Azure SQL Database and perform transformations.. Azure Data Factory (ADF) is the correct choice because it is a fully managed, serverless data integration service designed for high-scale data movement and transformation. ADF can directly read large CSV files from Blob Storage using Copy Activity with built-in parallelization and chunking, then transform the data using Mapping Data Flows or stored procedures in Azure SQL Database, all without provisioning VMs or managing infrastructure. This minimizes both processing time (via scale-out) and cost (pay-per-use, no idle compute).

Answer

Use Azure Logic Apps to trigger a function that parses the CSV and inserts into Cosmos DB.

Answer

Download the file to an Azure VM and use a custom script to parse and insert into a database.

Answer

Use Azure Stream Analytics to read the CSV from Blob Storage and output to a data warehouse.

Question 12

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

Accepted Answer

Use Azure Data Box to physically ship the data to Azure.. Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Answer

Use Azure File Sync to replicate the backup to Azure Files.

Answer

Use AzCopy to copy the backup file directly to Blob Storage.

Answer

Set up an ExpressRoute connection and use AzCopy.

Question 13

Which FOUR are valid ways to authenticate to Azure Blob Storage from an application? (Choose four.)

Accepted Answer

Use the storage account access key.. The storage account access key provides full administrative access to the storage account, including Blob Storage. It is a simple, shared-key authentication method using HMAC-SHA256 to sign requests. Option B is correct because OAuth2 tokens obtained from Microsoft Entra ID for a user are a supported authentication method for Azure Blob Storage, enabling fine-grained access control. Option C is correct because a shared access signature (SAS) token provides delegated access to storage resources with specified permissions and expiry. Option E is correct because a managed identity assigned to an Azure resource (e.g., a VM or App Service) can be used to authenticate to Blob Storage without storing credentials. Option D is incorrect because client certificates are not a supported authentication method for direct access to Azure Blob Storage; they are used for device authentication or authenticating to Azure AD as a service principal.

Answer

Use a client certificate.

Question 14

Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?

Accepted Answer

Read, write, and delete access to blobs in container c1.. The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.

Answer

Full management access to the storage account.

Answer

Read access to all containers in the storage account.

Answer

Read-only access to blobs in container c1.

Question 15

You are a developer for a healthcare company that stores patient diagnostic images in Azure Blob Storage. The images are uploaded by medical devices and must be retained for 7 years due to regulatory requirements. After 7 years, the data must be permanently deleted. The images are accessed infrequently after the first month. You need to design a storage lifecycle management policy to minimize costs while meeting compliance. The storage account uses general-purpose v2 with LRS. The container is named 'diagnostics'. Which of the following policies should you implement?

Accepted Answer

Move blobs to Cool tier after 30 days, move to Archive tier after 90 days, and delete after 7 years.. It aligns with the access pattern: blobs are moved to the Cool tier after 30 days (when infrequent access begins), then to the Archive tier after 90 days for long-term, low-cost storage, and finally deleted after 7 years to meet regulatory retention and deletion requirements. This minimizes costs by using the most cost-effective tier for each stage of the data lifecycle.

Answer

Move blobs to Cool tier after 30 days, and delete after 30 days.

Answer

Move blobs to Archive tier immediately after upload, and delete after 7 years.

Answer

Move blobs to Cool tier after 1 year, and delete after 7 years.