AZ-204 Develop for Azure storage Practice Test 11 — 15 Questions

Question 1

Which FOUR of the following are features of Azure Storage replication that provide high availability?

Accepted Answer

Locally redundant storage (LRS). LRS (A) is correct because it replicates data three times synchronously within a single Azure region, protecting against hardware failures and providing high availability within that region. GZRS (B) is correct because it combines ZRS replication across availability zones in the primary region with asynchronous replication to a secondary region, delivering both zone-level and regional high availability. GRS (C) is correct because it replicates data three times synchronously in the primary region and asynchronously to a paired secondary region, providing durability and availability if the primary region fails. ZRS (D) is correct because it replicates data synchronously across three availability zones within a region, keeping data available even if one zone goes down. Azure CDN (E) is not a storage replication feature; it is a content delivery service that caches content at edge locations to reduce latency, not a replication mechanism for high availability of storage data.

Answer

Azure Content Delivery Network (CDN)

Question 2

Which TWO of the following are valid reasons to use Azure Table Storage instead of Azure Cosmos DB?

Accepted Answer

Simpler API and no need for throughput provisioning. Azure Table Storage offers a simpler REST API based on OData and does not require explicit throughput provisioning (RU/s). In contrast, Azure Cosmos DB requires you to configure request units per second for each container, which adds operational complexity. For simple key-value workloads, Table Storage's pay-per-query model with no reserved capacity is more straightforward.

Answer

Global distribution with multi-master writes

Answer

Lower latency and higher throughput

Answer

Support for complex queries with indexing

Question 3

Refer to the exhibit. You have an Azure Storage account with a blob container named container1. The container's public access level is set to Blob (anonymous read access for blobs only). You attempt to assign the custom role defined in the JSON using Azure PowerShell. The role assignment fails. What is the most likely reason?

Accepted Answer

The condition StringEquals expects publicAccess to be 'none', but the container has Blob (anonymous) access.. C is correct because the custom role includes a condition that uses the `StringEquals` operator to check that the `publicAccess` property of the container is set to `'none'`. Since `container1` has public access level set to `Blob (anonymous read access for blobs only)`, the condition evaluates to false, causing the role assignment to fail. Azure role assignments with conditions require all specified conditions to be met; otherwise, the assignment is rejected.

Answer

The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is not a valid action.

Answer

The principal ID is invalid.

Answer

The resource scope is incorrectly formatted.

Question 4

Refer to the exhibit. You run the Get-AzStorageAccount cmdlet and see the output above. You need to enable the hierarchical namespace feature for this storage account. What should you do first?

Accepted Answer

Delete the storage account and create a new one with -EnableHierarchicalNamespace $true.. The hierarchical namespace feature (which enables Azure Data Lake Storage Gen2) cannot be enabled on an existing storage account; it must be set at creation time. Therefore, you must delete the current account and create a new one with the `-EnableHierarchicalNamespace $true` parameter. Option D is correct because it follows this immutable requirement.

Answer

Change the replication to LRS.

Answer

Set the -EnableHierarchicalNamespace parameter to true on the existing account.

Answer

Change the access tier to Hot.

Question 5

Your company, Contoso Ltd., operates a global e-commerce platform. The platform stores product images in Azure Blob Storage. Currently, the images are stored in a single storage account in the West US region. The application uses HTTP to download images. Users in Europe report slow load times. You need to reduce latency for European users. The solution must minimize costs and administrative overhead. You also need to ensure that images are served over HTTPS. You have the following requirements: 1) Users in Europe must have low-latency access. 2) The solution must be cost-effective. 3) The solution must not require changes to the application code. 4) Images must be served over HTTPS. Which course of action should you recommend?

Accepted Answer

Create an Azure CDN profile and add a CDN endpoint that points to the storage account. Enable HTTPS on the CDN endpoint.. Azure CDN provides a global, distributed network of edge servers that cache content closer to users, reducing latency for European users without requiring application code changes. Enabling HTTPS on the CDN endpoint ensures images are served securely over HTTPS, meeting the requirement. This solution is cost-effective as it uses a pay-as-you-go model and minimizes administrative overhead by leveraging a managed service.

Answer

Use Azure Front Door with the storage account as a backend.

Answer

Create a secondary storage account in Europe and use asynchronous replication. Update the application to use the secondary endpoint for European users.

Answer

Enable geo-redundant storage (GRS) on the storage account.

Question 6

You are developing a solution that uploads large files to Azure Blob Storage. Users report that uploads fail after 4 minutes. You need to ensure uploads can complete successfully. What should you do?

Accepted Answer

Increase the client-side timeout value in the upload request.. The default client-side timeout for Azure Blob Storage uploads is 4 minutes. When uploading large files, the operation may exceed this timeout, causing the upload to fail. Increasing the client-side timeout value in the upload request extends the allowed duration, ensuring the upload completes successfully.

Answer

Enable soft delete and versioning on the blob container.

Answer

Use premium block blob storage accounts.

Answer

Increase the storage account scale limit.

Question 7

Your application stores user-generated content in Azure Blob Storage. You need to implement a shared access signature (SAS) that allows users to upload files to a specific container but not read or delete. The SAS must be valid for one hour. Which type of SAS should you use?

Accepted Answer

Service SAS. A Service SAS is the correct choice because it allows you to delegate access to a specific Azure Blob Storage resource (in this case, a container) with granular permissions. You can generate a Service SAS scoped to the container with only the 'Create' and 'Write' permissions (no 'Read' or 'Delete'), and set its expiry to one hour. This meets the requirement of allowing uploads while preventing reads or deletes.

Answer

Account SAS

Answer

Stored access policy

Answer

User delegation SAS

Question 8

You are designing a disaster recovery plan for a storage account containing critical data. The storage account is in the West US region. You need to ensure that if West US becomes unavailable, read access to the data is still possible with minimal latency. The data must be replicated asynchronously. Which replication strategy should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is the correct choice because it provides asynchronous replication to a secondary region (paired region) and enables read access to the secondary endpoint even if the primary region fails. This meets the requirement for minimal latency read access during a West US outage, as RA-GRS allows reading from the secondary region while data is asynchronously replicated.

Answer

Read-access geo-zone-redundant storage (RA-GZRS)

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Question 9

Your application writes temperature data to Azure Table Storage every second. You have noticed that queries for the latest readings are slower than expected. What is the most likely cause?

Accepted Answer

The PartitionKey is not being used in the query filter.. In Azure Table Storage, queries that do not include the PartitionKey in the filter result in a full table scan, which is significantly slower than a point query that uses both PartitionKey and RowKey. Since the application writes data every second, the latest readings likely have a timestamp-based RowKey, but without filtering by PartitionKey, the query must scan all partitions, causing poor performance.

Answer

The storage account access tier is set to Cool.

Answer

The table name is too long.

Answer

The application is using an outdated version of the Azure Storage SDK.

Question 10

You are developing a web application that uses Azure Files shares for storing user documents. Users complain that they sometimes see stale file listings. The application uses the SMB protocol. What should you do to ensure the file listing is always current?

Accepted Answer

Set the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0 on clients.. The SMB protocol caches directory listings on the client side to improve performance. By setting the SMB_DIRECTORY_CACHE_MAX_AGE registry key to 0, you disable this caching, forcing the client to always fetch the latest directory listing from the Azure file share. This ensures that users see current file listings instead of stale cached data.

Answer

Enable soft delete for the file share.

Answer

Switch to using REST API for file listings.

Answer

Disable CDN caching for the storage account.

Question 11

Your company has a storage account with a hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to authorize an application to write data to a specific container using a managed identity. The application runs on an Azure VM with a system-assigned managed identity. Which role assignment should you use?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role on the container to the managed identity.. The 'Storage Blob Data Contributor' role grants read, write, and delete permissions to blob data at the container scope. For Azure Data Lake Storage Gen2 with a hierarchical namespace, this role provides the necessary ACL-based access for a managed identity to write data to a specific container, without granting control plane permissions.

Answer

Assign the 'Contributor' role on the storage account to the managed identity.

Answer

Assign the 'Storage Blob Data Reader' role on the container to the managed identity.

Answer

Assign the 'Owner' role on the storage account to the managed identity.

Question 12

You are building a solution that needs to process large CSV files uploaded to Azure Blob Storage. Each file can be up to 1 GB. You want to minimize processing time and cost. Which approach should you recommend?

Accepted Answer

Use Azure Data Factory to copy the data from Blob Storage to Azure SQL Database and perform transformations.. Azure Data Factory (ADF) is the correct choice because it is a fully managed, serverless data integration service designed for high-scale data movement and transformation. ADF can directly read large CSV files from Blob Storage using Copy Activity with built-in parallelization and chunking, then transform the data using Mapping Data Flows or stored procedures in Azure SQL Database, all without provisioning VMs or managing infrastructure. This minimizes both processing time (via scale-out) and cost (pay-per-use, no idle compute).

Answer

Use Azure Logic Apps to trigger a function that parses the CSV and inserts into Cosmos DB.

Answer

Download the file to an Azure VM and use a custom script to parse and insert into a database.

Answer

Use Azure Stream Analytics to read the CSV from Blob Storage and output to a data warehouse.

Question 13

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

Accepted Answer

Use Azure Data Box to physically ship the data to Azure.. Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Answer

Use Azure File Sync to replicate the backup to Azure Files.

Answer

Use AzCopy to copy the backup file directly to Blob Storage.

Answer

Set up an ExpressRoute connection and use AzCopy.

Question 14

Which FOUR are valid ways to authenticate to Azure Blob Storage from an application? (Choose four.)

Accepted Answer

Use the storage account access key.. Option A is correct because the storage account access key (key1/key2) is a shared secret that authorizes full access to the account's data plane and is a standard authentication method for Blob Storage. Option B is correct because OAuth2 bearer tokens issued by Microsoft Entra ID (for a user principal) can be presented to the Blob service and validated via Azure RBAC roles such as Storage Blob Data Reader/Contributor. Option C is correct because a shared access signature is a signed URL/token delegating scoped, time-limited permissions to blob resources, and it is a supported authentication mechanism. Option E is correct because a managed identity assigned to an Azure resource (system- or user-assigned) obtains an Entra ID token that the Blob SDK can use without storing credentials. Option D is not a valid Blob Storage authentication method; client certificates are used for other services (for example, service principals with certificate credentials authenticate to Entra ID, not directly to Blob Storage).

Answer

Use a client certificate.

Question 15

Which TWO Azure services can be used to trigger an Azure Function when a new blob is created in a storage account? (Choose two.)

Accepted Answer

Azure Event Grid trigger. Option C (Azure Event Grid trigger) is correct because Azure Storage integrates with Event Grid to publish blob-created events (Microsoft.Storage.BlobCreated), and an Azure Function can subscribe to that event via an Event Grid trigger to react to new blobs. Option D (Azure Blob Storage trigger) is correct because it is the native Azure Functions binding that polls/uses the Blob storage extension to invoke a function when a new or updated blob is detected in a container. Option A (Azure Cosmos DB trigger) is incorrect because it responds to changes in a Cosmos DB container's change feed, not to blob creation. Option B (Azure Queue Storage trigger) is incorrect because it fires on messages placed in a queue, not on blob creation events. Option E (Azure Service Bus trigger) is incorrect because it responds to messages on Service Bus queues or topics, which are unrelated to blob creation.

Answer

Azure Cosmos DB trigger

Answer

Azure Queue Storage trigger

Answer

Azure Service Bus trigger