AZ-204 Develop for Azure storage Practice Test 6 — 15 Questions

Question 1

You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?

Accepted Answer

Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.. Option B is correct because it uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.

Answer

Generate a shared access signature (SAS) with read permissions for the container.

Answer

Add the user as a Storage Blob Data Reader at the storage account level.

Answer

Share the storage account key with the user.

Question 2

Your application writes millions of small records (each under 1 KB) to Azure Table Storage every day. You notice that query performance degrades over time. Which design change would most improve performance?

Accepted Answer

Use a hash of the timestamp as the PartitionKey to distribute writes evenly.. Option B is correct because using a hash of the timestamp as the PartitionKey distributes writes evenly across partition ranges, preventing hot partitions. Azure Table Storage scales by splitting partitions across storage nodes; sequential timestamps create a hot partition on the last node, degrading throughput. A hash ensures uniform load, maximizing the account's 20,000 IOPS per partition target.

Answer

Store all records in a single blob and use Blob Storage.

Answer

Increase the storage account's throughput limits.

Answer

Use a single PartitionKey and a sequential RowKey.

Question 3

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

Question 4

You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?

Accepted Answer

A shared access signature (SAS) with read permission and an expiration time of one hour.. Option D is correct because a shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.

Answer

Storage account key.

Answer

Enable anonymous public read access on the container.

Answer

A user delegation key.

Question 5

Which TWO of the following are valid use cases for Azure Queue Storage? (Choose TWO.)

Accepted Answer

Building a reliable messaging layer between microservices.. Option A is correct because Azure Queue Storage provides a reliable, persistent message queue that enables asynchronous communication between microservices. It guarantees at-least-once delivery and supports message visibility timeouts, making it ideal for decoupling components in a distributed architecture.

Answer

Broadcasting messages to multiple subscribers.

Answer

Storing large JSON documents for later retrieval.

Answer

Streaming high-volume telemetry data for real-time analytics.

Question 6

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Option C is correct because Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 7

Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)

Accepted Answer

Storage account key (Shared Key).. Option A is correct because the storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.

Answer

Certificate-based authentication.

Answer

Managed Service Identity (MSI).

Answer

Shared access signature (SAS) token.

Question 8

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. Option D is correct because the `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 9

You deploy the ARM template shown in the exhibit. After deployment, you need to change the replication to geo-redundant storage (GRS) with read access (RA-GRS). What should you do?

Accepted Answer

Update the 'sku.name' to 'Standard_RAGRS' and redeploy.. Option D is correct because the ARM template initially deploys a storage account with 'Standard_GRS' (geo-redundant storage), but to enable read access to the secondary region (RA-GRS), you must change the SKU name to 'Standard_RAGRS'. Redeploying the template with this updated property updates the replication setting to RA-GRS, which provides both geo-redundancy and read access to the secondary endpoint.

Answer

Redeploy the same template; Standard_GRS already provides geo-redundancy.

Answer

Set the 'supportsHttpsTrafficOnly' property to false.

Answer

Change the 'accessTier' to 'Cool'.

Question 10

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

Accepted Answer

Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.. The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Answer

Convert the blob to an AppendBlob type.

Answer

Use the Get-AzStorageBlobContent cmdlet to download the blob directly.

Answer

Use the storage account key to access the blob.

Question 11

You are developing a .NET Core application that uploads large files (up to 50 GB) to Azure Blob Storage. The application must support resuming uploads that are interrupted due to network failures. Which approach should you use?

Accepted Answer

Use a block blob and upload blocks in parallel, then commit the block list.. Block blobs are designed for large files and support uploading blocks in parallel, which improves throughput and reliability. By uploading individual blocks and then committing the block list, you can resume an interrupted upload by re-uploading only the missing blocks, as each block is identified by a unique block ID. This approach is ideal for files up to 50 GB and aligns with Azure's recommended pattern for resumable uploads.

Answer

Use an append blob and append blocks in sequence.

Answer

Use the Put Blob API to upload the entire file in a single request.

Answer

Use a page blob and upload pages in sequence.

Question 12

You have an Azure Storage account with hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to provide an application with delegated access to a specific directory and its contents, with the ability to list, read, and write files. The access must be scoped to the directory and not allow access to other parts of the storage account. Which approach should you use?

Accepted Answer

Configure access control lists (ACLs) on the directory and assign the application's managed identity.. Option C is correct because Azure Data Lake Storage Gen2 supports POSIX-like access control lists (ACLs) that can grant granular permissions to a specific directory and its contents. By configuring ACLs on the target directory and assigning the application's managed identity, you can precisely scope list, read, and write access to that directory without affecting other parts of the storage account. This approach avoids the need for account-level keys or RBAC roles, which would grant broader permissions.

Answer

Generate a shared access signature (SAS) token for the directory.

Answer

Assign the 'Storage Blob Data Contributor' RBAC role to the application at the storage account level.

Answer

Use the storage account access key in the application.

Question 13

You are designing a solution that stores customer order data in Azure Table Storage. The data includes OrderID (string), CustomerID (string), OrderDate (datetime), and TotalAmount (decimal). You need to query orders for a specific customer within a date range efficiently. Which partition key and row key design should you use?

Accepted Answer

PartitionKey = CustomerID, RowKey = OrderDate (inverted ticks for descending order). Option B is correct because Azure Table Storage queries are most efficient when they use PartitionKey for exact matches and RowKey for range scans. By setting PartitionKey = CustomerID, all orders for a specific customer are stored in the same partition, allowing fast retrieval. Using RowKey = OrderDate (inverted ticks for descending order) enables efficient date-range filtering within that partition, as Azure Table Storage supports range queries on RowKey.

Answer

PartitionKey = OrderDate, RowKey = OrderID

Answer

PartitionKey = OrderDate, RowKey = CustomerID

Answer

PartitionKey = OrderID, RowKey = CustomerID

Question 14

You are deploying an Azure Functions app that processes messages from an Azure Storage queue. The function must ensure that each message is processed at least once, and if processing fails, the message should be retried up to 5 times before being moved to a poison queue. Which configuration should you set?

Accepted Answer

Set the maxDequeueCount property in the host.json for the queue trigger to 5.. Option A is correct because the Azure Storage queue trigger's `maxDequeueCount` property in `host.json` controls the maximum number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 5 ensures that after 5 failed processing attempts, the message is automatically moved to the poison queue, satisfying the at-least-once processing and retry requirements without custom code.

Answer

Manually implement a retry loop in the function code.

Answer

Set the visibility timeout to 5 minutes in the queue.

Answer

Set the message time-to-live to 5 in the queue.

Question 15

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.. Option D is correct because lifecycle management rules in Azure Storage use the 'daysAfterModificationGreaterThan' condition to trigger actions based on the last modification time of a blob. This allows you to tier blobs to archive after 30 days and delete them after 365 days, which aligns with the requirement to manage blobs based on age when access tracking is not enabled.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.