AZ-204 Develop for Azure storage Practice Test 6 — 15 Questions

Question 1

Audit logs are written daily as block blobs to an Azure Storage account. Logs older than 90 days must move to Cool tier automatically; logs older than 365 days must be deleted. The developer wants to implement this with no custom code and no recurring jobs. What is the correct solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a lifecycle management policy with two rules: tier to Cool after 90 days and delete after 365 days. Azure Blob Storage lifecycle management policies allow you to automate tier transitions and deletions based on blob age, without any custom code or recurring jobs. By defining a rule to tier blobs to Cool after 90 days and another rule to delete blobs after 365 days, the developer meets all requirements with a fully managed, no-code solution.

Answer

Write an Azure Function with a Timer trigger that lists all blobs, checks last-modified dates, and tiers or deletes them via the SDK

Answer

Enable Blob versioning and set a version retention policy of 365 days

Answer

Configure a Logic App with a Recurrence trigger to enumerate and process blobs weekly

Question 2

A Windows desktop application uses standard .NET file system calls such as File.ReadAllText and Directory.GetFiles. The team wants to move the file storage to Azure. The application code must not be rewritten. Which Azure storage service supports this requirement?

Accepted Answer

Azure Files with an SMB share mounted as a drive letter on the Windows machine. Azure Files with an SMB share mounted as a drive letter on the Windows machine allows the existing .NET application to use standard file system calls like File.ReadAllText and Directory.GetFiles without any code changes. This is because the mounted SMB share presents itself as a local drive, and the .NET runtime interacts with it through the standard Windows file system API, which internally uses the SMB protocol (CIFS) to communicate with Azure Files. No SDK or API rewrite is required.

Answer

Azure Blob Storage with the Azure Storage SDK replacing all file system calls

Answer

Azure Queue Storage for staging files between producer and consumer processes

Answer

Azure Table Storage with the file content stored as base64-encoded entity properties

Question 3

An e-commerce platform writes orders to a Cosmos DB container. A downstream inventory service must process every new or updated order exactly once, even if the inventory service restarts mid-batch. The solution must scale horizontally when order volume increases. What is the recommended design?

Accepted Answer

Use the change feed processor library with a dedicated lease container; each worker instance claims partition leases and commits checkpoints after processing each batch. The change feed processor library with a dedicated lease container is the recommended design because it provides exactly-once processing semantics through checkpointing, automatic partition lease management for horizontal scaling, and resilience to worker restarts by resuming from the last committed checkpoint. This pattern is purpose-built for Cosmos DB change feed consumption in distributed systems.

Answer

Poll the Cosmos DB container every 30 seconds using a _ts timestamp filter to find recently modified documents

Answer

Subscribe to Azure Event Grid Cosmos DB events and process them in an Azure Function

Answer

Enable Cosmos DB analytical store and run batch queries from an Azure Synapse Spark pool every hour

Question 4

Arrange the steps to implement Azure AD authentication in an ASP.NET Core web app in the correct order.

Accepted Answer

Register app in Azure AD → Configure settings in appsettings.json → Add Microsoft.Identity.Web NuGet package → Configure middleware in Startup.cs → Secure endpoints with [Authorize] attribute. First register the app in Microsoft Entra ID, then configure settings, add NuGet, configure middleware, and secure endpoints.

Answer

Add Microsoft.Identity.Web NuGet package → Register app in Azure AD → Configure settings in appsettings.json → Configure middleware in Startup.cs → Secure endpoints with [Authorize] attribute

Answer

Configure middleware in Startup.cs → Register app in Azure AD → Add Microsoft.Identity.Web NuGet package → Configure settings in appsettings.json → Secure endpoints with [Authorize] attribute

Answer

Secure endpoints with [Authorize] attribute → Register app in Azure AD → Configure settings in appsettings.json → Add Microsoft.Identity.Web NuGet package → Configure middleware in Startup.cs

Question 5

Arrange the steps to secure an Azure API Management API using OAuth 2.0 with Azure AD in the correct order.

Accepted Answer

Register an application in Azure AD, then configure API Management to use OAuth 2.0, then add the validate-jwt policy to the API, then configure the product to require OAuth 2.0, then test the setup.. First register app in Microsoft Entra ID, configure API Management with OAuth, add validate-jwt policy, configure product, test.

Answer

Configure API Management to use OAuth 2.0, then register an application in Azure AD, then add the validate-jwt policy to the API, then configure the product to require OAuth 2.0, then test the setup.

Answer

Register an application in Azure AD, then add the validate-jwt policy to the API, then configure API Management to use OAuth 2.0, then configure the product to require OAuth 2.0, then test the setup.

Answer

Register an application in Azure AD, then configure API Management to use OAuth 2.0, then configure the product to require OAuth 2.0, then add the validate-jwt policy to the API, then test the setup.

Question 6

Match each Azure messaging pattern to its description.

Accepted Answer

Azure Queue Storage: Simple message queuing for decoupling application components.. Azure messaging patterns include Queue Storage for simple queuing, Service Bus Topics for pub-sub with filters, Event Grid for event routing, and Event Hubs for streaming. Common confusions involve attributing advanced features like dead-lettering to Queue Storage or mixing IoT scenarios with Service Bus Topics.

Answer

Azure Queue Storage: Reliable message delivery with dead-lettering and scheduling.

Answer

Azure Service Bus Topic: Real-time IoT device communication.

Question 7

You are building a solution that uploads large files (up to 100 GB) to Azure Blob Storage. Users frequently experience timeout errors when uploading files over slow network connections. Which approach should you use to maximize reliability?

Accepted Answer

Use the Azure Storage SDK to upload the file as a block blob with multiple parallel blocks and implement retry logic with exponential backoff.. Uploading a large file as a block blob with multiple parallel blocks maximizes throughput and reliability over slow networks. The Azure Storage SDK automatically splits the file into blocks (up to 100 MB each), uploads them concurrently, and implements retry logic with exponential backoff to handle transient failures. This approach is specifically designed for large file uploads and mitigates timeout errors by keeping individual block transfers small and resumable.

Answer

Upload the file as a page blob in 512-byte chunks.

Answer

Increase the client-side timeout value to 10 minutes.

Answer

Use AzCopy with the /Z parameter to enable checkpointing.

Question 8

You are developing an application that stores sensitive user data in Azure Table Storage. You need to ensure that data is encrypted at rest and that only authorized users can access it. What should you implement?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) and use Microsoft Entra ID for authentication.. Azure Storage Service Encryption (SSE) automatically encrypts data at rest for Azure Table Storage using 256-bit AES encryption. By combining SSE with Microsoft Entra ID (formerly Azure AD) for authentication, you ensure both encryption at rest and role-based access control, meeting the requirement for authorized access without managing keys or encryption logic client-side.

Answer

Apply Azure Information Protection labels to the storage account.

Answer

Implement client-side encryption using the Azure Storage SDK and manage keys via Azure Key Vault.

Answer

Use shared access signatures (SAS) with a stored access policy to limit access to the data.

Question 9

Your application stores user profile images in Azure Blob Storage. You need to serve these images to users with low latency from a domain name that you own. What should you use?

Accepted Answer

Create an Azure CDN endpoint with a custom domain and point it to the blob container.. Azure CDN is the best choice for serving static images from Blob Storage with low latency using a custom domain. While Azure Front Door can also serve content with low latency, it is primarily a global load balancer and application acceleration service, and for simple image serving from blob storage, CDN is more cost-effective and directly designed for caching static content. Option A (static website hosting) does not provide edge caching for low latency. Option C (Azure DNS) only resolves the domain; it doesn't provide caching.

Answer

Enable static website hosting and configure a custom domain directly on the storage account.

Answer

Configure a custom domain in Azure DNS and point it to the storage account endpoint.

Answer

Use Azure Front Door with a custom domain.

Question 10

You are designing a solution that requires atomic operations on a counter stored in Azure Blob Storage. The counter must be updated by multiple instances without conflicts. Which approach should you use?

Accepted Answer

Store the counter in Azure Cosmos DB and use stored procedures to increment atomically.. Azure Cosmos DB stored procedures execute within the database engine's transactional scope, providing ACID-compliant atomic operations. This ensures that concurrent increments from multiple instances are serialized without conflicts, which is not natively supported by Azure Blob Storage's eventual consistency model.

Answer

Use Azure Queue Storage to queue increment messages.

Answer

Store the counter in Azure Table Storage and use optimistic concurrency with ETags.

Answer

Use Append Blob to append each increment as a new block and sum them later.

Question 11

You are using Azure File Sync to sync on-premises file shares to Azure. You need to ensure that files are cached locally on the on-premises server for fast access, but only the most frequently accessed files should be cached. What should you configure?

Accepted Answer

Enable cloud tiering on the server endpoint and set a volume free space policy.. Cloud tiering on an Azure File Sync server endpoint allows you to keep only frequently accessed files cached locally while infrequently accessed files are tiered to Azure. By setting a volume free space policy, you control how much local disk space is reserved for frequently accessed files, ensuring that only the most accessed files remain cached. This directly meets the requirement of caching only the most frequently accessed files locally.

Answer

Configure a caching rule using Azure File Sync's built-in cache size limit.

Answer

Configure a sync group with a custom server endpoint that filters files by last access time.

Answer

Use the Invoke-AzStorageSyncFileRecall cmdlet to recall files on demand.

Question 12

You need to grant a user from another Microsoft Entra ID tenant access to a specific blob container in your Azure Storage account. The solution must use Azure RBAC and minimize administrative overhead. What should you do?

Accepted Answer

Invite the user as a guest in your Microsoft Entra ID tenant and assign the Storage Blob Data Reader role to the container.. It uses Azure RBAC to grant cross-tenant access by inviting the user as a guest in your Microsoft Entra ID tenant, then assigning the Storage Blob Data Reader role at the container scope. This minimizes administrative overhead by leveraging existing role assignments without managing shared keys or SAS tokens, and it follows the principle of least privilege by scoping access to a specific container.

Answer

Generate a shared access signature (SAS) with read permissions for the container.

Answer

Add the user as a Storage Blob Data Reader at the storage account level.

Answer

Share the storage account key with the user.

Question 13

Your application writes millions of small records (each under 1 KB) to Azure Table Storage every day. You notice that query performance degrades over time. Which design change would most improve performance?

Accepted Answer

Use a hash of the timestamp as the PartitionKey to distribute writes evenly.. Using a hash of the timestamp as the PartitionKey distributes writes evenly across partition ranges, preventing hot partitions. Azure Table Storage scales by splitting partitions across storage nodes; sequential timestamps create a hot partition on the last node, degrading throughput. A hash ensures uniform load, maximizing the account's 20,000 IOPS per partition target.

Answer

Store all records in a single blob and use Blob Storage.

Answer

Increase the storage account's throughput limits.

Answer

Use a single PartitionKey and a sequential RowKey.

Question 14

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

Question 15

You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?

Accepted Answer

A shared access signature (SAS) with read permission and an expiration time of one hour.. A shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.

Answer

Storage account key.

Answer

Enable anonymous public read access on the container.

Answer

A user delegation key.