AZ-204 Develop for Azure storage Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are valid use cases for Azure Queue Storage? (Choose TWO.)

Accepted Answer

Building a reliable messaging layer between microservices.. Azure Queue Storage provides a reliable, persistent message queue that enables asynchronous communication between microservices. It guarantees at-least-once delivery and supports message visibility timeouts, making it ideal for decoupling components in a distributed architecture.

Answer

Broadcasting messages to multiple subscribers.

Answer

Storing large JSON documents for later retrieval.

Answer

Streaming high-volume telemetry data for real-time analytics.

Question 2

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 3

Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)

Accepted Answer

Storage account key (Shared Key).. The storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.

Answer

Certificate-based authentication.

Answer

Managed Service Identity (MSI).

Answer

Shared access signature (SAS) token.

Question 4

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. The `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 5

You deploy the ARM template shown in the exhibit. After deployment, you need to change the replication to geo-redundant storage (GRS) with read access (RA-GRS). What should you do?

Accepted Answer

Update the 'sku.name' to 'Standard_RAGRS' and redeploy.. The ARM template initially deploys a storage account with 'Standard_GRS' (geo-redundant storage), but to enable read access to the secondary region (RA-GRS), you must change the SKU name to 'Standard_RAGRS'. Redeploying the template with this updated property updates the replication setting to RA-GRS, which provides both geo-redundancy and read access to the secondary endpoint.

Answer

Redeploy the same template; Standard_GRS already provides geo-redundancy.

Answer

Set the 'supportsHttpsTrafficOnly' property to false.

Answer

Change the 'accessTier' to 'Cool'.

Question 6

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

Accepted Answer

Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.. The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Answer

Convert the blob to an AppendBlob type.

Answer

Use the Get-AzStorageBlobContent cmdlet to download the blob directly.

Answer

Use the storage account key to access the blob.

Question 7

You are developing a .NET Core application that uploads large files (up to 50 GB) to Azure Blob Storage. The application must support resuming uploads that are interrupted due to network failures. Which approach should you use?

Accepted Answer

Use a block blob and upload blocks in parallel, then commit the block list.. Block blobs are designed for large files and support uploading blocks in parallel, which improves throughput and reliability. By uploading individual blocks and then committing the block list, you can resume an interrupted upload by re-uploading only the missing blocks, as each block is identified by a unique block ID. This approach is ideal for files up to 50 GB and aligns with Azure's recommended pattern for resumable uploads.

Answer

Use an append blob and append blocks in sequence.

Answer

Use the Put Blob API to upload the entire file in a single request.

Answer

Use a page blob and upload pages in sequence.

Question 8

You have an Azure Storage account with hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to provide an application with delegated access to a specific directory and its contents, with the ability to list, read, and write files. The access must be scoped to the directory and not allow access to other parts of the storage account. Which approach should you use?

Accepted Answer

Configure access control lists (ACLs) on the directory and assign the application's managed identity.. Azure Data Lake Storage Gen2 supports POSIX-like access control lists (ACLs) that can grant granular permissions to a specific directory and its contents. By configuring ACLs on the target directory and assigning the application's managed identity, you can precisely scope list, read, and write access to that directory without affecting other parts of the storage account. This approach avoids the need for account-level keys or RBAC roles, which would grant broader permissions.

Answer

Generate a shared access signature (SAS) token for the directory.

Answer

Assign the 'Storage Blob Data Contributor' RBAC role to the application at the storage account level.

Answer

Use the storage account access key in the application.

Question 9

You are designing a solution that stores customer order data in Azure Table Storage. The data includes OrderID (string), CustomerID (string), OrderDate (datetime), and TotalAmount (decimal). You need to query orders for a specific customer within a date range efficiently. Which partition key and row key design should you use?

Accepted Answer

PartitionKey = CustomerID, RowKey = OrderDate (inverted ticks for descending order). Azure Table Storage queries are most efficient when they use PartitionKey for exact matches and RowKey for range scans. By setting PartitionKey = CustomerID, all orders for a specific customer are stored in the same partition, allowing fast retrieval. Using RowKey = OrderDate (inverted ticks for descending order) enables efficient date-range filtering within that partition, as Azure Table Storage supports range queries on RowKey.

Answer

PartitionKey = OrderDate, RowKey = OrderID

Answer

PartitionKey = OrderDate, RowKey = CustomerID

Answer

PartitionKey = OrderID, RowKey = CustomerID

Question 10

You are deploying an Azure Functions app that processes messages from an Azure Storage queue. The function must ensure that each message is processed at least once, and if processing fails, the message should be retried up to 5 times before being moved to a poison queue. Which configuration should you set?

Accepted Answer

Set the maxDequeueCount property in the host.json for the queue trigger to 5.. The Azure Storage queue trigger's `maxDequeueCount` property in `host.json` controls the maximum number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 5 ensures that after 5 failed processing attempts, the message is automatically moved to the poison queue, satisfying the at-least-once processing and retry requirements without custom code.

Answer

Manually implement a retry loop in the function code.

Answer

Set the visibility timeout to 5 minutes in the queue.

Answer

Set the message time-to-live to 5 in the queue.

Question 11

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.. The requirement specifies 'if they have not been accessed', which requires tracking last access time. Lifecycle management rules support the 'daysAfterLastAccessTimeGreaterThan' condition, but blob access tracking must be enabled for this condition to work. Option A includes both the condition and enabling access tracking, making it the correct choice. Option D uses 'daysAfterModificationGreaterThan', which tracks last modification time, not access time, so it does not meet the requirement.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.

Question 12

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. The SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w

Question 13

You are designing a solution that uses Azure File Shares. The application requires low-latency access to files from multiple Azure virtual machines in the same region. The files are accessed frequently and must support SMB protocol. Which storage account type and tier should you recommend?

Accepted Answer

FileStorage (premium file shares).. Azure premium file shares (FileStorage) provide low-latency, high-performance access using the SMB protocol, which is required for frequently accessed files from multiple VMs in the same region. Standard tiers (cool or transaction-optimized) do not meet the low-latency requirement, and BlobStorage does not support SMB protocol natively.

Answer

Standard general-purpose v2 with cool tier.

Answer

Standard general-purpose v2 with transaction-optimized tier.

Answer

BlobStorage with hot tier.

Question 14

You are developing an application that reads data from Azure Table Storage. The application must retrieve all entities for a specific partition key. Which query approach is the most efficient?

Accepted Answer

Query with a filter on PartitionKey only.. In Azure Table Storage, the PartitionKey is the primary index for partitioning data. Querying with a filter on PartitionKey only allows the service to perform a partition scan, which is the most efficient way to retrieve all entities within a single partition because it avoids cross-partition queries and leverages the partition-level index directly.

Answer

Query with a filter on RowKey only.

Answer

Query with a filter on both PartitionKey and RowKey.

Answer

Query all entities and filter in application code.

Question 15

Which TWO of the following are valid ways to authenticate to Azure Blob Storage from an application? (Choose two.)

Accepted Answer

Storage account access key. Option C (Storage account access key) is correct because Azure Blob Storage supports authorization using the storage account's access keys, which are shared secrets that grant full access to the storage account and can be used by an application to sign requests. Option D (Shared access signature (SAS) token) is also correct because a SAS is a URI that grants restricted, time-limited access rights to Blob Storage resources, and applications can authenticate by presenting this token. Option A is not valid because personal Microsoft account OAuth tokens are not an authentication mechanism for Blob Storage data-plane access; Microsoft Entra ID (work/school) identities are used instead. Option B is incorrect because SQL Server authentication applies to Azure SQL Database, not Blob Storage. Option E is incorrect because Azure Cosmos DB primary keys authenticate to Cosmos DB, not Blob Storage.

Answer

Microsoft account (personal) OAuth token

Answer

SQL Server authentication

Answer

Azure Cosmos DB primary key