AZ-204 Develop for Azure storage Practice Test 7 — 15 Questions

Question 1

You are developing a solution that must encrypt data before it is sent to Azure Blob Storage. You need to manage encryption keys yourself using Azure Key Vault. Which approach should you use?

Accepted Answer

Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.. Client-side encryption with the Azure Storage SDK allows you to encrypt data before it leaves your application, ensuring it is never transmitted or stored in plaintext. By storing the encryption keys in Azure Key Vault, you maintain full control over key management, which aligns with the requirement to manage encryption keys yourself.

Answer

Use Azure Information Protection to encrypt the files.

Answer

Use Azure Disk Encryption for the storage account.

Answer

Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

Question 2

You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?

Accepted Answer

A shared access signature (SAS) with read permission and an expiration time of one hour.. A shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.

Answer

Storage account key.

Answer

Enable anonymous public read access on the container.

Answer

A user delegation key.

Question 3

Which TWO of the following are valid use cases for Azure Queue Storage? (Choose TWO.)

Accepted Answer

Building a reliable messaging layer between microservices.. Azure Queue Storage provides a reliable, persistent message queue that enables asynchronous communication between microservices. It guarantees at-least-once delivery and supports message visibility timeouts, making it ideal for decoupling components in a distributed architecture.

Answer

Broadcasting messages to multiple subscribers.

Answer

Storing large JSON documents for later retrieval.

Answer

Streaming high-volume telemetry data for real-time analytics.

Question 4

Which THREE of the following are true about Azure Blob Storage access tiers? (Choose THREE.)

Accepted Answer

You can change the access tier of a blob after it has been uploaded.. Azure Blob Storage allows you to change the access tier of a blob after it has been uploaded, either by directly setting the tier on the blob or using lifecycle management policies. This flexibility enables you to optimize storage costs based on changing access patterns without re-uploading data.

Answer

Hot tier has lower storage cost than Cool tier.

Answer

Archive tier allows immediate read access to blobs.

Question 5

Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)

Accepted Answer

Storage account key (Shared Key).. The storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.

Answer

Certificate-based authentication.

Answer

Managed Service Identity (MSI).

Answer

Shared access signature (SAS) token.

Question 6

You have an Azure Storage account configured as shown in the exhibit. You need to ensure that all traffic to the storage account uses HTTPS. Which Azure CLI command should you run next?

Accepted Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --https-only true. The `az storage account update` command with the `--https-only true` parameter enforces HTTPS for all traffic to the storage account by setting the `supportsHttpsTrafficOnly` property to true. This is the specific Azure CLI parameter that controls this setting, and it must be applied after account creation. The command directly meets the requirement to ensure all traffic uses HTTPS.

Answer

az storage account create --name mystorageaccount --resource-group myResourceGroup --https-only true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --secure-transfer-required true

Answer

az storage account update --name mystorageaccount --resource-group myResourceGroup --enable-https-traffic-only true

Question 7

You deploy the ARM template shown in the exhibit. After deployment, you need to change the replication to geo-redundant storage (GRS) with read access (RA-GRS). What should you do?

Accepted Answer

Update the 'sku.name' to 'Standard_RAGRS' and redeploy.. The ARM template initially deploys a storage account with 'Standard_GRS' (geo-redundant storage), but to enable read access to the secondary region (RA-GRS), you must change the SKU name to 'Standard_RAGRS'. Redeploying the template with this updated property updates the replication setting to RA-GRS, which provides both geo-redundancy and read access to the secondary endpoint.

Answer

Redeploy the same template; Standard_GRS already provides geo-redundancy.

Answer

Set the 'supportsHttpsTrafficOnly' property to false.

Answer

Change the 'accessTier' to 'Cool'.

Question 8

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

Accepted Answer

Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.. The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Answer

Convert the blob to an AppendBlob type.

Answer

Use the Get-AzStorageBlobContent cmdlet to download the blob directly.

Answer

Use the storage account key to access the blob.

Question 9

You are developing a .NET Core application that uploads large files (up to 50 GB) to Azure Blob Storage. The application must support resuming uploads that are interrupted due to network failures. Which approach should you use?

Accepted Answer

Use a block blob and upload blocks in parallel, then commit the block list.. Block blobs are designed for large files and support uploading blocks in parallel, which improves throughput and reliability. By uploading individual blocks and then committing the block list, you can resume an interrupted upload by re-uploading only the missing blocks, as each block is identified by a unique block ID. This approach is ideal for files up to 50 GB and aligns with Azure's recommended pattern for resumable uploads.

Answer

Use an append blob and append blocks in sequence.

Answer

Use the Put Blob API to upload the entire file in a single request.

Answer

Use a page blob and upload pages in sequence.

Question 10

You have an Azure Storage account with hierarchical namespace enabled (Azure Data Lake Storage Gen2). You need to provide an application with delegated access to a specific directory and its contents, with the ability to list, read, and write files. The access must be scoped to the directory and not allow access to other parts of the storage account. Which approach should you use?

Accepted Answer

Configure access control lists (ACLs) on the directory and assign the application's managed identity.. Azure Data Lake Storage Gen2 supports POSIX-like access control lists (ACLs) that can grant granular permissions to a specific directory and its contents. By configuring ACLs on the target directory and assigning the application's managed identity, you can precisely scope list, read, and write access to that directory without affecting other parts of the storage account. This approach avoids the need for account-level keys or RBAC roles, which would grant broader permissions.

Answer

Generate a shared access signature (SAS) token for the directory.

Answer

Assign the 'Storage Blob Data Contributor' RBAC role to the application at the storage account level.

Answer

Use the storage account access key in the application.

Question 11

You are designing a solution that stores customer order data in Azure Table Storage. The data includes OrderID (string), CustomerID (string), OrderDate (datetime), and TotalAmount (decimal). You need to query orders for a specific customer within a date range efficiently. Which partition key and row key design should you use?

Accepted Answer

PartitionKey = CustomerID, RowKey = OrderDate (inverted ticks for descending order). Azure Table Storage queries are most efficient when they use PartitionKey for exact matches and RowKey for range scans. By setting PartitionKey = CustomerID, all orders for a specific customer are stored in the same partition, allowing fast retrieval. Using RowKey = OrderDate (inverted ticks for descending order) enables efficient date-range filtering within that partition, as Azure Table Storage supports range queries on RowKey.

Answer

PartitionKey = OrderDate, RowKey = OrderID

Answer

PartitionKey = OrderDate, RowKey = CustomerID

Answer

PartitionKey = OrderID, RowKey = CustomerID

Question 12

You are deploying an Azure Functions app that processes messages from an Azure Storage queue. The function must ensure that each message is processed at least once, and if processing fails, the message should be retried up to 5 times before being moved to a poison queue. Which configuration should you set?

Accepted Answer

Set the maxDequeueCount property in the host.json for the queue trigger to 5.. The Azure Storage queue trigger's `maxDequeueCount` property in `host.json` controls the maximum number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 5 ensures that after 5 failed processing attempts, the message is automatically moved to the poison queue, satisfying the at-least-once processing and retry requirements without custom code.

Answer

Manually implement a retry loop in the function code.

Answer

Set the visibility timeout to 5 minutes in the queue.

Answer

Set the message time-to-live to 5 in the queue.

Question 13

You have an Azure Storage account with cool tier blobs. You need to implement lifecycle management to move blobs to the archive tier after 30 days if they have not been accessed, and delete them after 365 days. Which lifecycle management rule action should you configure?

Accepted Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete, and enable blob access tracking.. The requirement specifies 'if they have not been accessed', which requires tracking last access time. Lifecycle management rules support the 'daysAfterLastAccessTimeGreaterThan' condition, but blob access tracking must be enabled for this condition to work. Option A includes both the condition and enabling access tracking, making it the correct choice. Option D uses 'daysAfterModificationGreaterThan', which tracks last modification time, not access time, so it does not meet the requirement.

Answer

Use a rule with condition 'daysAfterLastAccessTimeGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterSnapshotCreationGreaterThan' to tier and delete.

Answer

Use a rule with condition 'daysAfterModificationGreaterThan' to tier after 30 days and delete after 365 days.

Question 14

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.. Both options A and C are valid methods to ensure the Azure Function only processes image files. Option A uses an Event Grid trigger with filtering on the 'content-type' property, which allows the function to only run for blobs with image content types. Option C checks the content type inside the function and ignores non-image blobs, which also works but runs the function for all blobs. Option B is incorrect because blob triggers do not have a 'filter' property for extensions. Option D is incorrect because the blob trigger's path pattern does not filter by extension; the function triggers for any blob in the container regardless of the file extension.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.

Question 15

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. The SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w