AZ-204 Develop for Azure storage Practice Test 7 — 15 Questions

Question 1

You are developing a web application that allows users to upload profile pictures to Azure Blob Storage. The application generates thumbnails using an Azure Function that is triggered by blob creation. You need to ensure that the function only processes image files and ignores other file types. What should you do?

Accepted Answer

Use the blob trigger with a path pattern like 'images/{name}.jpg' and 'images/{name}.png' and use the extension binding to filter.. Option D is correct because Azure Blob Storage triggers in Azure Functions support path patterns that filter on blob name extensions, such as 'images/{name}.jpg' and 'images/{name}.png'. This allows the function to only fire when a blob with a matching extension is created, effectively ignoring non-image files without any runtime code or additional services.

Answer

Set the trigger's 'source' parameter to 'EventGrid' and filter events by the 'content-type' property.

Answer

Set the trigger's 'filter' property to '*.jpg,*.png'.

Answer

Implement the function without filtering and check the content type inside the function, ignoring non-image blobs.

Question 2

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

Accepted Answer

r and l. Option B is correct because the SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Answer

r, l, and c

Answer

r, l, and d

Answer

r, l, and w

Question 3

You are designing a solution that uses Azure File Shares. The application requires low-latency access to files from multiple Azure virtual machines in the same region. The files are accessed frequently and must support SMB protocol. Which storage account type and tier should you recommend?

Accepted Answer

FileStorage (premium file shares).. Option D is correct because Azure premium file shares (FileStorage) provide low-latency, high-performance access using the SMB protocol, which is required for frequently accessed files from multiple VMs in the same region. Standard tiers (cool or transaction-optimized) do not meet the low-latency requirement, and BlobStorage does not support SMB protocol natively.

Answer

Standard general-purpose v2 with cool tier.

Answer

Standard general-purpose v2 with transaction-optimized tier.

Answer

BlobStorage with hot tier.

Question 4

You are developing an application that reads data from Azure Table Storage. The application must retrieve all entities for a specific partition key. Which query approach is the most efficient?

Accepted Answer

Query with a filter on PartitionKey only.. In Azure Table Storage, the PartitionKey is the primary index for partitioning data. Querying with a filter on PartitionKey only allows the service to perform a partition scan, which is the most efficient way to retrieve all entities within a single partition because it avoids cross-partition queries and leverages the partition-level index directly.

Answer

Query with a filter on RowKey only.

Answer

Query with a filter on both PartitionKey and RowKey.

Answer

Query all entities and filter in application code.

Question 5

Which TWO of the following are valid ways to authenticate to Azure Blob Storage from an application? (Choose two.)

Accepted Answer

Storage account access key. Option C is correct because a storage account access key provides full administrative access to the storage account, including Blob Storage. Applications can authenticate by including the key in the Authorization header using the SharedKey scheme, which HMAC-SHA256 signs the request. This is a standard, documented method for authenticating to Azure Blob Storage.

Answer

Microsoft account (personal) OAuth token

Answer

SQL Server authentication

Answer

Azure Cosmos DB primary key

Question 6

Which THREE of the following are true about Azure Storage queues? (Choose three.)

Accepted Answer

The maximum time-to-live for a message is 7 days.. Option B is correct because Azure Storage queue messages have a configurable time-to-live (TTL) with a maximum value of 7 days. Once the TTL expires, the message is automatically deleted from the queue. This is a hard limit enforced by the Azure Storage service, not a default setting.

Answer

Messages are processed in strict FIFO order.

Answer

Messages can be up to 1 MB in size.

Question 7

Which TWO of the following are features of Azure Blob Storage lifecycle management? (Choose two.)

Accepted Answer

Automatically delete blobs after a specified number of days.. Option A is correct because Azure Blob Storage lifecycle management policies allow you to define rules that automatically delete blobs after a specified number of days. This is commonly used to enforce data retention policies or clean up temporary data without manual intervention.

Answer

Automatically apply legal hold to blobs.

Answer

Automatically replicate blobs to another region.

Answer

Automatically encrypt blobs at rest.

Question 8

You are building a web application that stores user-uploaded images in Azure Blob Storage. The application requires that images be accessible only via a time-limited URL. Which security mechanism should you use?

Accepted Answer

Generate a shared access signature (SAS) token for each blob.. A shared access signature (SAS) token provides delegated, time-limited access to a specific blob without exposing the storage account key. By generating a SAS token with an expiration time, you can enforce that the image URL is only valid for a limited period, meeting the requirement exactly. This is the standard Azure mechanism for granting granular, time-bound access to blob storage resources.

Answer

Use storage account access keys in the application code.

Answer

Assign the 'Storage Blob Data Reader' role to the application's managed identity.

Answer

Use Azure Key Vault to store and retrieve the storage account key.

Question 9

You are designing a solution to store large amounts of structured data that is accessed frequently and requires low-latency reads. The data must be globally distributed and support automatic failover. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and automatic failover.. Azure Cosmos DB with multi-region writes and automatic failover is the correct choice because it provides globally distributed, low-latency reads and writes with automatic failover at the database level. It supports multiple consistency models and guarantees single-digit millisecond read latencies, making it ideal for frequently accessed structured data that requires global distribution and high availability.

Answer

Azure Table Storage with geo-replication.

Answer

Azure SQL Database with active geo-replication and failover groups.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS).

Question 10

You are developing an application that writes telemetry data to Azure Table Storage. Each telemetry event is about 5 KB in size, and the application writes up to 10,000 events per second. The data is queried by device ID and timestamp range. What is the most efficient partitioning strategy to maximize write throughput and query performance?

Accepted Answer

Use device ID as the partition key and timestamp as the row key.. Option B is correct because using device ID as the partition key distributes writes across multiple partitions, avoiding throttling from a single partition's scalability limit (up to 20,000 operations per second per partition). Using timestamp as the row key enables efficient range queries for a specific device within a time window, leveraging the table's natural sort order on row key.

Answer

Use timestamp as the partition key and device ID as the row key.

Answer

Use device type as the partition key and timestamp as the row key.

Answer

Use a single partition key for all events and use timestamp as the row key.

Question 11

Your application runs on Azure App Service and needs to access Azure Queue Storage. You want to avoid storing connection strings in configuration files. Which approach should you use?

Accepted Answer

Use a system-assigned managed identity with RBAC role 'Storage Queue Data Contributor' on the queue.. Option B is correct because using a system-assigned managed identity for an Azure App Service allows it to authenticate to Azure Queue Storage without any stored secrets. By assigning the 'Storage Queue Data Contributor' RBAC role, the app gains the necessary permissions to read, write, and delete queue messages, and the identity is automatically managed by Azure AD, eliminating the need for connection strings.

Answer

Hardcode the connection string in the application code.

Answer

Use an environment variable in the App Service configuration.

Answer

Store the connection string in Azure Key Vault and retrieve it at runtime using Key Vault references.

Question 12

You are designing a cost-effective solution to store log files that are accessed infrequently after 30 days. The logs must be retained for 7 years for compliance. Data must be available within 1 hour of a request. Which Azure Blob Storage access tier and lifecycle management rule should you use?

Accepted Answer

Use Hot tier for 30 days, then Cool tier until 90 days, then Archive tier until deletion after 7 years.. Option D is correct because it balances cost and compliance: the Hot tier handles initial frequent writes, Cool tier reduces cost for infrequent access after 30 days, and Archive tier provides the lowest-cost storage for long-term retention while still allowing rehydration within 1 hour (via High Priority rehydration). The lifecycle rule deletes the blobs after 7 years to meet compliance requirements.

Answer

Use Hot tier initially, then move to Archive after 30 days, and delete after 7 years.

Answer

Use Archive tier immediately and set a lifecycle rule to delete after 7 years.

Answer

Use Cool tier initially, then move to Archive after 30 days, and delete after 7 years.

Question 13

You are implementing a serverless function in Azure Functions that processes messages from an Azure Storage Queue. The function must ensure that each message is processed at least once and that processing failures are retried up to 5 times. After 5 failed attempts, the message should be moved to a poison queue. What should you configure?

Accepted Answer

Use the default queue poison message handling with 'maxDequeueCount' set to 5.. Option C is correct because Azure Functions' Storage Queue trigger automatically implements a poison queue mechanism. By setting the 'maxDequeueCount' property in the host.json file to 5, the runtime will dequeue a message up to 5 times; after the 5th failed attempt, the message is automatically moved to the associated poison queue (named {originalqueue}-poison). This ensures at-least-once processing and retry handling without custom code.

Answer

Set the message time-to-live (TTL) to 5.

Answer

Implement a custom retry policy in the function code with a maximum of 5 retries.

Answer

Set the visibility timeout to 5 minutes.

Question 14

You need to store and retrieve large binary files (up to 100 GB each) with low latency. The files will be accessed by multiple geographic regions. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with geo-redundant storage (GRS).. Azure Blob Storage is designed for storing large binary objects (up to 4.7 TB per blob) and offers low-latency access via HTTP/HTTPS. Geo-redundant storage (GRS) replicates data to a paired secondary region, providing durability and availability for multi-region access. This combination meets the requirements for large files (up to 100 GB) and low-latency retrieval from multiple geographic regions.

Answer

Azure Queue Storage with messages.

Answer

Azure Files with Azure File Sync.

Answer

Azure SQL Database with file tables.

Question 15

Your application stores sensitive data in Azure Table Storage. You need to encrypt the data at rest. What should you do?

Accepted Answer

No action needed; Azure Storage Service Encryption (SSE) is enabled by default.. Option C is correct because Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in Azure Table Storage using 256-bit AES encryption, and it is enabled by default for all new and existing storage accounts. Since the question asks about encrypting data at rest and does not specify a need for customer-managed keys or client-side control, the default SSE meets the requirement without any additional configuration.

Answer

Implement client-side encryption using Azure Key Vault.

Answer

Enable server-side encryption with customer-managed keys in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the virtual machines accessing the storage.