AZ-204 Develop for Azure storage Practice Test 8 — 15 Questions

Question 1

You are designing a solution that uses Azure File Shares. The application requires low-latency access to files from multiple Azure virtual machines in the same region. The files are accessed frequently and must support SMB protocol. Which storage account type and tier should you recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

FileStorage (premium file shares).. Azure premium file shares (FileStorage) provide low-latency, high-performance access using the SMB protocol, which is required for frequently accessed files from multiple VMs in the same region. Standard tiers (cool or transaction-optimized) do not meet the low-latency requirement, and BlobStorage does not support SMB protocol natively.

Answer

Standard general-purpose v2 with cool tier.

Answer

Standard general-purpose v2 with transaction-optimized tier.

Answer

BlobStorage with hot tier.

Question 2

You are developing an application that reads data from Azure Table Storage. The application must retrieve all entities for a specific partition key. Which query approach is the most efficient?

Accepted Answer

Query with a filter on PartitionKey only.. In Azure Table Storage, the PartitionKey is the primary index for partitioning data. Querying with a filter on PartitionKey only allows the service to perform a partition scan, which is the most efficient way to retrieve all entities within a single partition because it avoids cross-partition queries and leverages the partition-level index directly.

Answer

Query with a filter on RowKey only.

Answer

Query with a filter on both PartitionKey and RowKey.

Answer

Query all entities and filter in application code.

Question 3

You are building a web application that stores user-uploaded images in Azure Blob Storage. The application requires that images be accessible only via a time-limited URL. Which security mechanism should you use?

Accepted Answer

Generate a shared access signature (SAS) token for each blob.. A shared access signature (SAS) token provides delegated, time-limited access to a specific blob without exposing the storage account key. By generating a SAS token with an expiration time, you can enforce that the image URL is only valid for a limited period, meeting the requirement exactly. This is the standard Azure mechanism for granting granular, time-bound access to blob storage resources.

Answer

Use storage account access keys in the application code.

Answer

Assign the 'Storage Blob Data Reader' role to the application's managed identity.

Answer

Use Azure Key Vault to store and retrieve the storage account key.

Question 4

You are designing a solution to store large amounts of structured data that is accessed frequently and requires low-latency reads. The data must be globally distributed and support automatic failover. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and automatic failover.. Azure Cosmos DB with multi-region writes and automatic failover is the correct choice because it provides globally distributed, low-latency reads and writes with automatic failover at the database level. It supports multiple consistency models and guarantees single-digit millisecond read latencies, making it ideal for frequently accessed structured data that requires global distribution and high availability.

Answer

Azure Table Storage with geo-replication.

Answer

Azure SQL Database with active geo-replication and failover groups.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS).

Question 5

You are developing an application that writes telemetry data to Azure Table Storage. Each telemetry event is about 5 KB in size, and the application writes up to 10,000 events per second. The data is queried by device ID and timestamp range. What is the most efficient partitioning strategy to maximize write throughput and query performance?

Accepted Answer

Use device ID as the partition key and timestamp as the row key.. Using device ID as the partition key distributes writes across multiple partitions, avoiding throttling from a single partition's scalability limit (up to 20,000 operations per second per partition). Using timestamp as the row key enables efficient range queries for a specific device within a time window, leveraging the table's natural sort order on row key.

Answer

Use timestamp as the partition key and device ID as the row key.

Answer

Use device type as the partition key and timestamp as the row key.

Answer

Use a single partition key for all events and use timestamp as the row key.

Question 6

Your application runs on Azure App Service and needs to access Azure Queue Storage. You want to avoid storing connection strings in configuration files. Which approach should you use?

Accepted Answer

Use a system-assigned managed identity with RBAC role 'Storage Queue Data Contributor' on the queue.. Using a system-assigned managed identity for an Azure App Service allows it to authenticate to Azure Queue Storage without any stored secrets. By assigning the 'Storage Queue Data Contributor' RBAC role, the app gains the necessary permissions to read, write, and delete queue messages, and the identity is automatically managed by Azure AD, eliminating the need for connection strings.

Answer

Hardcode the connection string in the application code.

Answer

Use an environment variable in the App Service configuration.

Answer

Store the connection string in Azure Key Vault and retrieve it at runtime using Key Vault references.

Question 7

You are designing a cost-effective solution to store log files that are accessed infrequently after 30 days. The logs must be retained for 7 years for compliance. Data must be available within 1 hour of a request. Which Azure Blob Storage access tier and lifecycle management rule should you use?

Accepted Answer

Use Hot tier for 30 days, then Cool tier until 90 days, then Archive tier until deletion after 7 years.. It balances cost and compliance: the Hot tier handles initial frequent writes, Cool tier reduces cost for infrequent access after 30 days, and Archive tier provides the lowest-cost storage for long-term retention while still allowing rehydration within 1 hour (via High Priority rehydration). The lifecycle rule deletes the blobs after 7 years to meet compliance requirements.

Answer

Use Hot tier initially, then move to Archive after 30 days, and delete after 7 years.

Answer

Use Archive tier immediately and set a lifecycle rule to delete after 7 years.

Answer

Use Cool tier initially, then move to Archive after 30 days, and delete after 7 years.

Question 8

You are implementing a serverless function in Azure Functions that processes messages from an Azure Storage Queue. The function must ensure that each message is processed at least once and that processing failures are retried up to 5 times. After 5 failed attempts, the message should be moved to a poison queue. What should you configure?

Accepted Answer

Use the default queue poison message handling with 'maxDequeueCount' set to 5.. Azure Functions' Storage Queue trigger automatically implements a poison queue mechanism. By setting the 'maxDequeueCount' property in the host.json file to 5, the runtime will dequeue a message up to 5 times; after the 5th failed attempt, the message is automatically moved to the associated poison queue (named {originalqueue}-poison). This ensures at-least-once processing and retry handling without custom code.

Answer

Set the message time-to-live (TTL) to 5.

Answer

Implement a custom retry policy in the function code with a maximum of 5 retries.

Answer

Set the visibility timeout to 5 minutes.

Question 9

You need to store and retrieve large binary files (up to 100 GB each) with low latency. The files will be accessed by multiple geographic regions. Which Azure storage solution should you recommend?

Accepted Answer

Azure Blob Storage with geo-redundant storage (GRS).. Azure Blob Storage is designed for storing large binary objects (up to 4.7 TB per blob) and offers low-latency access via HTTP/HTTPS. Geo-redundant storage (GRS) replicates data to a paired secondary region, providing durability and availability for multi-region access. This combination meets the requirements for large files (up to 100 GB) and low-latency retrieval from multiple geographic regions.

Answer

Azure Queue Storage with messages.

Answer

Azure Files with Azure File Sync.

Answer

Azure SQL Database with file tables.

Question 10

Your application stores sensitive data in Azure Table Storage. You need to encrypt the data at rest. What should you do?

Accepted Answer

No action needed; Azure Storage Service Encryption (SSE) is enabled by default.. Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in Azure Table Storage using 256-bit AES encryption, and it is enabled by default for all new and existing storage accounts. Since the question asks about encrypting data at rest and does not specify a need for customer-managed keys or client-side control, the default SSE meets the requirement without any additional configuration.

Answer

Implement client-side encryption using Azure Key Vault.

Answer

Enable server-side encryption with customer-managed keys in Azure Key Vault.

Answer

Enable Azure Disk Encryption on the virtual machines accessing the storage.

Question 11

You are creating an Azure function that uses an output binding to write messages to an Azure Storage Queue. The function must ensure that messages are not lost if the function fails after writing to the queue. Which approach should you use?

Accepted Answer

Use the queue output binding with a queue trigger input binding in the same function.. Using a queue output binding together with a queue trigger input binding leverages the Azure Functions runtime's transactional behavior. When a function has a queue trigger, the incoming message is kept in the queue until the function completes successfully. If the function fails after writing to the output queue (e.g., a crash or exception), the output binding write is rolled back (not committed), and the input message is not deleted from the source queue. This ensures no message is lost: the output message is never written if the function fails, and the input message remains for retry. Without the queue trigger, if the function were triggered by another source (e.g., HTTP), a failure after the output write could still result in the output message being committed (since the function completes), but the context of the operation might be lost. The queue trigger input binding provides the necessary atomicity for this specific scenario.

Answer

Use a separate queue client SDK to write messages and handle errors manually.

Answer

Write to the queue directly in the function code and rely on the function's retry policy.

Answer

Use a durable function to orchestrate the writing and processing.

Question 12

You are developing a .NET application that needs to store and retrieve large binary objects (up to 4.7 TB) in Azure Blob Storage. The application requires the lowest possible latency for reads and must support object-level tiering. Which blob type should you use?

Accepted Answer

Block blob. Block blobs are designed for storing large binary objects up to approximately 4.74 TB and support object-level tiering (Hot, Cool, Cold, Archive). They offer the lowest read latency among Azure blob types because they can be accessed directly via HTTP/HTTPS and are optimized for streaming and random read access. Object-level tiering allows you to change the access tier of individual blobs without moving the storage account, which meets the requirement for granular cost optimization.

Answer

Archive storage account

Answer

Page blob

Answer

Append blob

Question 13

You have a web application that writes user-uploaded images to Azure Blob Storage. The application uses a shared access signature (SAS) token with read and write permissions. Users report that sometimes they receive 'AuthorizationFailure' errors when uploading images, but the issue is intermittent. What is the most likely cause?

Accepted Answer

The SAS token has expired and the application is not regenerating it before it expires. SAS tokens have a defined expiration time. If the application does not regenerate the token before it expires, uploads will intermittently fail with 'AuthorizationFailure' errors. The intermittent nature is explained by the token being valid for some requests and expired for others, depending on when the token was last refreshed.

Answer

The blob container has a soft-delete policy that is preventing uploads

Answer

The storage account firewall is blocking requests from the web application's IP

Answer

The SAS token was generated with an incorrect IP range restriction

Question 14

You need to ensure that data stored in Azure Blob Storage is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you configure?

Accepted Answer

Azure Storage encryption with customer-managed keys in Azure Key Vault. Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to use your own encryption keys to protect data at rest in Blob Storage. This feature leverages Azure Storage Service Encryption (SSE) but wraps the data encryption key with a customer-managed key stored in Azure Key Vault, providing full control over key rotation and access policies.

Answer

Azure Disk Encryption (ADE) for the storage account

Answer

Azure Information Protection (AIP) for the blob container

Answer

Azure Storage Service Encryption (SSE) with Microsoft-managed keys

Question 15

You are developing a solution that uses Azure Table Storage to store time-series data. You need to query data for a specific device within a time range efficiently. Which two properties should you use as the PartitionKey and RowKey?

Accepted Answer

PartitionKey = deviceId, RowKey = timestamp. Using deviceId as the PartitionKey ensures all data for a specific device is stored in the same partition, enabling efficient point queries. Using timestamp as the RowKey allows range queries within a time range for that device, as RowKey is sorted lexicographically within a partition. Option A is incorrect because using timestamp as PartitionKey scatters data across partitions, requiring cross-partition queries. Option B is incorrect for the same reason, and also the RowKey is not optimized for range queries. Option D is incorrect because using reverse timestamp as RowKey does not improve range query efficiency over timestamp directly.

Answer

PartitionKey = timestamp, RowKey = reverse deviceId

Answer

PartitionKey = timestamp, RowKey = deviceId

Answer

PartitionKey = deviceId, RowKey = reverse timestamp