AZ-204 Develop for Azure storage Practice Test 9 — 15 Questions

Question 1

You need to store a large number of small files (each < 100 KB) that will be accessed frequently from a web application. The files are static assets (CSS, JavaScript, images). Which Azure storage option provides the best performance for serving these files directly to users?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large volumes of unstructured data, including small static files. By integrating Azure CDN, you cache these files at edge nodes closer to users, drastically reducing latency and offloading origin requests. This combination provides the best performance for frequently accessed static assets served directly to a web application's users.

Answer

Azure Queue Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 2

Refer to the exhibit. You are configuring access to an Azure Storage container using Azure RBAC via a custom role definition. You want to allow a user to list blobs in a container only if the request originates from the IP range 203.0.113.0/24. However, the user reports that they can list blobs from any IP. What is the issue?

Accepted Answer

The Principal is set to an Azure AD tenant instead of a specific user or group. Option A is correct because the custom role definition's 'AssignableScopes' property must be set to a scope that includes the user or group, but the issue here is that the role assignment's 'Principal' property is set to an Azure AD tenant instead of a specific user or group. When the principal is set to the tenant, the role assignment applies to all users in the tenant, bypassing the IP condition because the condition is evaluated per principal. To enforce the IP condition, the role must be assigned to a specific user or group, not the entire tenant.

Answer

The Resource should be the storage account resource ID, not the container resource ID

Answer

The Action should be 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'

Answer

The Condition for IP address is incorrectly formatted

Question 3

Refer to the exhibit. You run the Azure CLI command to list blobs in a container that are larger than 1 MB. The command returns no results even though you know there are blobs larger than 1 MB. What is the most likely cause?

Accepted Answer

The storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2). The Azure CLI command uses the `az storage blob list` command with a JMESPath query to filter blobs larger than 1 MB. However, when a storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2), the blob listing API returns directory entries and file entries in a flat list, but the `az storage blob list` command does not support the hierarchical namespace by default. The command may return no results because the underlying REST API (Blob Service REST API) does not properly enumerate blobs in a Data Lake Storage Gen2 account without using the `--use-hierarchical-namespace` flag or the `az storage fs file list` command instead. This is a known limitation where the standard blob list operation fails to list files in a hierarchical namespace-enabled account.

Answer

The JMESPath query uses backticks incorrectly

Answer

The --container-name parameter is case-sensitive

Answer

The --account-name parameter is incorrect

Question 4

Refer to the exhibit. You run the Azure CLI command to check if blob encryption is enabled for a storage account. The command returns 'false'. However, you know that Azure Storage encrypts all data at rest by default. What is the explanation?

Accepted Answer

The property 'encryption.services.blob.enabled' refers to customer-managed key encryption, not the default encryption. Option C is correct because the property `encryption.services.blob.enabled` in the Azure CLI command `az storage account show` specifically indicates whether customer-managed keys (CMK) are enabled for blob encryption, not whether the default Microsoft-managed key encryption is active. Azure Storage automatically encrypts all data at rest using Microsoft-managed keys, and this default encryption is always enabled and cannot be disabled. The command returns 'false' because CMK has not been configured, but the underlying default encryption is still in effect.

Answer

The storage account was created with Azure Disk Encryption instead

Answer

The command is querying the wrong property; use 'encryption.requireInfrastructureEncryption'

Answer

The storage account is in a region that does not support encryption

Question 5

You are designing a solution to store and serve large media files (500 MB to 2 GB) to a global audience. The files must be accessible via HTTPS with low latency. Which Azure Storage option should you use?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large, unstructured data like media files, and integrating it with Azure CDN caches content at edge nodes worldwide, reducing latency for global users. HTTPS access is natively supported, and CDN ensures low-latency delivery by serving files from the nearest point of presence (PoP).

Answer

Azure Queue Storage

Answer

Azure Files with SMB protocol

Answer

Azure Table Storage

Question 6

Your application writes millions of small log entries per hour to an Azure Storage account. You notice throttling errors (HTTP 503) during peak traffic. You need to minimize throttling without changing the application code. What should you do?

Accepted Answer

Use a separate storage account for log data. Option B is correct because using a separate storage account for log data isolates the high-volume write traffic from other workloads, distributing the request load across different storage account endpoints. Azure Storage accounts have scalability targets (e.g., up to 20,000 requests per second per account for blob storage), and splitting logs into a dedicated account prevents hitting those limits, reducing HTTP 503 throttling errors without requiring code changes.

Answer

Request a storage account limit increase from Azure Support

Answer

Change the replication type to geo-redundant storage (GRS)

Answer

Enable soft delete on the blob container

Question 7

You need to securely connect an on-premises application to Azure Blob Storage without exposing data to the public internet. Which feature should you use?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint uses a private IP address from your virtual network to connect to Azure Blob Storage over the Microsoft backbone network, ensuring traffic never traverses the public internet. This provides a secure, private connection for on-premises applications via VPN or ExpressRoute, meeting the requirement to avoid public exposure.

Answer

IP firewall rules on the storage account

Answer

Storage account access keys

Answer

Shared access signature (SAS) with stored access policy

Question 8

Which TWO authentication methods can be used to authorize access to Azure Blob Storage without requiring shared keys?

Accepted Answer

Microsoft Entra ID (formerly Azure AD) authentication. Microsoft Entra ID (formerly Azure AD) authentication and managed identities for Azure resources are both identity-based authentication methods that do not require shared keys. Entra ID authentication uses OAuth 2.0 tokens to authorize access to Blob Storage, while managed identities provide an automatically managed identity in Entra ID for Azure resources, eliminating the need for developers to manage credentials. Both methods support role-based access control (RBAC) for fine-grained permissions.

Answer

Shared access signature (SAS) token

Answer

Storage account access keys

Answer

Client certificate-based authentication

Question 9

Which THREE Azure Storage features can be used to enforce immutability for compliance requirements?

Accepted Answer

Blob versioning with delete lock policy. Option A is correct because blob versioning with a delete lock policy prevents deletion of blob versions, effectively enforcing immutability by ensuring that once a version is created, it cannot be deleted or overwritten. This satisfies compliance requirements such as SEC 17a-4(f) or FINRA rules that mandate data preservation.

Answer

Soft delete for blobs

Answer

Storage account firewall rules

Question 10

Which TWO Azure Blob Storage access tiers are optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Archive. The Cool tier is optimized for data that is infrequently accessed and stored for at least 30 days, offering lower storage costs than Hot but higher access costs. The Archive tier is optimized for rarely accessed data with a minimum storage duration of 180 days, but it also supports infrequent access patterns and is often considered for long-term retention. Both Cool and Archive tiers are designed for infrequently accessed data, with Cool having a 30-day minimum and Archive a 180-day minimum, making them the correct answers for the 30-day requirement.

Answer

Transactional

Answer

Premium

Answer

Hot

Question 11

You are developing a solution that needs to store and retrieve JSON documents with a flexible schema. The data is accessed via REST API and requires low-latency reads. Which Azure Storage service should you use?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is the correct choice because it natively supports storing and querying JSON documents with a flexible schema via its SQL API, and it guarantees single-digit millisecond read latencies at the 99th percentile, which meets the low-latency requirement. Unlike other Azure storage services, Cosmos DB is a fully managed NoSQL database designed for REST API access with automatic indexing of all JSON properties.

Answer

Azure Blob Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 12

Your application uses Azure Blob Storage to store images. You need to automatically move blobs older than 30 days to the Cool tier and delete blobs older than 365 days. What should you implement?

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to cooler tiers (e.g., Cool) after a specified number of days and delete them after a different number of days. This is the native, cost-effective, and fully managed solution for automating tier transitions and deletions based on blob age, without requiring external compute or orchestration services.

Answer

Azure Automation runbook on a schedule

Answer

Azure Logic Apps with recurrence trigger

Answer

Azure Event Grid subscription with blob created event

Question 13

You need to grant a user the ability to read and write blobs in a specific container for 24 hours. The solution must use delegated access without exposing the storage account key. What should you use?

Accepted Answer

User delegation shared access signature (SAS). A user delegation SAS is secured with Azure AD credentials and is the only SAS type that uses delegated authorization without exposing the storage account key. It allows you to grant granular, time-limited access (e.g., 24 hours) to a specific container for read and write operations, meeting the requirement exactly.

Answer

Storage account access key

Answer

Account shared access signature (SAS)

Answer

Service shared access signature (SAS)

Question 14

You want to ensure that data in an Azure Storage account is replicated across multiple Azure regions to protect against regional outages. Which replication option should you choose?

Accepted Answer

Geo-redundant storage (GRS). Geo-redundant storage (GRS) replicates your data synchronously three times within a primary region using LRS, then asynchronously replicates to a secondary region hundreds of miles away. This ensures data survives a complete regional outage because the secondary copy is available for read or write access after a failover, meeting the requirement for cross-region protection.

Answer

Locally-redundant storage (LRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Zone-redundant storage (ZRS)

Question 15

Your application uses Azure Queue Storage to process orders. Occasionally, messages are not processed and remain in the queue. You need to ensure that messages are automatically retried after a specified time if they are not deleted. What should you configure?

Accepted Answer

Set the message visibility timeout to a small value. Option A is correct because setting the message visibility timeout to a small value ensures that if a message is not deleted after processing (i.e., the worker fails or crashes), the message becomes visible again in the queue after the short timeout. This allows other queue consumers to retry processing the message automatically. The visibility timeout controls how long a message is hidden from other consumers after being dequeued, and a small value reduces the delay before a retry occurs.

Answer

Configure a dead-letter queue

Answer

Enable queue storage logging

Answer

Increase the message time-to-live (TTL)