AZ-204 Develop for Azure storage Practice Test 9 — 15 Questions

Question 1

A company stores sensitive customer data in Azure Blob Storage. They require that all access to the storage account be logged and that any access from outside the corporate network be denied. They also need to allow read access from a specific Azure web app without exposing the storage account publicly. Which three actions should be taken? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace. Enabling diagnostic settings for the storage account and sending logs to a Log Analytics workspace captures all access logs (including read, write, and delete operations) as required by the scenario. This satisfies the logging requirement. Assigning the 'Storage Blob Data Reader' role to the web app's managed identity provides secure, credential-less read access for the web app to the storage account, aligning with the principle of least privilege and avoiding public exposure. Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app ensures that access from outside the corporate network is denied and that the storage account is not exposed publicly, as the web app would access it via a private link or service endpoint within the allowed VNet.

Answer

Enable Azure Defender for Storage

Answer

Generate a SAS token and store it in the web app's configuration

Question 2

A company stores customer images in Azure Blob Storage. They need to reduce costs by automatically moving blobs that have not been accessed for 30 days to Cool tier, and after 90 days to Archive tier. They also need to delete blobs after one year. Which two Azure features should they implement? (Choose two.)

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policy allows you to define rules to automatically transition blobs to Cool and Archive tiers based on last access time and delete them after one year. Additionally, versioning with a retention policy automatically removes old blob versions after a specified period, preventing unnecessary storage costs from accumulating. Together, these features optimize storage costs by managing both current blobs and their versions.

Answer

Azure Blob Storage object replication

Answer

Azure Blob Storage soft delete

Answer

Azure Blob Storage immutability policy

Question 3

You need to grant a user access to read and write blobs in a specific container for exactly 24 hours. The user is external to your organization. Which two methods can you use? (Choose two.)

Accepted Answer

Create a shared access signature (SAS) token with an expiry time of 24 hours. A shared access signature (SAS) token can be scoped to a specific container and granted read and write permissions, with an expiry time set to exactly 24 hours. This allows the external user to access only that container for the specified duration without exposing the storage account key or requiring Azure AD authentication.

Answer

Share the storage account access key with the user

Answer

Create an account SAS token with read and write permissions

Answer

Assign the 'Storage Blob Data Contributor' role to the user's Microsoft account

Question 4

You need to upload a large file (500 MB) to Azure Blob Storage from a .NET application with high throughput and resilience to network interruptions. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK for .NET with the UploadAsync method that automatically splits the file into blocks. The Azure Storage SDK's UploadAsync method automatically uses block blob staging, splitting the 500 MB file into multiple blocks that are uploaded in parallel. This provides high throughput and resilience: if a network interruption occurs, only the failed blocks need to be retried, not the entire file. The SDK handles block management and final commit, making it ideal for large file uploads.

Answer

Use HTTP PUT with the entire file in a single request

Answer

Use the Azure Portal to upload the file

Answer

Use AzCopy with a single command

Question 5

You are using Azure File Storage to share configuration files across multiple virtual machines running a legacy application. The application requires SMB 3.0 protocol with encryption. You need to ensure the file share is accessible from all VMs without exposing it to the internet. Which configuration should you use?

Accepted Answer

Create a storage account with a private endpoint and mount the file share using the private IP. A private endpoint assigns the storage account a private IP address from your virtual network, allowing VMs to access the file share over SMB 3.0 with encryption without exposing the storage account to the public internet. This meets the requirement for secure, private connectivity while supporting the legacy application's SMB 3.0 protocol needs.

Answer

Create a storage account with a shared access signature (SAS) token and mount using the SAS URL

Answer

Create a storage account with a public endpoint and use a VPN gateway to connect the VMs

Answer

Create a storage account with a public endpoint and configure the firewall to allow only the VNet

Question 6

You are designing a solution that requires storing millions of small (1-5 KB) messages from IoT devices. Each message has a unique device ID and timestamp. You need to support efficient point queries by device ID and time range, and also support aggregation queries (e.g., count of messages per device per hour). Which Azure storage solution should you use?

Accepted Answer

Azure Table Storage. Azure Table Storage is the correct choice because it is a NoSQL key-value store optimized for storing large volumes of structured, non-relational data. It supports efficient point queries using the PartitionKey (device ID) and RowKey (timestamp), enabling fast retrieval by device ID and time range. Additionally, it allows aggregation queries like counting messages per device per hour via partition-scanned queries or client-side aggregation, and it is cost-effective for storing millions of small (1-5 KB) messages.

Answer

Azure Cosmos DB for NoSQL

Answer

Azure Queue Storage

Answer

Azure Blob Storage with JSON files

Question 7

You need to store a large number of small files (each < 100 KB) that will be accessed frequently from a web application. The files are static assets (CSS, JavaScript, images). Which Azure storage option provides the best performance for serving these files directly to users?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large volumes of unstructured data, including small static files. By integrating Azure CDN, you cache these files at edge nodes closer to users, drastically reducing latency and offloading origin requests. This combination provides the best performance for frequently accessed static assets served directly to a web application's users.

Answer

Azure Queue Storage

Answer

Azure Table Storage

Answer

Azure Files

Question 8

Refer to the exhibit. You are configuring access to an Azure Storage container using Azure RBAC via a custom role definition. You want to allow a user to list blobs in a container only if the request originates from the IP range 203.0.113.0/24. However, the user reports that they can list blobs from any IP. What is the issue?

Accepted Answer

The Condition for IP address is incorrectly formatted. The current explanation is technically incorrect. Azure RBAC conditions are designed to add restrictions to role assignments and are evaluated for every request by any principal covered by that assignment, regardless of whether the assignment target is a specific user, group, or a broader scope like the tenant. Assigning a role to the tenant does not bypass conditions; the condition should still be enforced for all principals covered by that assignment. A more plausible reason for the observed behavior (user can list blobs from any IP) would be that the condition for the IP address is incorrectly formatted (Option D), causing it to always evaluate to true or be ignored, or that another role assignment without the condition exists for the user.

Answer

The Principal is set to an Azure AD tenant instead of a specific user or group

Answer

The Resource should be the storage account resource ID, not the container resource ID

Answer

The Action should be 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'

Question 9

Refer to the exhibit. You run the Azure CLI command to list blobs in a container that are larger than 1 MB. The command returns no results even though you know there are blobs larger than 1 MB. What is the most likely cause?

Accepted Answer

The storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2). The Azure CLI command uses the `az storage blob list` command with a JMESPath query to filter blobs larger than 1 MB. However, when a storage account has hierarchical namespace enabled (Azure Data Lake Storage Gen2), the blob listing API returns directory entries and file entries in a flat list, but the `az storage blob list` command does not support the hierarchical namespace by default. The command may return no results because the underlying REST API (Blob Service REST API) does not properly enumerate blobs in a Data Lake Storage Gen2 account without using the `--use-hierarchical-namespace` flag or the `az storage fs file list` command instead. This is a known limitation where the standard blob list operation fails to list files in a hierarchical namespace-enabled account.

Answer

The JMESPath query uses backticks incorrectly

Answer

The --container-name parameter is case-sensitive

Answer

The --account-name parameter is incorrect

Question 10

You are designing a solution to store and serve large media files (500 MB to 2 GB) to a global audience. The files must be accessible via HTTPS with low latency. Which Azure Storage option should you use?

Accepted Answer

Azure Blob Storage with Azure CDN. Azure Blob Storage is optimized for storing large, unstructured data like media files, and integrating it with Azure CDN caches content at edge nodes worldwide, reducing latency for global users. HTTPS access is natively supported, and CDN ensures low-latency delivery by serving files from the nearest point of presence (PoP).

Answer

Azure Queue Storage

Answer

Azure Files with SMB protocol

Answer

Azure Table Storage

Question 11

Your application writes millions of small log entries per hour to an Azure Storage account. You notice throttling errors (HTTP 503) during peak traffic. You need to minimize throttling without changing the application code. What should you do?

Accepted Answer

Use a separate storage account for log data. Using a separate storage account for log data isolates the high-volume write traffic from other workloads, distributing the request load across different storage account endpoints. Azure Storage accounts have scalability targets (e.g., up to 20,000 requests per second per account for blob storage), and splitting logs into a dedicated account prevents hitting those limits, reducing HTTP 503 throttling errors without requiring code changes.

Answer

Request a storage account limit increase from Azure Support

Answer

Change the replication type to geo-redundant storage (GRS)

Answer

Enable soft delete on the blob container

Question 12

You need to securely connect an on-premises application to Azure Blob Storage without exposing data to the public internet. Which feature should you use?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint uses a private IP address from your virtual network to connect to Azure Blob Storage over the Microsoft backbone network, ensuring traffic never traverses the public internet. This provides a secure, private connection for on-premises applications via VPN or ExpressRoute, meeting the requirement to avoid public exposure.

Answer

IP firewall rules on the storage account

Answer

Storage account access keys

Answer

Shared access signature (SAS) with stored access policy

Question 13

Which TWO authentication methods can be used to authorize access to Azure Blob Storage without requiring shared keys?

Accepted Answer

Microsoft Entra ID (formerly Azure AD) authentication. Microsoft Entra ID (formerly Azure AD) authentication and managed identities for Azure resources are both identity-based authentication methods that do not require shared keys. Entra ID authentication uses OAuth 2.0 tokens to authorize access to Blob Storage, while managed identities provide an automatically managed identity in Entra ID for Azure resources, eliminating the need for developers to manage credentials. Both methods support role-based access control (RBAC) for fine-grained permissions.

Answer

Shared access signature (SAS) token

Answer

Storage account access keys

Answer

Client certificate-based authentication

Question 14

Which THREE Azure Storage features can be used to enforce immutability for compliance requirements?

Accepted Answer

Blob versioning with delete lock policy. Blob versioning with a delete lock policy prevents deletion of blob versions, effectively enforcing immutability by ensuring that once a version is created, it cannot be deleted or overwritten. This satisfies compliance requirements such as SEC 17a-4(f) or FINRA rules that mandate data preservation.

Answer

Soft delete for blobs

Answer

Storage account firewall rules

Question 15

Which Azure Blob Storage access tier is optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Cool. The Cool tier is optimized for infrequently accessed data and has a minimum storage duration of 30 days, matching both requirements. The Archive tier is for infrequently accessed data but requires a minimum storage duration of 180 days, so it does not meet the 30-day requirement. The Hot tier is for frequently accessed data. The Premium tier is for high-performance, frequently accessed data. 'Transactional' is not a standard Azure Blob Storage access tier. Therefore, among the given options, only Cool satisfies all criteria.

Answer

Transactional

Answer