AZ-204 Develop for Azure storage — Timed 15 Questions

Question 1

You are developing an IoT solution that stores device metadata (device ID, location, firmware version, last seen timestamp) in Azure Table Storage. Each device has a unique DeviceId and a Timestamp. You need to design the PartitionKey and RowKey to optimize query performance for the following query: Retrieve all firmware versions for devices in a specific city that were last seen within the last 24 hours. The query must be efficient (partition scan minimized). Which key design is most appropriate?

15 minute time limit — choose an answer to begin.

Accepted Answer

PartitionKey = City, RowKey = Inverted timestamp (e.g., DateTime.MaxValue.Ticks - Timestamp.Ticks). City as the PartitionKey groups all devices for a city in one partition. Use a zero-padded, fixed-length inverted timestamp such as (DateTime.MaxValue.Ticks - Timestamp.Ticks).ToString("D19") as the RowKey; this makes more recent timestamps sort as smaller RowKey values. To retrieve the last 24 hours efficiently, query the city partition for RowKey values between the inverted current timestamp (lower bound) and the inverted timestamp 24 hours ago (upper bound) — i.e., RowKey >= inverted(now) and RowKey <= inverted(now - 24h). Azure Table Storage can then perform a partitioned range scan instead of scanning all devices in the city.

Answer

PartitionKey = City, RowKey = DeviceId_Timestamp (e.g., "device123_2023-10-01T12:00:00")

Answer

PartitionKey = DeviceId, RowKey = Timestamp

Answer

PartitionKey = City, RowKey = DeviceId

Question 2

Match each Azure Storage access tier to its description.

Accepted Answer

Hot: Optimized for data that is accessed frequently, highest storage cost, lowest access cost.. Azure Blob Storage access tiers include Hot, Cool, Cold, and Archive. Hot is optimized for frequently accessed data and has the highest storage cost but the lowest access cost (Option A). Cool is optimized for infrequently accessed data stored for at least 30 days (Option C). Cold is optimized for infrequently accessed data stored for at least 90 days (Option E). Archive is optimized for rarely accessed data stored for at least 180 days (Option F). Therefore the correct options are A, C, E, and F.

Answer

Hot: Optimized for data that is infrequently accessed and stored for at least 30 days.

Answer

Cool: Optimized for rarely accessed data stored for at least 180 days.

Question 3

Which TWO of the following are valid ways to authenticate to Azure Blob Storage from an application? (Choose two.)

Accepted Answer

Storage account access key. Storage account access keys provide full administrative access to the storage account, including Blob Storage. Applications can authenticate by including the key in the Authorization header using the SharedKey scheme, which HMAC-SHA256 signs the request. Shared Access Signatures (SAS) tokens provide delegated access to specific resources in a storage account with granular permissions and a defined validity period, making them ideal for granting limited access to clients without exposing the account key. Both are standard, documented methods for authenticating to Azure Blob Storage from an application.

Answer

Microsoft account (personal) OAuth token

Answer

SQL Server authentication

Answer

Azure Cosmos DB primary key

Question 4

Which THREE of the following are true about Azure Storage queues? (Choose three.)

Accepted Answer

The maximum time-to-live for a message is 7 days.. Azure Storage queue messages have a configurable time-to-live (TTL) with a maximum value of 7 days. Messages are limited to 64 KB in size. The visibility timeout feature allows a consumer to temporarily hide a message from other consumers while it is being processed, preventing duplicate processing.

Answer

Messages are processed in strict FIFO order.

Answer

Messages can be up to 1 MB in size.

Question 5

Which TWO of the following are features of Azure Blob Storage lifecycle management? (Choose two.)

Accepted Answer

Automatically delete blobs after a specified number of days.. Azure Blob Storage lifecycle management policies allow you to define rules that automatically delete blobs or move them between access tiers (Hot, Cool, Archive) after a specified number of days. This is commonly used to enforce data retention policies, optimize costs by moving less frequently accessed data to cooler tiers, or clean up temporary data without manual intervention.

Answer

Automatically apply legal hold to blobs.

Answer

Automatically replicate blobs to another region.

Answer

Automatically encrypt blobs at rest.

Question 6

Which THREE of the following are valid methods for authenticating to Azure Blob Storage?

Accepted Answer

Shared access signature (SAS) token. Azure Blob Storage supports several authentication methods: Shared Key uses the storage account key; Shared Access Signatures (SAS) provide delegated, time-limited access; and Azure AD authentication (RBAC) provides identity-based access. Therefore, options B, C, and D are correct. A connection string is not a separate authentication method—it packages the account key—and client certificates are not a supported Blob Storage authentication method.

Answer

Connection string with account key

Answer

Client certificate authentication

Question 7

Which THREE of the following are true about Azure Blob Storage lifecycle management?

Accepted Answer

It can automatically move blobs to the Cool tier after a specified number of days.. Azure Blob Storage lifecycle management policies are defined at the storage account level and can be applied to General-purpose v2 and Blob storage accounts. They can automatically transition blobs between access tiers (e.g., Hot to Cool) and delete blobs, blob versions, or snapshots after a specified number of days, enabling cost optimization and data retention management.

Answer

It can be defined at the container level.

Answer

It can change the replication type of the storage account.

Question 8

Which TWO of the following are correct about Azure Cosmos DB consistency levels?

Accepted Answer

Strong consistency is available in all Azure regions.. Strong consistency is available in all Azure regions when the Cosmos DB account is configured to use it. However, it is important to note that Strong consistency cannot be combined with multi-region writes; it only supports a single write region. This ensures that all reads return the most recent write, but it comes at the cost of higher latency and reduced availability during regional outages. Additionally, Session consistency is the default consistency level for all new Azure Cosmos DB accounts, providing a good balance of consistency, availability, and performance for most applications.

Answer

Strong consistency provides the highest availability.

Answer

Bounded staleness consistency is the default consistency level.

Answer

Eventual consistency is the default consistency level for all new Cosmos DB accounts.

Question 9

You are designing a solution to store large amounts of log data that will be queried infrequently but must be retained for regulatory purposes for 7 years. The logs are append-only and do not need to be modified. You need to choose a cost-effective storage option. Which three Azure capabilities should you consider? (Choose three.)

Accepted Answer

Azure Blob Storage lifecycle management policy. Azure Blob Storage lifecycle management policy (B) is correct because it automates the transition of log data to cooler tiers (e.g., from Hot to Cool to Archive) and finally deletes it after 7 years, minimizing storage costs without manual intervention. This aligns with the requirement for infrequent querying and long-term retention. Azure Blob Storage with Cool access tier (C) is correct as it provides a cost-effective storage option for data that is accessed infrequently, which matches the log data's access pattern. Azure Blob Storage immutability policy (E) is correct because it enforces Write Once, Read Many (WORM) compliance, preventing modification or deletion of the log data for the required 7-year regulatory retention period, ensuring data integrity for append-only logs.

Answer

Azure Blob Storage soft delete

Answer

Azure Table Storage

Question 10

Refer to the exhibit. You run the Azure CLI command to check if blob encryption is enabled for a storage account. The command returns 'false'. However, you know that Azure Storage encrypts all data at rest by default. What is the explanation?

Accepted Answer

The property 'encryption.services.blob.enabled' refers to customer-managed key encryption, not the default encryption. The property 'encryption.services.blob.enabled' in the Azure CLI command 'az storage account show --query "encryption.services.blob.enabled"' returns 'true' for all Azure Storage accounts. This is because encryption for data at rest (using Microsoft-managed keys) is always enabled by default for the blob service and cannot be disabled. This property indicates that the blob service has encryption enabled, not whether customer-managed keys (CMK) are in use. To determine if CMK is configured, one would typically check the 'encryption.keySource' property, which would be 'Microsoft.Keyvault' if CMK is active, or 'Microsoft.Storage' if Microsoft-managed keys are in use. Therefore, the stem's premise that the command returns 'false' is incorrect, and the original explanation's assertion that 'encryption.services.blob.enabled' refers specifically to CMK is also incorrect.

Answer

The storage account was created with Azure Disk Encryption instead

Answer

The command is querying the wrong property; use 'encryption.requireInfrastructureEncryption'

Answer

The storage account is in a region that does not support encryption

Question 11

Which TWO of the following are valid approaches to secure access to Azure Blob Storage?

Accepted Answer

Use a Shared Access Signature (SAS) token. A Shared Access Signature (SAS) token provides delegated, time-limited access to specific Azure Blob Storage resources without exposing the storage account key. It allows you to grant granular permissions (read, write, delete) and enforce constraints like IP restrictions and allowed protocols (HTTPS only). This is a secure, recommended approach for sharing access with clients or third parties. Azure Role-Based Access Control (RBAC) allows you to assign specific roles (like Storage Blob Data Contributor, Storage Blob Data Reader) to Azure AD identities (users, groups, service principals, or managed identities) at various scopes (storage account, container, or blob). This provides a robust and scalable way to manage access based on the principle of least privilege, integrating directly with Azure's identity management system.

Answer

Use Azure Front Door to restrict access

Answer

Embed storage account keys in client code

Answer

Enable public blob access

Question 12

Which FOUR of the following are features of Azure Storage replication that provide high availability?

Accepted Answer

Locally redundant storage (LRS). Locally redundant storage (LRS), Zone-redundant storage (ZRS), Geo-redundant storage (GRS), and Geo-zone-redundant storage (GZRS) are all valid Azure Storage replication options that provide high availability and durability. LRS replicates data within a single datacenter. ZRS replicates data across multiple availability zones within a region. GRS replicates data to a secondary region. GZRS combines ZRS in the primary region with GRS to a secondary region, offering the highest level of availability and durability. Azure Content Delivery Network (CDN) is a content delivery service and not a storage replication mechanism.

Answer

Azure Content Delivery Network (CDN)

Question 13

Which TWO actions should you take to ensure data durability for a storage account using LRS? (Choose two.)

Accepted Answer

Enable soft delete for blobs.. Enabling soft delete for blobs protects data by retaining deleted blobs for a specified retention period, allowing recovery from accidental deletion or overwrite. Enabling blob versioning automatically saves previous versions of a blob when it's modified or deleted, allowing recovery to an earlier state. Both features directly enhance data durability within a single data center under LRS, as they provide additional layers of protection against user errors (accidental deletion or overwrite) beyond the three synchronous replicas provided by LRS.

Answer

Assign RBAC roles to users.

Answer

Change replication to GRS.

Answer

Configure network firewall rules.

Question 14

Which TWO Azure services can be used to trigger an Azure Function when a new blob is created in a storage account? (Choose two.)

Accepted Answer

Azure Event Grid trigger. Both Azure Event Grid and Azure Blob Storage triggers can be used to trigger an Azure Function when a new blob is created. Azure Blob Storage trigger is a native binding that directly monitors a specified blob container for new or updated blobs. Azure Event Grid provides a more advanced, event-driven integration where the function subscribes to 'Microsoft.Storage.BlobCreated' events from a storage account, offering lower latency and higher reliability for high-throughput scenarios compared to polling-based blob triggers.

Answer

Azure Cosmos DB trigger

Answer

Azure Queue Storage trigger

Answer

Azure Service Bus trigger

Question 15

A healthcare application stores patient diagnostic images in Azure Blob Storage. The images are accessed by radiologists worldwide. You need to reduce latency for image retrieval while maintaining security and compliance. Which TWO actions should you take?

Accepted Answer

Enable Azure CDN or Azure Front Door with caching rules.. Azure CDN or Azure Front Door (Option B) caches frequently accessed images at edge locations closer to radiologists worldwide, significantly reducing latency for image retrieval. Caching rules are essential for controlling cache duration and behavior. Additionally, using Azure Front Door with Private Link to the storage account (Option D) ensures that the connection from Front Door to the origin storage is secure and private, traversing the Azure backbone network instead of the public internet. This enhances security and compliance while also contributing to overall latency reduction by optimizing the origin fetch path.

Answer

Upgrade to Premium Block Blob storage.

Answer

Enable read-access geo-redundant storage (RA-GRS).

Answer

Use Blob Storage lifecycle management to delete blobs after reading.