AZ-204 Connect to and consume Azure services and third-party services — 10 Questions

Question 1

You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Service Bus.. Azure Service Bus is the correct choice because it supports exactly-once delivery through duplicate detection and can fan out notifications to multiple subscribers using topics and subscriptions. It also provides built-in retry logic on failures. While Event Grid offers at-least-once delivery, only Service Bus can guarantee exactly-once when properly configured.

Answer

Azure Event Grid.

Answer

Azure Notification Hubs.

Answer

Azure Queue Storage.

Question 2

Your company uses Azure Logic Apps to automate workflows. A workflow must call an external REST API that requires an API key in the header. You need to securely store the API key and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use the Key Vault connector to retrieve it dynamically in the Logic App.. Azure Key Vault provides a secure, centralized store for secrets like API keys, and the Logic App Key Vault connector retrieves the key at runtime without exposing it in the workflow definition. This approach ensures the secret is never stored in plain text within the Logic App's JSON definition or source control, aligning with Azure security best practices for managed identities and access policies.

Answer

Store the API key in plain text directly in the Logic App HTTP action header.

Answer

Store the API key in an App Service application setting and reference it using the 'appsetting' expression.

Answer

Create an Azure Function with the API key hardcoded as an environment variable and call it from the Logic App.

Question 3

You are building an Azure Logic App that needs to call an external HTTP API secured with OAuth 2.0 Client Credentials flow. The client ID and client secret are stored in Azure Key Vault. You need to obtain an access token and include it in the Authorization header of each request. Which combination of actions should you use within the Logic App?

Accepted Answer

Use an HTTP action with the OAuth 2.0 authentication type. Set the client secret parameter to a secure reference to the Key Vault secret.. The HTTP action in Azure Logic Apps natively supports the OAuth 2.0 authentication type, which can directly handle the Client Credentials flow. By setting the client secret parameter to a secure reference (e.g., `@Microsoft.KeyVault(SecretUri=...)`) pointing to the secret stored in Azure Key Vault, you avoid exposing credentials in the workflow definition. The Logic Apps runtime automatically retrieves the secret from Key Vault, obtains an access token from the token endpoint, and includes it in the Authorization header of each request without requiring custom token management.

Answer

Use two HTTP actions: first, call the token endpoint with credentials to get a token, then use the token in the second action. Store credentials in a string variable.

Answer

Use the HTTP action with managed identity authentication.

Answer

Use the 'Invoke an Microsoft Entra ID protected API' connector with the client credentials grant type.

Question 4

You are developing a worker role that processes events from an Azure Event Hub. The worker runs on multiple virtual machines to ensure high availability. Each partition of the Event Hub should be processed by only one instance at a time, and events from the same partition must be processed in order. You need to manage partition leasing and checkpointing efficiently. Which Azure SDK class should you use?

Accepted Answer

EventProcessorHost. The EventProcessorHost (EPH) class is designed specifically for scenarios requiring distributed processing of Event Hub partitions across multiple instances. It manages partition leasing to ensure each partition is processed by only one instance at a time, handles checkpointing to track progress, and guarantees ordered processing within a partition. This makes it the correct choice for high-availability worker roles that must avoid duplicate processing and maintain event order.

Answer

EventHubClient

Answer

PartitionReceiver

Answer

EventHubConsumerClient

Question 5

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue is correct because it allows the function to handle transient failures safely by automatically moving messages that exceed the maximum number of delivery attempts to a dead-letter queue. This prevents infinite retries and ensures that problematic messages are isolated for manual inspection, while the function can continue processing other messages without blocking. The max delivery count setting in Azure Service Bus controls how many times a message is delivered before being dead-lettered, which is essential for managing transient failures without losing data.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 6

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on the subscription key. This directly protects backend services from excessive traffic by enforcing per-subscription call rates and quotas, which aligns with the requirement to throttle clients by subscription.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 7

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 8

Match each Azure caching service to its description.

Accepted Answer

Azure Cache for Redis: A distributed in-memory data store that supports caching, session state, and pub/sub messaging.. The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Answer

Azure Cache for Redis: A global content delivery network that accelerates static file delivery.

Answer

Azure CDN: A distributed in-memory cache that provides Redis-like functionality for session state.

Question 9

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

Accepted Answer

Store in Azure Key Vault. Azure Key Vault is the correct choice because it is purpose-built for securely storing secrets like OAuth2 client secrets, with encryption at rest, access policies, RBAC, and auditing. The Function app can retrieve the secret at runtime using its Managed Identity, so the secret never appears in code or configuration files. This satisfies the security requirement for the client credentials flow.

Answer

Store in application settings as environment variable

Answer

Store in Azure App Configuration

Answer

Use Managed Identity

Question 10

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. Option B (Microsoft Entra ID app registration) is required because Microsoft Graph API is protected by the Microsoft identity platform, so the Function app must authenticate against an app registration that defines the client identity, permissions (such as Microsoft Graph application or delegated permissions), and credentials. Option E (Azure Managed Identity) is correct because it lets the Function app obtain tokens from Microsoft Entra ID without storing secrets, and the managed identity's service principal can be granted Microsoft Graph permissions. Option D (Azure Key Vault) is correct because when a client secret or certificate is used instead of managed identity, the secret must be stored and retrieved securely, which is the standard role of Key Vault in this scenario. Option A (Azure API Management) is not required because API Management is an API gateway for publishing, securing, and monitoring APIs, not a prerequisite for a Function app to authenticate to Microsoft Graph. Option C (Azure SQL Database) is not required because it is a relational database service unrelated to obtaining or managing Microsoft Graph authentication credentials.

Answer

Azure API Management

Answer

Azure SQL Database