AZ-204 Connect to and consume Azure services and third-party services — 15 Questions

Question 1

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 2

Match each Azure caching service to its description.

Accepted Answer

Azure Cache for Redis: A distributed in-memory data store that supports caching, session state, and pub/sub messaging.. The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Answer

Azure Cache for Redis: A global content delivery network that accelerates static file delivery.

Answer

Azure CDN: A distributed in-memory cache that provides Redis-like functionality for session state.

Question 3

Which TWO services can be used to implement a publish-subscribe messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (C) natively implements a publish-subscribe pattern through topics and subscriptions, where each message published to a topic is delivered to all subscriptions that match the filtering rules. This allows multiple independent subscribers to receive the same message. Azure Event Grid (D) is also a publish-subscribe service, designed for event routing. Publishers send events to Event Grid, which then delivers them to multiple subscribers (event handlers) that have subscribed to specific event types or sources, enabling event-driven architectures.

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 4

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. To authenticate an Azure Function app to call Microsoft Graph API securely, three components are typically involved:
1.  **Azure Managed Identity (E)**: This is the recommended way for Azure resources like Function Apps to authenticate to services that support Microsoft Entra ID authentication, including Microsoft Graph. It provides an automatically managed identity for the Function App, eliminating the need to manage credentials directly.
2.  **Microsoft Entra ID app registration (B)**: While a Managed Identity creates a Service Principal in Microsoft Entra ID (visible under Enterprise Applications), the concept of an 'app registration' broadly refers to defining an application's identity and configuring its API permissions within Microsoft Entra ID. The Managed Identity's Service Principal must be granted the necessary Microsoft Graph API permissions within Microsoft Entra ID to access the API.
3.  **Azure Key Vault (D)**: Although Managed Identities eliminate the need to manage secrets for their own authentication to services like Microsoft Graph, Azure Functions often require other sensitive configuration data (e.g., connection strings, other API keys for different services). Azure Key Vault is the secure service for storing such secrets, and the Azure Function (using its Managed Identity) can securely access these secrets from Key Vault. Therefore, Key Vault is a critical component for a robust and secure Azure Function application, even if not directly for the Managed Identity's token acquisition for Graph.

Answer

Azure API Management

Answer

Azure SQL Database

Question 5

Which TWO approaches can be used to securely connect an Azure web app to an on-premises database without exposing it to the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway establishes an encrypted IPSec/IKE tunnel over the public internet between the Azure virtual network and the on-premises network, enabling secure site-to-site connectivity. Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, bypassing the public internet entirely. Both approaches allow an Azure web app to securely connect to an on-premises database through the virtual network without exposing the database to the internet, maintaining security and compliance.

Answer

Azure API Management

Answer

Public IP address with firewall rules

Answer

Azure App Service Hybrid Connections

Question 6

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. The WS-Security UsernameToken must be added as an XML element within the <soap:Header> section of the SOAP message, which is part of the HTTP request body. To achieve this in Azure API Management, policies like 'set-body' or 'find-and-replace' are typically used to modify the XML content of the request body before it is sent to the backend SOAP service. The 'set-header' policy is designed for manipulating HTTP headers, not for modifying the internal structure of the SOAP message body.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 7

Which TWO are valid ways to authenticate to Azure Service Bus from an application? (Choose two.)

Accepted Answer

Using Azure AD and a managed identity.. Azure Service Bus supports authentication via Azure AD, which allows applications to use a managed identity (either system-assigned or user-assigned) to obtain an OAuth 2.0 token. This eliminates the need for hard-coded secrets and provides a secure, identity-based authentication mechanism integrated with Azure RBAC. Additionally, Service Bus supports authentication using a connection string that includes a Shared Access Signature (SAS) key, which grants specific permissions to access Service Bus entities.

Answer

Using an X.509 certificate directly in the connection string.

Answer

Using a connection string with a SAS key from Azure Event Hubs.

Answer

Using a storage account access key.

Question 8

Which THREE are benefits of using Azure API Management for consuming third-party APIs? (Choose three.)

Accepted Answer

Transforming request and response formats (e.g., XML to JSON).. Azure API Management offers several benefits when consuming third-party APIs. It can transform request and response formats (e.g., XML to JSON) using policies, adapting the third-party API's data format to your application's requirements. It also allows for implementing rate limiting and throttling policies to manage consumption and avoid exceeding third-party API quotas. Furthermore, APIM can cache responses, significantly reducing latency for consumers and decreasing the load on the external API.

Answer

Automatically scaling the third-party API based on demand.

Answer

Providing a global load balancer for the third-party API.

Question 9

Which TWO are correct ways to securely store and access secrets for Azure Functions? (Choose two.)

Accepted Answer

Use a Key Vault reference in the Function App settings.. Azure Functions can use Key Vault references in Application Settings to securely reference secrets stored in Azure Key Vault. This allows the function to retrieve secrets at runtime without storing them in code or configuration files, leveraging managed identities for authentication and authorization. Additionally, secrets can be stored directly in Function App Application Settings, which are encrypted at rest by Azure and protected by Azure RBAC, providing a secure storage mechanism.

Answer

Use Environment.ExpandEnvironmentVariables in the code.

Answer

Store secrets in the Function App code as constants.

Answer

Store secrets in a local.settings.json file and deploy it.

Question 10

You run the following PowerShell script to upload a blob to Azure Storage:

```powershell
$context = New-AzStorageContext -StorageAccountName 'mystorageaccount' -StorageAccountKey 'fakekey...'
Set-AzStorageBlobContent -Context $context -Container 'mycontainer' -Blob 'myblob' -File 'This is the file content'
```

The script fails with an error.

Which part of the script is causing the failure?

Accepted Answer

The -File parameter should be a file path, not a string.. The script fails because the `-File` parameter of `Set-AzStorageBlobContent` expects a local file path, but the script passes raw content as a string literal. The cmdlet cannot find a file with that path, so it throws an error.

Answer

The storage account name 'mystorageaccount' is invalid.

Answer

The connection string format is incorrect.

Answer

The container name 'mycontainer' does not exist.

Question 11

Which TWO authentication mechanisms can be used to authenticate an Azure Function to Azure Storage?

Accepted Answer

Storage account connection string with account key. Azure Functions can authenticate to Azure Storage using a storage account connection string with account key, which is used by built-in bindings and the Functions host. System-assigned managed identity is also supported and is the recommended secure option: the function app gets an Azure AD identity and is granted Azure RBAC roles on the storage account. Client certificates (A) are not a direct Azure Storage authentication mechanism for Functions bindings. SAS tokens (B) are valid for ad hoc access to Storage, but are not used by the built-in Functions runtime bindings, which require a connection string or identity-based connection. Azure AD tokens acquired via client credentials flow (D) can authenticate to Storage in custom code, but the Functions host and bindings use managed identity or connection strings rather than a manually acquired token.

Answer

Client certificate

Answer

Shared access signature (SAS) token

Answer

Azure AD token acquired via client credentials flow

Question 12

You are deploying this ARM template. After deployment, you want to ensure that all traffic to the storage account uses HTTPS. However, you notice that HTTP requests are still accepted. What is the most likely reason?

Accepted Answer

The property 'supportsHttpsTrafficOnly' is misspelled. The ARM template property 'supportsHttpsTrafficOnly' (or 'enableHttpsTrafficOnly') enforces that all requests to the storage account must use HTTPS. If this property is set to 'true', any requests made over HTTP will be rejected, regardless of the storage account's network firewall rules (IP addresses or virtual networks). Network rules control *who* can access the storage account, not *which protocol* they must use. If HTTP requests are still accepted after deployment, it indicates that the 'supportsHttpsTrafficOnly' property was not effectively enabled or configured correctly in the ARM template.

Answer

The storage account's network rules allow HTTP traffic from certain IP addresses

Answer

The property should be set on the blob service, not the storage account

Answer

The API version does not support this property

Question 13

A company runs a microservices application on Azure Kubernetes Service (AKS). One service needs to securely access an Azure SQL Database. The solution should avoid storing connection strings in code or configuration. What should they use?

Accepted Answer

Azure AD Pod Identity (aad-pod-identity). The provided explanation accurately describes the functionality and benefits of Azure AD Workload Identity. However, it does not justify the specific technology named in option D ('Azure AD Pod Identity'), which is outdated. The explanation should either be updated to accurately describe Azure AD Pod Identity, or option D should be updated to 'Azure AD Workload Identity' to align with the explanation and current best practices.

Answer

Azure Key Vault with a secret store CSI driver

Answer

Virtual machine managed identity

Answer

Kubernetes secrets

Question 14

Which TWO Azure services can be used to implement a pub/sub messaging pattern for decoupling microservices? (Choose two.)

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics provide enterprise-grade pub/sub messaging, allowing multiple subscriptions to receive copies of messages sent to a topic, each acting as an independent queue for decoupled microservices. Azure Event Grid is an event routing service that also implements a pub/sub pattern, enabling event producers to publish events and multiple subscribers to react to them, effectively decoupling microservices through event-driven architectures.

Answer

Azure Storage Queue

Answer

Azure Event Hubs

Answer

Azure Logic Apps

Question 15

Which THREE actions should be taken to secure an Azure App Service web app that accesses an Azure SQL Database? (Choose three.)

Accepted Answer

Enable Managed Identity for the App Service.. Enabling Managed Identity for an App Service (B) allows it to authenticate to Azure SQL Database without storing credentials in code or configuration. The identity is managed by Azure AD, and the app can obtain an access token to connect to the database, eliminating the need for a connection string with a username and password. For any other secrets or connection strings that cannot leverage Managed Identity, using Azure Key Vault (C) to store them and referencing them from the app is a best practice, ensuring secrets are not directly exposed in application settings. Finally, configuring the Azure SQL Database firewall to allow Azure services (D) ensures that only traffic originating from Azure (including your App Service) can reach the database, providing a crucial layer of network security.

Answer

Store the connection string in App Service application settings.

Answer

Disable TLS 1.2 on the App Service.