AZ-204 Connect to and consume Azure services and third-party services — 20 Questions

Question 1

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 2

Match each Azure caching service to its description.

Accepted Answer

Azure Cache for Redis: A distributed in-memory data store that supports caching, session state, and pub/sub messaging.. The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Answer

Azure Cache for Redis: A global content delivery network that accelerates static file delivery.

Answer

Azure CDN: A distributed in-memory cache that provides Redis-like functionality for session state.

Question 3

Which TWO services can be used to implement a publish-subscribe messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (C) natively implements a publish-subscribe pattern through topics and subscriptions, where each message published to a topic is delivered to all subscriptions that match the filtering rules. This allows multiple independent subscribers to receive the same message. Azure Event Grid (D) is also a publish-subscribe service, designed for event routing. Publishers send events to Event Grid, which then delivers them to multiple subscribers (event handlers) that have subscribed to specific event types or sources, enabling event-driven architectures.

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 4

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. To authenticate an Azure Function app to call Microsoft Graph API securely, three components are typically involved:
1.  **Azure Managed Identity (E)**: This is the recommended way for Azure resources like Function Apps to authenticate to services that support Microsoft Entra ID authentication, including Microsoft Graph. It provides an automatically managed identity for the Function App, eliminating the need to manage credentials directly.
2.  **Microsoft Entra ID app registration (B)**: While a Managed Identity creates a Service Principal in Microsoft Entra ID (visible under Enterprise Applications), the concept of an 'app registration' broadly refers to defining an application's identity and configuring its API permissions within Microsoft Entra ID. The Managed Identity's Service Principal must be granted the necessary Microsoft Graph API permissions within Microsoft Entra ID to access the API.
3.  **Azure Key Vault (D)**: Although Managed Identities eliminate the need to manage secrets for their own authentication to services like Microsoft Graph, Azure Functions often require other sensitive configuration data (e.g., connection strings, other API keys for different services). Azure Key Vault is the secure service for storing such secrets, and the Azure Function (using its Managed Identity) can securely access these secrets from Key Vault. Therefore, Key Vault is a critical component for a robust and secure Azure Function application, even if not directly for the Managed Identity's token acquisition for Graph.

Answer

Azure API Management

Answer

Azure SQL Database

Question 5

Which TWO approaches can be used to securely connect an Azure web app to an on-premises database without exposing it to the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway establishes an encrypted IPSec/IKE tunnel over the public internet between the Azure virtual network and the on-premises network, enabling secure site-to-site connectivity. Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, bypassing the public internet entirely. Both approaches allow an Azure web app to securely connect to an on-premises database through the virtual network without exposing the database to the internet, maintaining security and compliance.

Answer

Azure API Management

Answer

Public IP address with firewall rules

Answer

Azure App Service Hybrid Connections

Question 6

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. The WS-Security UsernameToken must be added as an XML element within the <soap:Header> section of the SOAP message, which is part of the HTTP request body. To achieve this in Azure API Management, policies like 'set-body' or 'find-and-replace' are typically used to modify the XML content of the request body before it is sent to the backend SOAP service. The 'set-header' policy is designed for manipulating HTTP headers, not for modifying the internal structure of the SOAP message body.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 7

Which TWO are valid ways to authenticate to Azure Service Bus from an application? (Choose two.)

Accepted Answer

Using Azure AD and a managed identity.. Azure Service Bus supports authentication via Azure AD, which allows applications to use a managed identity (either system-assigned or user-assigned) to obtain an OAuth 2.0 token. This eliminates the need for hard-coded secrets and provides a secure, identity-based authentication mechanism integrated with Azure RBAC. Additionally, Service Bus supports authentication using a connection string that includes a Shared Access Signature (SAS) key, which grants specific permissions to access Service Bus entities.

Answer

Using an X.509 certificate directly in the connection string.

Answer

Using a connection string with a SAS key from Azure Event Hubs.

Answer

Using a storage account access key.

Question 8

Which THREE are benefits of using Azure API Management for consuming third-party APIs? (Choose three.)

Accepted Answer

Transforming request and response formats (e.g., XML to JSON).. Azure API Management offers several benefits when consuming third-party APIs. It can transform request and response formats (e.g., XML to JSON) using policies, adapting the third-party API's data format to your application's requirements. It also allows for implementing rate limiting and throttling policies to manage consumption and avoid exceeding third-party API quotas. Furthermore, APIM can cache responses, significantly reducing latency for consumers and decreasing the load on the external API.

Answer

Automatically scaling the third-party API based on demand.

Answer

Providing a global load balancer for the third-party API.

Question 9

Which TWO are correct ways to securely store and access secrets for Azure Functions? (Choose two.)

Accepted Answer

Use a Key Vault reference in the Function App settings.. Azure Functions can use Key Vault references in Application Settings to securely reference secrets stored in Azure Key Vault. This allows the function to retrieve secrets at runtime without storing them in code or configuration files, leveraging managed identities for authentication and authorization. Additionally, secrets can be stored directly in Function App Application Settings, which are encrypted at rest by Azure and protected by Azure RBAC, providing a secure storage mechanism.

Answer

Use Environment.ExpandEnvironmentVariables in the code.

Answer

Store secrets in the Function App code as constants.

Answer

Store secrets in a local.settings.json file and deploy it.

Question 10

You run the following PowerShell script to upload a blob to Azure Storage:

```powershell
$context = New-AzStorageContext -StorageAccountName 'mystorageaccount' -StorageAccountKey 'fakekey...'
Set-AzStorageBlobContent -Context $context -Container 'mycontainer' -Blob 'myblob' -File 'This is the file content'
```

The script fails with an error.

Which part of the script is causing the failure?

Accepted Answer

The -File parameter should be a file path, not a string.. The script fails because the `-File` parameter of `Set-AzStorageBlobContent` expects a local file path, but the script passes raw content as a string literal. The cmdlet cannot find a file with that path, so it throws an error.

Answer

The storage account name 'mystorageaccount' is invalid.

Answer

The connection string format is incorrect.

Answer

The container name 'mycontainer' does not exist.

Question 11

Which TWO authentication mechanisms can be used to authenticate an Azure Function to Azure Storage?

Accepted Answer

Storage account connection string with account key. Azure Functions can authenticate to Azure Storage using a storage account connection string with account key, which is used by built-in bindings and the Functions host. System-assigned managed identity is also supported and is the recommended secure option: the function app gets an Azure AD identity and is granted Azure RBAC roles on the storage account. Client certificates (A) are not a direct Azure Storage authentication mechanism for Functions bindings. SAS tokens (B) are valid for ad hoc access to Storage, but are not used by the built-in Functions runtime bindings, which require a connection string or identity-based connection. Azure AD tokens acquired via client credentials flow (D) can authenticate to Storage in custom code, but the Functions host and bindings use managed identity or connection strings rather than a manually acquired token.

Answer

Client certificate

Answer

Shared access signature (SAS) token

Answer

Azure AD token acquired via client credentials flow

Question 12

You are deploying this ARM template. After deployment, you want to ensure that all traffic to the storage account uses HTTPS. However, you notice that HTTP requests are still accepted. What is the most likely reason?

Accepted Answer

The property 'supportsHttpsTrafficOnly' is misspelled. The ARM template property 'supportsHttpsTrafficOnly' (or 'enableHttpsTrafficOnly') enforces that all requests to the storage account must use HTTPS. If this property is set to 'true', any requests made over HTTP will be rejected, regardless of the storage account's network firewall rules (IP addresses or virtual networks). Network rules control *who* can access the storage account, not *which protocol* they must use. If HTTP requests are still accepted after deployment, it indicates that the 'supportsHttpsTrafficOnly' property was not effectively enabled or configured correctly in the ARM template.

Answer

The storage account's network rules allow HTTP traffic from certain IP addresses

Answer

The property should be set on the blob service, not the storage account

Answer

The API version does not support this property

Question 13

A company runs a microservices application on Azure Kubernetes Service (AKS). One service needs to securely access an Azure SQL Database. The solution should avoid storing connection strings in code or configuration. What should they use?

Accepted Answer

Azure AD Pod Identity (aad-pod-identity). The provided explanation accurately describes the functionality and benefits of Azure AD Workload Identity. However, it does not justify the specific technology named in option D ('Azure AD Pod Identity'), which is outdated. The explanation should either be updated to accurately describe Azure AD Pod Identity, or option D should be updated to 'Azure AD Workload Identity' to align with the explanation and current best practices.

Answer

Azure Key Vault with a secret store CSI driver

Answer

Virtual machine managed identity

Answer

Kubernetes secrets

Question 14

Which TWO Azure services can be used to implement a pub/sub messaging pattern for decoupling microservices? (Choose two.)

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics provide enterprise-grade pub/sub messaging, allowing multiple subscriptions to receive copies of messages sent to a topic, each acting as an independent queue for decoupled microservices. Azure Event Grid is an event routing service that also implements a pub/sub pattern, enabling event producers to publish events and multiple subscribers to react to them, effectively decoupling microservices through event-driven architectures.

Answer

Azure Storage Queue

Answer

Azure Event Hubs

Answer

Azure Logic Apps

Question 15

Which THREE actions should be taken to secure an Azure App Service web app that accesses an Azure SQL Database? (Choose three.)

Accepted Answer

Enable Managed Identity for the App Service.. Enabling Managed Identity for an App Service (B) allows it to authenticate to Azure SQL Database without storing credentials in code or configuration. The identity is managed by Azure AD, and the app can obtain an access token to connect to the database, eliminating the need for a connection string with a username and password. For any other secrets or connection strings that cannot leverage Managed Identity, using Azure Key Vault (C) to store them and referencing them from the app is a best practice, ensuring secrets are not directly exposed in application settings. Finally, configuring the Azure SQL Database firewall to allow Azure services (D) ensures that only traffic originating from Azure (including your App Service) can reach the database, providing a crucial layer of network security.

Answer

Store the connection string in App Service application settings.

Answer

Disable TLS 1.2 on the App Service.

Question 16

Which TWO services can be used to implement a pub/sub messaging pattern in Azure? (Choose two.)

Accepted Answer

Azure Service Bus topics. Azure Service Bus topics support a publish/subscribe pattern through the use of topics and subscriptions. A publisher sends messages to a topic, and each subscription can independently receive a copy of those messages, enabling fan-out delivery to multiple consumers. Azure Event Grid is also a pub/sub service, designed for event-driven architectures. It allows publishers to send events to topics, and multiple event handlers (subscribers) can receive and react to those events independently, providing highly scalable event routing and fan-out capabilities.

Answer

Azure Logic Apps

Answer

Azure Queue Storage

Answer

Azure Data Lake Storage

Question 17

Your company has an Azure Logic App that processes orders by calling a third-party REST API using an HTTP trigger. Recently, the API provider changed their authentication to require OAuth 2.0 with client credentials. The Logic App currently uses a basic authentication header. What should you do to update the Logic App?

Accepted Answer

Use Azure API Management to proxy the API and add OAuth support. Option C is incorrect because the 'Active Directory OAuth' authentication in Logic Apps is used for authenticating to services protected by Microsoft Entra ID (Azure AD) using the Logic App's managed identity. It does not support obtaining tokens from an arbitrary third-party OAuth 2.0 provider via client credentials flow. For a generic third-party API, the Logic App would need to implement a multi-step process to first acquire a token from the third-party's token endpoint and then use it. Option A, using Azure API Management, is a valid architectural solution. API Management can be configured to handle the OAuth 2.0 client credentials flow, acquiring a token from the third-party provider and injecting it into requests to the backend API, thus centralizing authentication logic. Options B and D are incorrect as they do not address the authentication requirement securely or relevantly.

Answer

Add the client ID and client secret as query parameters

Answer

Configure the Logic App to use a managed identity and update the HTTP action authentication to 'Active Directory OAuth'

Answer

Replace the HTTP trigger with a Service Bus queue

Question 18

Your organization uses Azure API Management (APIM) to expose internal APIs to external partners. You need to ensure that only partners with a valid subscription key can access the APIs. Additionally, you want to log all requests for auditing. Which APIM policy should you implement?

Accepted Answer

Apply a policy and a policy. Subscription key validation is a built-in feature of Azure API Management, enforced at the product level when an API is associated with a product that requires a subscription; therefore, no specific policy is needed for this requirement. For logging all requests for auditing, the policy is the correct choice. Option A suggests applying a policy, which is used for validating JSON Web Tokens, not subscription keys. Since the stem specifically asks for subscription key validation, and this is handled inherently by APIM without a policy, and is inappropriate, Option A is incorrect. No provided option fully and correctly addresses both requirements as stated in the stem.

Answer

Apply an <ip-filter> policy

Answer

Apply a <rate-limit> policy

Answer

Apply a <cors> policy

Question 19

Which TWO authentication methods can be used to connect an Azure App Service to an Azure SQL Database without storing connection strings in code or configuration files?

Accepted Answer

System-assigned managed identity. System-assigned managed identity (D) and User-assigned managed identity (E) are both correct. Managed identities allow Azure App Services to authenticate to Azure SQL Database using Azure AD authentication without storing any secrets or connection strings in code or configuration files. These identities are automatically managed by Azure (system-assigned) or created and assigned by the user (user-assigned), enabling secure, passwordless connections via token-based authentication to Azure services.

Answer

Client certificate installed on the App Service

Answer

Storage account access key

Answer

SQL Server authentication (username and password)

Question 20

A company wants to send email notifications from an Azure Function app. The function app runs on a Consumption plan. Which service should be used to send emails?

Accepted Answer

Azure Communication Services. SendGrid is a third-party email delivery service that integrates directly with Azure Functions via an output binding or API, making it a simple and cost-effective option for sending emails from a Consumption plan function app. It handles SMTP relay, deliverability, and scaling. Azure Communication Services (ACS) also now offers an Email service, which is a first-party Azure solution for sending emails, making it another viable option for this scenario. Both services align well with the Consumption plan's pay-per-use model.

Answer

Azure Logic Apps

Answer

Microsoft Graph API