AZ-204 Connect to and consume Azure services and third-party services Practice Test 10 — 15 Questions

Question 1

You are using Azure CLI to upload a blob using your Azure AD credentials (--auth-mode login). The command fails with an authorization error. What is the most likely cause?

Accepted Answer

The user does not have the 'Storage Blob Data Contributor' role on the storage account. When using `--auth-mode login` with Azure CLI, the operation relies on Azure AD role-based access control (RBAC). The user must be assigned a built-in role like 'Storage Blob Data Contributor' or 'Storage Blob Data Owner' on the storage account to authorize blob uploads. Without this role, the request fails with an authorization error because Azure AD has no permissions to grant access to the blob data plane.

Answer

The Azure CLI version is outdated

Answer

The storage account key is not provided

Answer

The container name does not exist

Question 2

A company is developing an application that processes orders. The application uses Azure Service Bus queues to decouple order submission from processing. During peak hours, some messages are not processed within the required time, causing order delays. The team needs to increase throughput without changing the existing message processing logic. What should they do?

Accepted Answer

Increase the number of concurrent listeners on the queue.. Increasing the number of concurrent listeners on the Service Bus queue allows multiple message receivers to process messages in parallel, directly increasing throughput without altering the existing message processing logic. This leverages the competing consumers pattern, where each listener independently receives and processes messages from the same queue, effectively scaling out the processing capacity.

Answer

Use Azure Event Hubs instead of Service Bus.

Answer

Enable sessions on the queue to group related messages.

Answer

Increase the lock duration on messages.

Question 3

A web app needs to access Azure Key Vault secrets for database credentials. The app runs as a managed identity in Azure App Service. Which authentication method should be used to retrieve secrets without storing credentials in the app code?

Accepted Answer

Managed identity. Managed identity is the correct authentication method because it allows the Azure App Service web app to authenticate to Azure Key Vault without storing any credentials in code or configuration. Azure automatically manages the identity, and the app uses a token from the Azure Instance Metadata Service (IMDS) endpoint to access Key Vault secrets. This aligns with the principle of zero-trust and eliminates the security risk of hardcoded secrets.

Answer

Access key

Answer

Client certificate

Answer

Shared access signature (SAS) token

Question 4

A company uses Azure Cosmos DB for a global e-commerce platform. They need to query product inventory across multiple regions with low latency. The data is partitioned by product category. Some queries filter on category and price range. What indexing policy should be configured to optimize these queries?

Accepted Answer

Create a composite index with (category, price).. A composite index on (category, price) allows Cosmos DB to efficiently satisfy queries that filter on both fields in a single index seek, avoiding a full scan. Composite indexes are designed for multi-property filters and sort orders, which directly matches the requirement to query by category and price range with low latency.

Answer

Use a wildcard index for all properties.

Answer

Add a hash index on category and a range index on price.

Answer

Enable spatial index on price.

Question 5

A developer is building a function app that processes messages from an Azure Storage queue. The function must scale automatically based on queue length. Which hosting plan supports this automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan is correct because it is a primary Azure Functions hosting plan that provides true automatic scaling based on event-driven triggers, such as queue length. In this plan, the Azure Functions host dynamically adds or removes instances, scaling from zero when idle, up to a maximum of 200 (default) based on the number of messages in the Storage queue. It uses a target-based scaling strategy that monitors queue depth and backlog, making it the default and most cost-effective option for workloads that need to scale to zero and burst to handle large message volumes. While the Premium plan also supports automatic scaling based on event triggers, it maintains at least one warm instance and does not scale to zero.

Answer

Premium plan

Answer

App Service plan

Answer

Azure Container Instances

Question 6

A company uses Azure API Management to expose APIs. They need to enforce rate limiting per subscription key and also allow a burst of requests for a short period. Which policy should they apply?

Accepted Answer

rate-limit-by-key. The `rate-limit-by-key` policy is correct because it allows rate limiting based on a specified key, such as a subscription key, and supports a burst configuration via the `renewal-period` and `retry-after` attributes. This policy enforces a per-key counter that resets after a defined period, enabling a burst of requests (e.g., 10 requests in 60 seconds) while still enforcing an overall limit.

Answer

limit-concurrency

Answer

rate-limit (per product)

Answer

rate-limit-by-ip

Question 7

A company integrates an Azure Logic App with Microsoft Teams to send notifications when a new file is added to an Azure Blob storage container. The Logic App currently polls the blob container every minute. They want to reduce latency and avoid polling. What should they do?

Accepted Answer

Add an Event Grid subscription to the blob storage.. Azure Event Grid provides a reactive, event-driven model that eliminates the need for polling. By subscribing to the Blob Storage 'BlobCreated' event, the Logic App is triggered instantly when a new file is added, reducing latency to near real-time. This aligns with the requirement to avoid polling and improve responsiveness.

Answer

Increase the polling frequency to every 10 seconds.

Answer

Use Azure Data Factory to monitor the storage.

Answer

Use Azure Service Bus topics for file notifications.

Question 8

A developer needs to store session state for a web app that runs on multiple instances behind a load balancer. The state must be persisted across restarts. Which Azure service should they use?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis is the correct choice because it provides a high-performance, in-memory data store that supports session state persistence across multiple web app instances behind a load balancer. It offers built-in session state providers for ASP.NET and ASP.NET Core, ensuring state is preserved across restarts and scale-out scenarios with low-latency access.

Answer

Azure Table Storage

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 9

A company has an Azure Service Bus namespace with a topic that receives high-throughput messages. They need to ensure that if a subscriber fails, messages are not lost and can be replayed. The subscriber is a client application that uses the PeekLock receive mode. What should they configure?

Accepted Answer

Enable dead-lettering on the subscription.. Dead-lettering on a subscription allows messages that cannot be processed by a subscriber to be moved to a dead-letter queue (DLQ) instead of being lost. When a subscriber using PeekLock mode fails to process a message (e.g., exceeds MaxDeliveryCount or the lock expires), the message is automatically transferred to the DLQ. This ensures messages are preserved and can be replayed later by reprocessing the DLQ, meeting the requirement for no message loss and replay capability.

Answer

Enable auto-forwarding on the subscription.

Answer

Set a SQL filter on the subscription.

Answer

Disable dead-lettering on the subscription.

Question 10

Which TWO Azure services can be used to trigger an Azure Function in response to a new blob being added to an Azure Storage account? (Choose two.)

Accepted Answer

Azure Blob Storage trigger. The Azure Blob Storage trigger is specifically designed to execute a function whenever a new or updated blob is detected in a storage container. It uses a polling mechanism to monitor the container and invokes the function with the blob's content and metadata as input. Option E is correct because an Azure Event Grid subscription can be configured to listen for the 'Microsoft.Storage.BlobCreated' event and route it to an Azure Function as an event-driven trigger, providing near-real-time, push-based notification without polling.

Answer

HTTP trigger

Answer

Queue trigger

Answer

Timer trigger

Question 11

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. The most likely cause is that the GitHub Actions workflow file is missing from the repository. The ARM template configures the web app to use GitHub Actions for deployment, but it does not create the workflow file. Without the workflow file in the repository at the path referenced (e.g., .github/workflows/), the deployment will not trigger on pull request merges. Option A is incorrect because isManualIntegration: false means automated deployment is expected. Option B is unlikely because the runtime stack is typically specified correctly in the ARM template. Option C is incorrect because the branch is set to main, which typically triggers deployments on merges to main.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.

Question 12

Refer to the exhibit. You are deploying an API in Azure API Management using an ARM template. The API is configured to use OAuth 2.0 authentication. The deployment fails with a validation error. What is the most likely cause?

Accepted Answer

The authorization server 'auth-server-1' is not defined in the template.. When an API in Azure API Management is configured to use OAuth 2.0 authentication, the ARM template must include a corresponding authorization server resource (type 'Microsoft.ApiManagement/service/authorizationServers') that defines the OAuth 2.0 provider. The API's authenticationSettings reference this authorization server by name, and if that server is not defined in the template, the deployment fails with a validation error indicating a missing dependency or undefined resource.

Answer

The serviceUrl is not a valid URL.

Answer

The dependsOn array uses resourceId incorrectly.

Answer

The protocols array does not include http.

Question 13

Refer to the exhibit. An Azure OpenAI Service account is deployed with this ARM template. After deployment, a developer tries to call the OpenAI endpoint from an Azure App Service that has no public IP. The request is blocked. What change should be made to allow access?

Accepted Answer

Configure a private endpoint for the OpenAI account.. The ARM template sets `networkAcls.defaultAction` to `Deny`, which blocks all traffic by default. Since the App Service has no public IP, it cannot be reached via IP-based rules. Configuring a private endpoint for the OpenAI account creates a private network connection over Azure's backbone, bypassing the public endpoint and allowing the App Service to access the OpenAI service securely without requiring a public IP.

Answer

Add a service tag for App Service in the ipRules.

Answer

Change the defaultAction to Allow.

Answer

Add the App Service's outbound IP address to the ipRules.

Question 14

You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?

Accepted Answer

DefaultAzureCredential. DefaultAzureCredential is the correct choice because it automatically chains multiple authentication sources, including managed identity, environment variables, and Visual Studio credentials. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will first attempt to authenticate using the managed identity endpoint, making it the most seamless and recommended approach for this scenario.

Answer

SharedAccessSignatureCredential

Answer

InteractiveBrowserCredential

Answer

ClientSecretCredential

Question 15

You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?

Accepted Answer

The Event Grid subscription does not have the required RBAC role on the function.. If the Azure Function app is secured with Azure AD authentication, and the Event Grid subscription is configured to use a managed identity for delivery, then that managed identity requires an appropriate RBAC role (e.g., 'Azure Function Data Sender' or a custom role allowing `Microsoft.Web/sites/functions/invoke/action`) on the function app to successfully invoke the function. Without this role, Event Grid cannot authorize its call to the function, even if the endpoint is network reachable. This is a common misconfiguration when the function is protected by Azure AD authentication.

Answer

The storage account has public network access disabled.

Answer

The AzureWebJobsStorage connection string is missing from the function app settings.

Answer

Blob versioning is not enabled on the storage account.