AZ-204 Connect to and consume Azure services and third-party services Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. You are deploying an ARM template that includes the above network security group rule. The rule is intended to block all outbound internet traffic from a virtual network. However, after deployment, virtual machines in the subnet still have outbound internet access. What is the most likely reason?

Accepted Answer

The network security group is not associated with the subnet or network interface.. Option C is correct because the rule has a priority of 100, which is a high priority number (lowest priority). By default, Azure NSGs allow outbound internet traffic with a default rule (AllowInternetOutbound) that has a priority of 65001. Since 100 is lower than 65001, the deny rule should take precedence. However, the issue is that the rule uses 'VirtualNetwork' as the source address prefix, which means it only applies to traffic from the virtual network itself, not to traffic originating from VMs. Actually, the exhibit shows sourceAddressPrefixes as 'VirtualNetwork', which is correct for traffic from the VNet. But the problem is that the rule's priority is 100, which is higher than the default allow rule (65001), so it should work. Wait, let's re-evaluate: priority numbers are lower = higher priority. A priority of 100 means it is evaluated before the default rule (65001). So the rule should block outbound internet. However, the rule might not be applied because the NSG is not associated with the subnet or NIC. But the exhibit only shows the rule definition. The most likely reason from the options is that the NSG is not associated with the subnet or NIC. Option A is wrong because priority 100 is higher than default rules. Option B is wrong because the rule does apply to VMs in the VNet. Option D is wrong because the rule does not need to specify source port ranges. So Option C is correct.

Answer

The destination port range '*' is invalid; you must specify explicit ports.

Answer

The source address prefix should be '*' instead of 'VirtualNetwork'.

Answer

The rule priority is too low; it should be lower than the default allow rule.

Question 2

Refer to the exhibit. You run the above Azure CLI command to upload a blob to Azure Blob Storage. The command fails with the error 'This request is not authorized to perform this operation.' You have verified that the storage account name and container name are correct, and the file exists. What should you do to resolve the error?

Accepted Answer

Provide the storage account key using the --account-key parameter or set the AZURE_STORAGE_KEY environment variable.. Option D is correct because the --auth-mode key option uses the storage account key for authentication. However, the error indicates that the request is not authorized, which typically means the key is missing or invalid. By default, the CLI uses Azure AD authentication. To use key authentication, you must provide the account key either via the --account-key parameter or set the AZURE_STORAGE_KEY environment variable. The command as shown does not include the key, so it fails. Option A is wrong because upgrading the CLI version does not fix missing credentials. Option B is wrong because the --auth-mode key is correct for key-based auth, but the key itself is missing. Option C is wrong because SAS is not required; key auth should work.

Answer

Generate a shared access signature (SAS) and use it instead of key.

Answer

Change --auth-mode key to --auth-mode login.

Answer

Upgrade to the latest version of Azure CLI.

Question 3

Refer to the exhibit. You are configuring Azure Monitor autoscale for a virtual machine scale set using the above JSON metric configuration. The autoscale rule is supposed to scale out when average memory usage exceeds 80%. However, autoscale is not triggering even when memory usage is consistently above 90%. What is the most likely cause?

Accepted Answer

The autoscale rule condition is not configured to use this metric.. Option B is correct because the exhibit shows that the aggregation interval is set to 00:05:00 (5 minutes) and the aggregation type is Average. Autoscale rules use the aggregated metric over the specified duration. If the duration is not configured correctly, the rule may not trigger. However, a common issue is that the memory metric is not available or not collected. But from the exhibit, it seems the metric is defined. Another possibility is that the autoscale rule's threshold is defined in a separate configuration. The exhibit only shows the metric definition, not the actual autoscale rule condition. The most likely cause from the options is that the autoscale rule is not associated with the scale set or the metric is not being emitted. Option A is wrong because the aggregation interval is 5 minutes, which is valid. Option C is wrong because the aggregation type is Average, which is appropriate. Option D is wrong because the metric name is 'MemoryPercent', which is a valid metric for VMs (if collected). However, the exhibit does not show the autoscale rule condition; it only shows the metric configuration for a custom metric. The actual autoscale rule might be missing or misconfigured. Based on the options, Option B is the most plausible: the autoscale rule might not be configured to use this metric, or the metric source is not set.

Answer

The aggregation interval is too long; it should be set to 1 minute.

Answer

The metric name is incorrect; it should be 'Percentage Memory'.

Answer

The aggregation type should be 'Maximum' instead of 'Average'.

Question 4

Which TWO services can be used to implement a pub/sub messaging pattern in Azure? (Choose two.)

Accepted Answer

Azure Service Bus topics. Options A and D are correct. Azure Service Bus topics support pub/sub with multiple subscriptions. Azure Event Grid also supports pub/sub with multiple subscribers. Option B is wrong because Azure Queue Storage is a point-to-point queue, not pub/sub. Option C is wrong because Azure Data Lake Storage is a storage service. Option E is wrong because Azure Logic Apps is an integration service, not a messaging service.

Answer

Azure Logic Apps

Answer

Azure Queue Storage

Answer

Azure Data Lake Storage

Question 5

Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)

Accepted Answer

Grant the managed identity the 'Key Vault Secrets User' role.. Options A, B, and D are correct. Enable managed identity on the App Service to authenticate without secrets. Grant the managed identity the Key Vault Secrets User role to read secrets. Use the DefaultAzureCredential class in code to automatically use the managed identity. Option C is wrong because storing the connection string in app settings exposes the secret. Option E is wrong because network restrictions are not required for security; managed identity and RBAC are sufficient.

Answer

Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.

Answer

Store the Key Vault URL and a client secret in App Service application settings.

Question 6

Which THREE are best practices for implementing an API using Azure API Management? (Choose three.)

Accepted Answer

Use policies to enforce throttling and quotas.. Options A, C, and D are correct. Use subscription keys to authenticate and rate-limit clients. Implement caching to reduce backend load and improve response times. Use policies to enforce throttling and quotas. Option B is wrong because exposing internal service URLs directly bypasses API Management's security and management features. Option E is wrong because the consumption tier does not support custom domains; for custom domains, you need a higher tier.

Answer

Use the Consumption tier for production APIs with custom domains.

Answer

Expose the backend service URLs directly to clients.

Question 7

You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?

Accepted Answer

Use a system-assigned managed identity. Managed identities provide an automatically managed identity in Microsoft Entra ID for the Azure Functions app to authenticate to Key Vault without storing credentials in code. Option A is wrong because client certificates require certificate management. Option B is wrong because connection strings are not used for authentication to Key Vault. Option D is wrong because access keys are for storage accounts, not Key Vault.

Answer

Use a client certificate stored in the function app

Answer

Use the Key Vault connection string from app settings

Answer

Use the storage account access key from the function app

Question 8

Your company has an Azure Logic App that processes orders by calling a third-party REST API using an HTTP trigger. Recently, the API provider changed their authentication to require OAuth 2.0 with client credentials. The Logic App currently uses a basic authentication header. What should you do to update the Logic App?

Accepted Answer

Configure the Logic App to use a managed identity and update the HTTP action authentication to 'Active Directory OAuth'. Azure Logic Apps can use managed identities to authenticate to services that support Microsoft Entra ID. For third-party APIs, you can configure the authentication type to 'Active Directory OAuth' and use the managed identity. Option A is wrong because the API key is not OAuth 2.0. Option B is wrong because API Management can be used but adds unnecessary complexity. Option D is wrong because connection strings are not relevant.

Answer

Use Azure API Management to proxy the API and add OAuth support

Answer

Add the client ID and client secret as query parameters

Answer

Replace the HTTP trigger with a Service Bus queue

Question 9

You are designing a solution to send email notifications from an Azure App Service web app. The app must use a third-party email service that requires an API key. You need to minimize management overhead and ensure the key is rotated automatically. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. Azure Key Vault can store the API key, and the app can use a managed identity to retrieve it. Key Vault supports automatic rotation of secrets. Option A is wrong because storing in app settings is not secure and does not rotate automatically. Option B is wrong because managed identities do not store secrets directly. Option D is wrong because the Logic App adds unnecessary overhead.

Answer

Use a system-assigned managed identity to authenticate to the email service

Answer

Store the API key in the App Service application settings

Answer

Create an Azure Logic App to send emails and call it from the web app

Question 10

A company uses Azure Functions to process messages from Azure Service Bus. The function needs to scale out during high load. Which consumption plan should you choose to enable automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan automatically scales based on the number of incoming messages. Option A is wrong because App Service plan requires manual scaling. Option B is wrong because Premium plan also scales but has additional features; however, the question asks for automatic scaling, which both achieve, but Consumption is the simplest. Option D is wrong because Logic Apps is a different service.

Answer

Logic Apps plan

Answer

Premium plan

Answer

App Service plan

Question 11

You are developing a microservice that processes images. After processing, it needs to store the result in Azure Blob Storage and send a message to Azure Service Bus for further processing. Which Azure SDK client should you use to minimize overhead?

Accepted Answer

Use the Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages. The Azure SDK for .NET provides client libraries for Blob Storage and Service Bus that are optimized for performance and low overhead. Option A is wrong because REST APIs require manual HTTP handling. Option B is wrong because SignalR is for real-time messaging, not queues. Option C is wrong because Functions are compute, not client libraries.

Answer

Deploy the microservice as an Azure Function

Answer

Call the Azure REST APIs directly using HttpClient

Answer

Use Azure SignalR Service for messaging

Question 12

Your organization uses Azure API Management (APIM) to expose internal APIs to external partners. You need to ensure that only partners with a valid subscription key can access the APIs. Additionally, you want to log all requests for auditing. Which APIM policy should you implement?

Accepted Answer

Apply a policy and a policy. The policy can check the subscription key (via the 'Ocp-Apim-Subscription-Key' header) and the policy sends logs to an event hub for auditing. Option A is wrong because only throttles, not validates. Option B is wrong because handles cross-origin requests. Option C is wrong because filters by IP, not by key.

Answer

Apply an <ip-filter> policy

Answer

Apply a <rate-limit> policy

Answer

Apply a <cors> policy

Question 13

You are building a solution that needs to send millions of events per second to Azure for processing. Which Azure service should you use to ingest the events?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is designed for high-throughput data ingestion, capable of handling millions of events per second. Option A is wrong because Service Bus is for enterprise messaging with lower throughput. Option B is wrong because IoT Hub is for IoT device connectivity. Option D is wrong because Notification Hubs is for push notifications.

Answer

Azure Service Bus

Answer

Azure IoT Hub

Answer

Azure Notification Hubs

Question 14

A developer writes an Azure Function that uses the Azure.Storage.Blobs SDK to upload a file to Blob Storage. The function runs locally but fails when deployed to Azure with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The function app does not have the correct RBAC role on the storage account. The function app in Azure needs a managed identity with the appropriate RBAC role (e.g., Storage Blob Data Contributor) to access the storage account. Locally, the developer might be using their own credentials. Option A is wrong because the function runtime is not the issue. Option B is wrong because firewall rules would affect both local and cloud. Option D is wrong because the SDK version is unlikely to cause a 403.

Answer

The Azure.Storage.Blobs SDK version is deprecated

Answer

The function runtime version is incompatible

Answer

The storage account is behind a firewall and the function app's outbound IP is not whitelisted

Question 15

You have an Azure Function that processes messages from an Event Hubs event stream. The function is failing with 'Message lock lost' errors. The processing time per event is about 10 minutes. What should you do to resolve the errors?

Accepted Answer

Configure the EventProcessorOptions with a longer lease duration. Event Hubs capture does not have a lock mechanism; the error is likely due to the checkpoint store. However, the issue is that the function is using Event Hubs with a consumer group that has a short lease duration. Increasing the 'maxReceiveWaitTime' or 'prefetch count' might help, but the best solution is to increase the 'eventProcessorOptions' for the lease duration. Option A is wrong because partition count does not affect lock loss. Option B is wrong because batch size is not the issue. Option D is wrong because increasing function timeout does not affect the Event Hubs lease.

Answer

Increase the function's timeout duration

Answer

Increase the number of partitions in the Event Hub

Answer

Decrease the batch size to process events faster

AZ-204 Connect to and consume Azure services and third-party services Practice Test 10 — 15 Questions

Exhibit

AZ-204 Connect to and consume Azure services and third-party services Practice Test 10 — 15 Questions

Exhibit