AZ-204 Connect to and consume Azure services and third-party services Practice Test 10 — 15 Questions

Question 1

Which THREE are benefits of using Azure API Management for consuming third-party APIs? (Choose three.)

Accepted Answer

Transforming request and response formats (e.g., XML to JSON).. Option A is correct because API Management policies such as the XML-to-JSON policy (xml-to-json) and the set-body policy let you transform request and response payloads on the fly, so a consumer can call a third-party XML API while its own clients speak JSON. Option B is correct because APIM provides rate-limit and rate-limit-by-key policies (and quota policies) that cap calls per subscription or key, protecting you from exceeding the third-party API's contractual quotas and avoiding throttling or overage charges. Option D is correct because the response-cache and cache-lookup/cache-store policies can cache third-party responses at the APIM gateway, cutting latency for callers and reducing the number of calls hitting the external API. Option C is not correct because APIM does not autoscale the third-party API itself; it only scales its own gateway instances, and the external service's capacity is outside your control. Option E is not correct because APIM is not a global load balancer for the third-party API; it can route to multiple backends, but it does not provide global traffic distribution for an API you do not own.

Answer

Automatically scaling the third-party API based on demand.

Answer

Providing a global load balancer for the third-party API.

Question 2

You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?

Accepted Answer

The App Service does not have a managed identity enabled and the Key Vault access policy is missing.. An Azure App Service must have a managed identity enabled and the Key Vault must have an access policy granting that identity the 'Get' permission for secrets. Without these, the App Service cannot authenticate to Key Vault, causing the deployment to fail with an access error.

Answer

The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.

Answer

The ARM template cannot use Key Vault references in app settings.

Answer

The secret name in the URI does not match the actual secret name.

Question 3

You are querying Azure Monitor metrics using Kusto Query Language (KQL). The query is supposed to return average metric values per hour per resource provider, but it returns no results. What is the most likely issue?

Accepted Answer

The table name should be 'AzureMetrics' instead of 'metrics'.. C is correct because the Azure Monitor metrics table is named 'AzureMetrics', not 'metrics'. When querying Azure Monitor metrics using KQL, referencing the wrong table name will result in no results being returned, as the query engine cannot find the specified table.

Answer

The ORDER BY clause should be before GROUP BY.

Answer

The 'bin' function is used incorrectly; it should be 'bin(TimeGenerated, 1h)' without the alias.

Answer

The GROUP BY clause cannot include a computed column like 'bin'.

Question 4

You run the following PowerShell script to upload a blob to Azure Storage:

```powershell
$context = New-AzStorageContext -StorageAccountName 'mystorageaccount' -StorageAccountKey 'fakekey...'
Set-AzStorageBlobContent -Context $context -Container 'mycontainer' -Blob 'myblob' -File 'This is the file content'
```

The script fails with an error.

Which part of the script is causing the failure?

Accepted Answer

The -File parameter should be a file path, not a string.. The script fails because the `-File` parameter of `Set-AzStorageBlobContent` expects a local file path, but the script passes raw content as a string literal. The cmdlet cannot find a file with that path, so it throws an error.

Answer

The storage account name 'mystorageaccount' is invalid.

Answer

The connection string format is incorrect.

Answer

The container name 'mycontainer' does not exist.

Question 5

Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?

Accepted Answer

Microsoft Entra Workload ID (formerly Azure AD Pod Identity). Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.

Answer

Service principal with certificate stored in the pod

Answer

User-assigned managed identity on the node resource group

Answer

System-assigned managed identity on AKS cluster

Question 6

A web app running on Azure App Service must integrate with Microsoft Graph API to read user profiles. The app is registered in Microsoft Entra ID and uses the OAuth 2.0 authorization code flow. However, after deployment, the app fails to acquire tokens. What is the most likely cause?

Accepted Answer

The redirect URI is not configured in the app registration. The OAuth 2.0 authorization code flow requires a redirect URI to be registered in the app registration in Microsoft Entra ID. This URI is where the authorization server sends the authorization code after user consent. If the redirect URI is missing or mismatched, the token acquisition fails because the authorization server cannot validate the callback endpoint, causing the authentication request to be rejected.

Answer

The API permission for User.Read is not granted

Answer

The app is using the client credentials flow instead of authorization code flow

Answer

The client secret is expired

Question 7

You are developing a solution that processes events from Azure Event Hubs and stores them in Azure Blob Storage. The processing must be idempotent and exactly-once. Which approach should you use?

Accepted Answer

Use EventProcessorHost with checkpointing and blob leases to track processed events. The EventProcessorHost (EPH) pattern with checkpointing and blob leases provides the foundation for exactly-once processing in Event Hubs. Checkpointing records the offset of the last successfully processed event in Azure Blob Storage, while blob leases ensure partition ownership and prevent duplicate processing by competing consumers. This combination allows the processor to resume from the last checkpoint after a failure, guaranteeing that each event is processed exactly once.

Answer

Use Azure Functions with Event Hubs trigger and store events in batches

Answer

Use a simple consumer group and delete events after reading from Event Hubs

Answer

Implement a transactional outbox pattern with Azure SQL Database

Question 8

Your company wants to send email notifications to users via a third-party email service (SendGrid) from an Azure Logic App. What is the recommended way to securely store the SendGrid API key?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. Azure Key Vault securely stores secrets and can be accessed by Logic Apps via managed identity, providing the most secure and recommended approach. Option B is wrong because app settings are less secure and can be exposed in configuration files or logs. Option C is wrong because hardcoding secrets in workflow definitions is insecure and violates best practices. Option D is wrong because environment variables are not specifically designed for secret management and lack the security controls of Key Vault.

Answer

Store the API key in an App Setting of the Logic App

Answer

Hardcode the API key in the Logic App workflow definition

Answer

Store the API key in an environment variable on the integration service environment

Question 9

You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?

Accepted Answer

Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime. Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.

Answer

Use a system-assigned managed identity and acquire a token for Cognitive Services

Answer

Prompt the user to enter the key on first launch

Answer

Store the key in the mobile app's local secure storage after initial retrieval

Question 10

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

Accepted Answer

Enable sessions on the queue and use peek-lock mode with automatic complete on success. Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Answer

Use auto-forwarding to a dead-letter queue on failure

Answer

Partition the queue and use multiple functions to process each partition in order

Answer

Use receive and delete mode to ensure each message is processed only once

Question 11

Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?

Accepted Answer

rate-limit by key policy with @(context.Subscription.Id) as counter key. The `rate-limit by key` policy in Azure API Management allows you to enforce throttling limits based on a specific counter key. Using `@(context.Subscription.Id)` as the counter key ensures that each subscription key is tracked individually, enabling per-subscription throttling as required.

Answer

rate-limit policy with IP address filtering

Answer

rate-limit by key policy with no counter key

Answer

validate-jwt policy with claims check

Question 12

You are developing a serverless application using Azure Functions that processes orders. Each order must be validated by calling a third-party API. If the third-party API is unavailable, the function should retry with exponential backoff. How should you implement this?

Accepted Answer

Implement retry logic with exponential backoff and circuit breaker using Polly within the function. It uses the Polly library to implement retry logic with exponential backoff and circuit breaker, which is a lightweight and flexible approach. Option B is incorrect because the trigger binding's automatic retries are for infrastructure failures (e.g., message delivery), not for application-level errors like API unavailability. Option C is incorrect because a long timeout does not handle transient faults; it just waits. Option D is incorrect because, while Azure Durable Functions does support retry via CallActivityWithRetryAsync, it introduces unnecessary complexity (orchestration overhead) for a simple HTTP call that can be handled directly with a library like Polly.

Answer

Enable automatic retries on the function's trigger binding

Answer

Configure the function to have a long timeout and hope the API responds

Answer

Use Azure Durable Functions to orchestrate the retry

Question 13

Your Azure App Service app uses SignalR Service to push real-time updates to clients. You notice that some clients are disconnected after 30 minutes of inactivity. What is the most likely cause and solution?

Accepted Answer

The Azure SignalR Service has a default client timeout of 30 minutes; configure the ClientTimeout setting in the SignalR service. The Azure SignalR Service has a default idle client timeout of 30 minutes. When a client connection remains idle (no data frames sent or received) for this duration, the service proactively closes the connection to conserve resources. To prevent this, you must configure the `ClientTimeout` setting in the SignalR service to a higher value or implement keep-alive mechanisms such as ping frames from the client.

Answer

The app service plan is scaled down, causing idle connections to drop

Answer

The app service plan has an idle timeout of 30 minutes

Answer

The SignalR service is in serverless mode, which disconnects idle clients

Question 14

Which THREE services can be used to implement a pub/sub messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (A) implement pub/sub natively: a topic receives messages and multiple subscriptions (with filters/rules) each get a copy, decoupling publishers from subscribers. Azure Event Grid (D) is a pub/sub event-routing service where publishers emit events to topics and subscribers receive them via event subscriptions (webhooks, Functions, queues, etc.). Azure Event Hubs (E) is a publish/subscribe event-streaming platform using partitions and consumer groups, so multiple consumers can independently read the same stream. Azure Notification Hubs (B) is a push-notification broadcast service to mobile devices, not a general pub/sub messaging broker. Azure Queue Storage (C) is point-to-point queue messaging where each message is consumed once, so it does not provide the fan-out semantics of pub/sub.

Answer

Azure Notification Hubs

Answer

Azure Queue Storage

Question 15

You are reviewing an Azure Policy definition that applies to storage accounts. The policy has an effect of 'deny' and specifies network ACLs. What is the intended behavior of this policy?

Accepted Answer

Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny. The Azure Policy definition with effect 'deny' and network ACL conditions will block the creation of any storage account that does not include a virtual network rule allowing 'vnet1' and does not have the default action set to 'Deny'. This ensures that only storage accounts with the specified network restrictions are permitted, enforcing a security baseline that denies all traffic except from the allowed virtual network.

Answer

Allow all storage accounts to be created regardless of network rules

Answer

Deny all traffic to storage accounts

Answer

Allow only traffic from the specified virtual network