AZ-204 Connect to and consume Azure services and third-party services Practice Test 11 — 15 Questions

Question 1

You are designing a solution that requires asynchronous processing of messages from an Azure Service Bus queue. The solution must guarantee at-least-once delivery and handle poison messages automatically. Which combination of Service Bus features should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PeekLock mode with dead-letter queue. PeekLock mode is required for at-least-once delivery because it allows the consumer to process the message and then explicitly complete it, ensuring the message is not removed from the queue until processing succeeds. The dead-letter queue automatically handles poison messages by moving messages that exceed the maximum delivery count or fail processing, preventing them from blocking the queue.

Answer

ReceiveAndDelete mode with a separate dead-letter queue

Answer

ReceiveAndDelete mode with automatic forwarding

Answer

PeekLock mode with sessions

Question 2

You are developing an application that needs to store and retrieve large binary objects (up to 5 TB) in Azure Blob Storage. The application requires the ability to access data from any URL via HTTP/HTTPS. Which Blob Storage access tier should you use?

Accepted Answer

Hot. The Hot access tier is optimized for frequent read and write access to data, supports objects up to 5 TB, and allows access via HTTP/HTTPS from any URL. It is the only tier that combines low-latency access, high throughput, and public internet accessibility without requiring rehydration or special permissions, making it suitable for general-purpose blob storage scenarios.

Answer

Archive

Answer

Cool

Answer

Premium

Question 3

You are implementing a custom API that calls a downstream API secured with OAuth 2.0. The downstream API requires a client credentials grant flow. You need to securely store the client secret and obtain an access token. What should you use?

Accepted Answer

Azure Key Vault to store the secret and MSAL to obtain the token. Azure Key Vault provides secure, auditable storage for client secrets, and MSAL (Microsoft Authentication Library) is the recommended SDK for implementing OAuth 2.0 client credentials grant flows in Azure. MSAL handles token acquisition, caching, and renewal, while Key Vault ensures the secret is never exposed in code or configuration files.

Answer

Azure App Configuration to store the secret and the Azure Identity SDK to obtain the token

Answer

Managed identity to access the downstream API directly

Answer

Azure Certificate Manager to store the secret and the HttpClient to obtain the token

Question 4

You are using Azure API Management to expose a legacy SOAP API as a RESTful API. The SOAP API has complex XML schemas. You need to transform the SOAP response to JSON. Which policy should you use?

Accepted Answer

set-body. The `set-body` policy is correct because it allows you to replace the body of the SOAP response with a JSON representation. In Azure API Management, you can use the `set-body` policy with a Liquid template or a .NET expression to transform the incoming XML SOAP response into JSON, effectively converting the complex XML schemas to a RESTful JSON output.

Answer

transform-body

Answer

return-response

Answer

convert-to-json

Question 5

You need to process large volumes of streaming data from IoT devices in near real-time. The processed data must be stored in Azure Cosmos DB for further analysis. Which Azure service should you use for stream processing?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is purpose-built for real-time stream processing, capable of ingesting large volumes of data from sources like Azure Event Hubs or IoT Hub, applying SQL-based queries, and outputting results directly to Azure Cosmos DB. This aligns perfectly with the requirement for near real-time processing and storage in Cosmos DB.

Answer

Azure Batch

Answer

Azure Databricks

Answer

Azure Data Lake Storage

Question 6

You are developing a microservice that needs to publish events to multiple subscribers. Each subscriber should receive the event independently and at its own pace. The event must be retained for up to 7 days. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus topic. Azure Service Bus Topic is the correct choice. It provides a publish-subscribe model where each subscriber receives events independently through its own durable subscription. Messages are retained within each subscription until they are processed or their time-to-live expires (up to 14 days by default), which perfectly meets the requirement for events to be retained for up to 7 days for subscribers to consume at their own pace. Event Grid is designed for near real-time event delivery and does not offer durable message retention for subscribers over several days; its retry policy is limited to a maximum of 24 hours.

Answer

Azure Service Bus queue

Answer

Azure Event Grid

Answer

Azure Event Hubs

Question 7

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

Accepted Answer

The storage account is behind a firewall and the Cognitive Search service IP is not allowed.. When a storage account is protected by a firewall, Azure Cognitive Search's indexer must be granted explicit network access. Even if the connection string is correct, the indexer's outbound requests will be blocked unless the storage account's firewall rules include the IP address or subnet of the Cognitive Search service. This is a common misconfiguration that results in 'Data source credentials are invalid' errors despite valid credentials.

Answer

The Cognitive Search service is in a different region than the storage account.

Answer

The Cognitive Search service's admin key is missing.

Answer

The indexer configuration is missing the storage account key.

Question 8

Refer to the exhibit. You are deploying an ARM template that includes the above network security group rule. The rule is intended to block all outbound internet traffic from a virtual network. However, after deployment, virtual machines in the subnet still have outbound internet access. What is the most likely reason?

Accepted Answer

The network security group is not associated with the subnet or network interface.. A network security group (NSG) rule only takes effect when the NSG is explicitly associated with a subnet or a network interface. Without this association, the rule is not applied to traffic flowing through the subnet, so virtual machines retain default outbound internet access. The ARM template may have defined the NSG and its rules, but if the association step (e.g., via Microsoft.Network/virtualNetworks/subnets with the networkSecurityGroup property) is missing or misconfigured, the rule is effectively ignored.

Answer

The destination port range '*' is invalid; you must specify explicit ports.

Answer

The source address prefix should be '*' instead of 'VirtualNetwork'.

Answer

The rule priority is too low; it should be lower than the default allow rule.

Question 9

Refer to the exhibit. You run the above Azure CLI command to upload a blob to Azure Blob Storage. The command fails with the error 'This request is not authorized to perform this operation.' You have verified that the storage account name and container name are correct, and the file exists. What should you do to resolve the error?

Accepted Answer

Provide the storage account key using the --account-key parameter or set the AZURE_STORAGE_KEY environment variable.. The error 'This request is not authorized to perform this operation' indicates that the Azure CLI command did not provide valid credentials for the storage account. By default, Azure CLI uses Azure AD authentication (--auth-mode login), but when the command is run without a logged-in user context or without proper RBAC roles, it fails. Providing the storage account key via --account-key or setting the AZURE_STORAGE_KEY environment variable supplies the shared key for HMAC-SHA256 authorization, which is a fallback authentication method that does not require Azure AD.

Answer

Generate a shared access signature (SAS) and use it instead of key.

Answer

Change --auth-mode key to --auth-mode login.

Answer

Upgrade to the latest version of Azure CLI.

Question 10

Refer to the exhibit. You are configuring Azure Monitor autoscale for a virtual machine scale set using the above JSON metric configuration. The autoscale rule is supposed to scale out when average memory usage exceeds 80%. However, autoscale is not triggering even when memory usage is consistently above 90%. What is the most likely cause?

Accepted Answer

The autoscale rule condition is not configured to use this metric.. The exhibit shows a metric configuration, but the autoscale rule itself must explicitly reference that metric in its condition. Without a rule condition that uses this metric, autoscale will not evaluate it, regardless of how the metric is configured. The JSON snippet only defines the metric source, not the scaling rule logic.

Answer

The aggregation interval is too long; it should be set to 1 minute.

Answer

The metric name is incorrect; it should be 'Percentage Memory'.

Answer

The aggregation type should be 'Maximum' instead of 'Average'.

Question 11

Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)

Accepted Answer

Grant the managed identity the 'Key Vault Secrets User' role.. Granting the managed identity the 'Key Vault Secrets User' role uses Azure RBAC to authorize the App Service to read secrets from Key Vault without requiring any keys or secrets to be stored in the application. This aligns with the principle of least privilege and eliminates the need for client secrets or certificates in code or configuration.

Answer

Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.

Answer

Store the Key Vault URL and a client secret in App Service application settings.

Question 12

Which THREE are best practices for implementing an API using Azure API Management? (Choose three.)

Accepted Answer

Use policies to enforce throttling and quotas.. A is correct because Azure API Management policies allow you to enforce throttling and quotas at the API level, protecting your backend from excessive traffic. By defining rate limits and quota policies, you can control the number of requests a client can make within a specified time window, ensuring fair usage and preventing abuse.

Answer

Use the Consumption tier for production APIs with custom domains.

Answer

Expose the backend service URLs directly to clients.

Question 13

You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?

Accepted Answer

Use a system-assigned managed identity. A system-assigned managed identity is the recommended authentication method for Azure Functions to access Key Vault because it eliminates the need to store credentials in code or configuration. When enabled, Azure automatically creates a service principal in Azure AD for the function app, and the function can authenticate to Key Vault using this identity via the Azure Identity SDK (e.g., DefaultAzureCredential). This approach is secure, fully managed, and aligns with the principle of least privilege.

Answer

Use a client certificate stored in the function app

Answer

Use the Key Vault connection string from app settings

Answer

Use the storage account access key from the function app

Question 14

You are designing a solution to send email notifications from an Azure App Service web app. The app must use a third-party email service that requires an API key. You need to minimize management overhead and ensure the key is rotated automatically. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. It uses Azure Key Vault to securely store the third-party API key, and a system-assigned managed identity to authenticate the App Service to Key Vault without managing credentials. This minimizes management overhead by eliminating manual key rotation (Key Vault can rotate secrets automatically) and removes the need to store secrets in code or configuration.

Answer

Use a system-assigned managed identity to authenticate to the email service

Answer

Store the API key in the App Service application settings

Answer

Create an Azure Logic App to send emails and call it from the web app

Question 15

A company uses Azure Functions to process messages from Azure Service Bus. The function needs to scale out during high load. Which consumption plan should you choose to enable automatic scaling?

Accepted Answer

Consumption plan. The Consumption plan is the correct choice because it automatically scales out based on the number of incoming messages from Azure Service Bus, adding function instances up to a maximum of 200 instances per function app. This plan is event-driven and provides true serverless scaling with no reserved capacity, making it ideal for handling variable workloads like Service Bus message processing.

Answer

Logic Apps plan

Answer

Premium plan

Answer

App Service plan