AZ-204 Connect to and consume Azure services and third-party services Practice Test 11 — 15 Questions

Question 1

Which TWO authentication methods can be used to connect an Azure App Service to an Azure SQL Database without storing connection strings in code or configuration files?

Accepted Answer

System-assigned managed identity. Managed identities (system-assigned or user-assigned) and service principals are both identity-based methods that can authenticate to Azure SQL without storing credentials. Option A is wrong because SQL authentication uses username/password stored in configuration. Option B is wrong because the access key is for storage accounts. Option D is wrong because certificates are stored in the app, not managed by Azure identity.

Answer

Client certificate installed on the App Service

Answer

Storage account access key

Answer

SQL Server authentication (username and password)

Question 2

Which THREE Azure services can be used to trigger an Azure Function when a new blob is uploaded to a storage account?

Accepted Answer

Azure Blob Storage trigger (Event Grid based). Blob Storage trigger (Event Grid), Event Grid directly, and Event Hubs can all be used. Service Bus is not designed for blob events. Logic Apps is a different service that can trigger functions but is not a standalone trigger service.

Answer

Azure Service Bus queue

Answer

Azure Logic Apps

Question 3

Which TWO Azure services can be used to implement a publish-subscribe messaging pattern?

Accepted Answer

Azure Event Grid. Azure Service Bus Topics and Azure Event Grid both support publish-subscribe. Event Hubs is for event streaming, not pub-sub. Queue Storage is for point-to-point messaging. Notification Hubs is for push notifications.

Answer

Azure Queue Storage

Answer

Azure Notification Hubs

Answer

Azure Event Hubs

Question 4

Refer to the exhibit. The exhibit shows an Azure Event Grid subscription configuration. You notice that the webhook endpoint is not receiving events when a .png file is uploaded to the 'images' container. What is the most likely reason?

Accepted Answer

The subject filter excludes .png files. The filter 'subjectEndsWith' is set to '.jpg', so only .jpg files trigger events. .png files do not match. Option A is wrong because the subscription is enabled. Option B is wrong because the endpoint type is WebHook. Option D is wrong because there is no authentication configured in the exhibit, but that would affect all events, not just .png.

Answer

The subscription is disabled

Answer

The destination endpoint type is incorrect

Answer

The webhook endpoint requires authentication

Question 5

Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?

Accepted Answer

The minimum TLS version is set to 1.2, blocking TLS 1.1. The '--min-tls-version 1.2' parameter sets the minimum TLS version to 1.2, so TLS 1.1 is rejected. Option A is wrong because Standard_GRS is geo-redundant storage, which is available. Option B is wrong because the kind StorageV2 supports blobs. Option D is wrong because the location eastus is valid.

Answer

The storage account uses Standard_GRS replication which is not accessible from all clients

Answer

The storage account is in a different location than the client

Answer

The storage account kind is StorageV2 which does not support blobs

Question 6

Refer to the exhibit. You deploy the ARM template to create an Azure Key Vault. After deployment, you attempt to add an access policy to grant a user 'Get' secret permissions using the Azure portal, but the option is grayed out. What is the most likely reason?

Accepted Answer

RBAC authorization is enabled, so access policies are not used. The property 'enableRbacAuthorization' is set to true, which means the Key Vault uses Azure RBAC for authorization instead of access policies. The access policies tab is disabled. Option A is wrong because soft delete does not affect access policies. Option B is wrong because the vault is enabled. Option C is wrong because 'enabledForDeployment' is for Azure VMs, not access policies.

Answer

The vault is disabled due to 'enableSoftDelete'

Answer

The property 'enabledForDeployment' is set to false

Answer

Soft delete is enabled, which prevents access policy changes

Question 7

A company develops a web app that processes images uploaded by users. The app uses Azure Cognitive Services to analyze images for moderation. The solution must minimize latency when calling the Cognitive Services endpoint. Which service should the developer use to call the endpoint?

Accepted Answer

Azure Front Door. Option A is correct because Azure Blob Storage with public endpoint adds latency. Option B is correct because Azure Front Door provides global load balancing and acceleration, reducing latency. Option C is incorrect because Azure API Management adds processing overhead. Option D is incorrect because Azure Traffic Manager is DNS-based and doesn't optimize the connection path.

Answer

Azure Traffic Manager

Answer

Azure API Management

Answer

Azure Blob Storage with a public endpoint

Question 8

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

Accepted Answer

Azure Key Vault. Option A is correct because Azure Key Vault securely stores secrets and credentials, and Logic Apps can reference them. Option B is incorrect because Azure App Configuration is for configuration settings, not secrets. Option C is incorrect because Azure SQL Database is not a secret store. Option D is incorrect because Azure Managed Identity is for Azure AD authentication, not for third-party OAuth secrets.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure SQL Database

Question 9

A developer is building a microservices application on Azure Kubernetes Service (AKS). One service needs to consume messages from an Azure Service Bus queue. The solution must minimize cost and automatically scale based on the number of messages. Which approach should the developer choose?

Accepted Answer

Use KEDA to scale the pods based on the Service Bus queue length. Option A is correct because KEDA (Kubernetes Event-Driven Autoscaling) can scale pods based on Service Bus queue length, and it's cost-effective. Option B is incorrect because the Service Bus SDK with manual scaling doesn't provide automatic scaling. Option C is incorrect because Azure Functions running on a dedicated plan would incur cost even when idle. Option D is incorrect because Azure Event Grid is for event routing, not queue consumption.

Answer

Use Azure Event Grid to route messages to the microservice

Answer

Use Azure Functions with a Service Bus trigger on a dedicated App Service plan

Answer

Use the Azure Service Bus SDK in the pod code and manually scale pods

Question 10

A company wants to send email notifications from an Azure Function app. The function app runs on a Consumption plan. Which service should be used to send emails?

Accepted Answer

SendGrid. Option A is correct because SendGrid is a third-party email service available as an Azure Marketplace integration. Option B is incorrect because Azure Logic Apps could be used but adds overhead. Option C is incorrect because Azure Communication Services is for SMS/chat, not email. Option D is incorrect because Microsoft Graph API sends emails from a user mailbox, which is not suitable for automated notifications.

Answer

Azure Logic Apps

Answer

Microsoft Graph API

Answer

Azure Communication Services

Question 11

A developer is configuring a web app to authenticate users with Microsoft Entra ID. The web app needs to call a downstream API that also uses Microsoft Entra ID for authentication. The developer must ensure that the web app can securely obtain access tokens for the downstream API. Which authentication flow should the developer implement?

Accepted Answer

OAuth 2.0 On-Behalf-Of flow. Option B is correct because the OAuth 2.0 On-Behalf-Of flow allows a web app to use the user's identity to obtain a token for a downstream API. Option A is incorrect because the Authorization Code flow is for user authentication, not for chaining to a downstream API. Option C is incorrect because Client Credentials flow is for daemon apps, not for user context. Option D is incorrect because the Implicit flow is deprecated and not secure.

Answer

OAuth 2.0 Client Credentials flow

Answer

OAuth 2.0 Implicit flow

Answer

OAuth 2.0 Authorization Code flow

Question 12

A company uses Azure API Management (APIM) to expose a set of REST APIs. A new requirement mandates that all API calls must be throttled per user based on usage tiers (Free, Basic, Premium). User identity is provided via a JWT token. Which policy should the developer configure in APIM to enforce this throttling?

Accepted Answer

rate-limit-by-key policy. Option B is correct because the rate-limit-by-key policy can throttle calls based on a key extracted from the JWT claim (e.g., subscription tier). Option A is incorrect because rate-limit policy applies globally, not per user. Option C is incorrect because quota-by-key limits total calls over a period, not rate. Option D is incorrect because IP-based throttling does not consider user identity.

Answer

rate-limit policy

Answer

quota-by-key policy

Answer

IP-based throttling

Question 13

A developer is building an application that needs to store and retrieve large binary files (e.g., images, videos). The application runs on Azure Virtual Machines. Which Azure service provides the most cost-effective storage for these files?

Accepted Answer

Azure Blob Storage. Option B is correct because Azure Blob Storage is specifically designed for storing large amounts of unstructured data like binary files at low cost. Option A is incorrect because Azure SQL Database is for relational data, not blob storage. Option C is incorrect because Azure Files is for shared file systems, not optimal for large binary files. Option D is incorrect because Azure Cosmos DB is for NoSQL data and is more expensive for blob storage.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Files

Question 14

An application uses Azure Functions with a Durable Functions extension to orchestrate a workflow. The workflow calls multiple external APIs. The developer needs to handle transient failures when calling these APIs. Which pattern should the developer implement?

Accepted Answer

Implement retry logic with exponential backoff. Option A is correct because automatic retry with exponential backoff is a best practice for transient faults. Option B is incorrect because circuit breaker is for preventing repeated calls to a failing service, but it doesn't handle retries. Option C is incorrect because the request-reply pattern is for messaging, not for handling failures. Option D is incorrect because the saga pattern is for distributed transactions, not for retries.

Answer

Use a saga pattern

Answer

Use a request-reply pattern

Answer

Use a circuit breaker pattern

Question 15

A company uses Azure Event Hubs to ingest telemetry data from IoT devices. The data is processed by a stream analytics job that outputs to Azure Data Lake Storage Gen2. The developer needs to ensure that the stream analytics job can authenticate to Event Hubs without storing connection strings in code. Which authentication method should the developer use?

Accepted Answer

Use Managed Identity. Option B is correct because Managed Identity allows Azure resources to authenticate to other Azure services without storing credentials. Option A is incorrect because Shared Access Signature requires a token stored somewhere. Option C is incorrect because connection strings expose secrets. Option D is incorrect because a client certificate would need to be stored.

Answer

Use a connection string with the Event Hubs namespace

Answer

Use a client certificate

Answer

Use a Shared Access Signature (SAS) token