AZ-204 Connect to and consume Azure services and third-party services Practice Test 12 — 15 Questions

Question 1

You are developing a microservice that processes images. After processing, it needs to store the result in Azure Blob Storage and send a message to Azure Service Bus for further processing. Which Azure SDK client should you use to minimize overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages. The Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages are the official, high-level Azure SDK client libraries that provide optimized, asynchronous APIs for interacting with Azure Blob Storage and Azure Service Bus. These libraries handle connection pooling, retry policies, serialization, and authentication automatically, minimizing overhead compared to lower-level approaches.

Answer

Deploy the microservice as an Azure Function

Answer

Call the Azure REST APIs directly using HttpClient

Answer

Use Azure SignalR Service for messaging

Question 2

You are building a solution that needs to send millions of events per second to Azure for processing. Which Azure service should you use to ingest the events?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is the correct choice because it is a big data streaming platform and event ingestion service designed to handle millions of events per second with low latency. It supports high-throughput data ingestion from sources like telemetry, logs, and clickstreams, making it ideal for this scenario.

Answer

Azure Service Bus

Answer

Azure IoT Hub

Answer

Azure Notification Hubs

Question 3

A developer writes an Azure Function that uses the Azure.Storage.Blobs SDK to upload a file to Blob Storage. The function runs locally but fails when deployed to Azure with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The function app does not have the correct RBAC role on the storage account. The 403 Forbidden error when an Azure Function runs in Azure but not locally typically indicates an authorization failure. By default, Azure Functions use managed identity to access storage accounts, and the function app's system-assigned managed identity must be granted the appropriate RBAC role (e.g., Storage Blob Data Contributor) on the storage account. Without this role, the SDK's request to Blob Storage is denied, resulting in a 403.

Answer

The Azure.Storage.Blobs SDK version is deprecated

Answer

The function runtime version is incompatible

Answer

The storage account is behind a firewall and the function app's outbound IP is not whitelisted

Question 4

You have an Azure Function that processes messages from an Event Hubs event stream. The function is failing with 'Message lock lost' errors. The processing time per event is about 10 minutes. What should you do to resolve the errors?

Accepted Answer

Configure the EventProcessorOptions with a longer lease duration. The 'Message lock lost' error occurs because the default Event Hubs lease duration (30 seconds) is too short for processing that takes 10 minutes per event. By configuring the EventProcessorOptions with a longer lease duration, you ensure the partition lease is not expired while the function is still processing the event, preventing the lease from being stolen by another instance.

Answer

Increase the function's timeout duration

Answer

Increase the number of partitions in the Event Hub

Answer

Decrease the batch size to process events faster

Question 5

Which THREE Azure services can be used to trigger an Azure Function when a new blob is uploaded to a storage account?

Accepted Answer

Azure Blob Storage trigger (Event Grid based). The Azure Blob Storage trigger (Event Grid based) is the native and recommended way to execute an Azure Function in response to a new blob being uploaded. It leverages Azure Event Grid to reliably deliver blob created events, enabling near-real-time, serverless processing without polling or custom code.

Answer

Azure Service Bus queue

Answer

Azure Logic Apps

Question 6

Which TWO Azure services can be used to implement a publish-subscribe messaging pattern?

Accepted Answer

Azure Event Grid. Azure Service Bus Topics (Option D) natively implement a publish-subscribe pattern by allowing multiple subscriptions to receive copies of messages sent to a topic. Azure Event Grid (Option B) is a fully managed event routing service that uses a publish-subscribe model, where publishers send events and subscribers handle them via webhooks or Azure services. Both support decoupled communication with multiple receivers.

Answer

Azure Queue Storage

Answer

Azure Notification Hubs

Answer

Azure Event Hubs

Question 7

Refer to the exhibit. The exhibit shows an Azure Event Grid subscription configuration. You notice that the webhook endpoint is not receiving events when a .png file is uploaded to the 'images' container. What is the most likely reason?

Accepted Answer

The subject filter excludes .png files. The exhibit shows an Event Grid subscription with a subject filter configured to only include events where the subject ends with '.jpg'. Since a .png file upload would have a subject ending in '.png', the filter excludes it, preventing the event from being sent to the webhook endpoint. Therefore, the subject filter is the most likely reason the webhook is not receiving .png file events.

Answer

The subscription is disabled

Answer

The destination endpoint type is incorrect

Answer

The webhook endpoint requires authentication

Question 8

Refer to the exhibit. You executed the Azure CLI command to create a storage account. Later, you attempt to connect from an application that uses TLS 1.1. The connection fails. What is the most likely reason?

Accepted Answer

The minimum TLS version is set to 1.2, blocking TLS 1.1. The Azure CLI command used to create the storage account did not specify a minimum TLS version, so the default value of 1.2 applies. When the application attempts to connect using TLS 1.1, Azure Storage rejects the connection because the service enforces TLS 1.2 or higher. This is a security default in Azure Storage accounts created after a certain date, and it can be overridden by setting the `--min-tls-version` parameter to 1.0 during creation or by updating the account's properties.

Answer

The storage account uses Standard_GRS replication which is not accessible from all clients

Answer

The storage account is in a different location than the client

Answer

The storage account kind is StorageV2 which does not support blobs

Question 9

Refer to the exhibit. You deploy the ARM template to create an Azure Key Vault. After deployment, you attempt to add an access policy to grant a user 'Get' secret permissions using the Azure portal, but the option is grayed out. What is the most likely reason?

Accepted Answer

RBAC authorization is enabled, so access policies are not used. When Azure Key Vault is configured to use Azure RBAC (Role-Based Access Control) for authorization, the traditional access policy UI is disabled. The ARM template in the exhibit sets 'enableRbacAuthorization' to true, which switches the vault's authorization model from vault-level access policies to Azure RBAC roles. In this mode, you must assign roles (e.g., Key Vault Secrets User) via Azure RBAC instead of adding access policies.

Answer

The vault is disabled due to 'enableSoftDelete'

Answer

The property 'enabledForDeployment' is set to false

Answer

Soft delete is enabled, which prevents access policy changes

Question 10

A company develops a web app that processes images uploaded by users. The app uses Azure Cognitive Services to analyze images for moderation. The solution must minimize latency when calling the Cognitive Services endpoint. Which service should the developer use to call the endpoint?

Accepted Answer

Azure Front Door. Azure Front Door is a global, scalable entry point that uses the Microsoft global edge network to route user traffic to the nearest regional Cognitive Services endpoint. It provides anycast-based acceleration and TLS termination at the edge, which minimizes latency by reducing the number of network hops and enabling connection reuse. This makes it the optimal choice for low-latency calls to Cognitive Services from a web app.

Answer

Azure Traffic Manager

Answer

Azure API Management

Answer

Azure Blob Storage with a public endpoint

Question 11

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct service because it provides a secure, centralized store for secrets such as client secrets and refresh tokens. By storing these sensitive values in Key Vault, the developer can reference them in the Logic App workflow using the Key Vault connector, ensuring that secrets are never exposed in code or configuration. This aligns with the OAuth 2.0 requirement to protect long-lived credentials like refresh tokens.

Answer

Azure App Configuration

Answer

Azure Managed Identity

Answer

Azure SQL Database

Question 12

A developer is building a microservices application on Azure Kubernetes Service (AKS). One service needs to consume messages from an Azure Service Bus queue. The solution must minimize cost and automatically scale based on the number of messages. Which approach should the developer choose?

Accepted Answer

Use KEDA to scale the pods based on the Service Bus queue length. KEDA (Kubernetes Event-Driven Autoscaling) is the correct choice because it natively integrates with Azure Service Bus to monitor queue length and automatically scale the number of pods in AKS based on that metric. This minimizes cost by scaling to zero when there are no messages and scaling up only as needed, without requiring manual intervention or additional infrastructure.

Answer

Use Azure Event Grid to route messages to the microservice

Answer

Use Azure Functions with a Service Bus trigger on a dedicated App Service plan

Answer

Use the Azure Service Bus SDK in the pod code and manually scale pods

Question 13

A developer is configuring a web app to authenticate users with Microsoft Entra ID. The web app needs to call a downstream API that also uses Microsoft Entra ID for authentication. The developer must ensure that the web app can securely obtain access tokens for the downstream API. Which authentication flow should the developer implement?

Accepted Answer

OAuth 2.0 On-Behalf-Of flow. The OAuth 2.0 On-Behalf-Of (OBO) flow is the correct choice because the web app has already authenticated the user via Microsoft Entra ID and needs to exchange the user's access token for a new token to call the downstream API. This flow allows the web app to act on behalf of the authenticated user, maintaining the user's identity and consent context for the downstream API call.

Answer

OAuth 2.0 Client Credentials flow

Answer

OAuth 2.0 Implicit flow

Answer

OAuth 2.0 Authorization Code flow

Question 14

A company uses Azure API Management (APIM) to expose a set of REST APIs. A new requirement mandates that all API calls must be throttled per user based on usage tiers (Free, Basic, Premium). User identity is provided via a JWT token. Which policy should the developer configure in APIM to enforce this throttling?

Accepted Answer

rate-limit-by-key policy. The rate-limit-by-key policy is correct because it allows throttling based on a specific key extracted from the request, such as the user identity from a JWT token. This policy enables per-user rate limiting by using a policy expression to extract the 'sub' claim or a custom claim from the JWT as the counter key, which maps directly to the usage tiers requirement.

Answer

rate-limit policy

Answer

quota-by-key policy

Answer

IP-based throttling

Question 15

A developer is building an application that needs to store and retrieve large binary files (e.g., images, videos). The application runs on Azure Virtual Machines. Which Azure service provides the most cost-effective storage for these files?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is designed specifically for storing massive amounts of unstructured data, such as images and videos, and offers the lowest cost per gigabyte for large binary files compared to other Azure storage options. It supports scalable, durable, and highly available storage with tiered pricing (Hot, Cool, Archive) to optimize costs based on access patterns.

Answer

Azure SQL Database

Answer

Azure Cosmos DB

Answer

Azure Files