AZ-204 Connect to and consume Azure services and third-party services Practice Test 15 — 15 Questions

Question 1

You are building an event-driven solution that processes orders from an Azure Storage Queue. Each order triggers an Azure Function. To improve reliability, you need to automatically retry processing if an exception occurs, but only up to 3 times. You must also preserve the original order message in a poison queue after max retries. Which configuration should you use in the function's host.json?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set 'maxDequeueCount' to 3. The 'maxDequeueCount' setting in the host.json for an Azure Storage Queue-triggered function controls the number of times a message is dequeued for processing before it is moved to the poison queue. Setting it to 3 ensures that after three failed processing attempts (due to exceptions), the message is automatically redirected to the poison queue, preserving the original message for later inspection.

Answer

Set 'prefetchCount' to 3

Answer

Set 'newBatchThreshold' to 3

Answer

Set 'batchSize' to 3

Question 2

You have an Azure API Management instance that exposes a REST API. You need to secure the API using OAuth 2.0 with Microsoft Entra ID. The API should accept tokens from multiple client applications. Which policy should you add to the inbound processing section?

Accepted Answer

. The policy is the correct choice because it validates the OAuth 2.0 token presented in the Authorization header, ensuring that only requests with valid tokens from Microsoft Entra ID are processed. This policy checks the token's signature, issuer, audience, and expiration, and returns a 401 status code if validation fails, which is essential for securing the API against unauthorized access from multiple client applications.

Answer

<xml-to-json>

Answer

<rate-limit>

Answer

<cache-lookup>

Question 3

You are building a solution that uses Azure Cosmos DB for NoSQL. You need to implement a change feed processor to handle real-time updates. The application runs on multiple instances to ensure high availability. Which lease container configuration ensures that each instance processes a distinct set of partitions?

Accepted Answer

Use a separate lease container with partition key /id. The change feed processor uses a lease container to track which partitions each instance is processing. By setting the partition key to /id, each lease document is uniquely identified, allowing the processor to distribute partitions across instances. This ensures that each instance processes a distinct set of partitions, enabling horizontal scaling without duplication.

Answer

Set the partition key of the monitored container to /city

Answer

Configure the change feed to start from the beginning

Answer

Set the lease container's throughput to 1000 RU/s

Question 4

You are using Azure Blob Storage to store large media files. Clients upload files directly to the storage account using SAS tokens. You need to ensure that the SAS token expires 1 hour after creation. Which parameter should you set when generating the SAS token?

Accepted Answer

SignedExpiry (se). The SignedExpiry (se) parameter explicitly defines the expiration time of a SAS token. When generating a SAS token for Azure Blob Storage, setting 'se' to a UTC time 1 hour from creation ensures the token is valid only for that duration, meeting the requirement that clients can upload files directly using the SAS token for exactly 1 hour.

Answer

SignedProtocol (spr)

Answer

IP range (sip)

Answer

SignedStart (st)

Question 5

You are developing a .NET Core application that uses Azure Service Bus queues. You need to implement a dead-lettering mechanism for messages that cannot be processed after 5 delivery attempts. Which property should you set on the queue to automate this?

Accepted Answer

maxDeliveryCount. The maxDeliveryCount property on an Azure Service Bus queue defines the maximum number of attempts to deliver a message before it is automatically moved to the dead-letter queue. Setting this property to 5 ensures that after five failed delivery attempts, the message is dead-lettered, meeting the requirement without custom code.

Answer

defaultMessageTimeToLive

Answer

lockDuration

Answer

requiresDuplicateDetection

Question 6

You are designing a solution that uses Azure Event Grid to handle events from multiple Azure services. The events must be filtered and routed to different endpoints based on event type. Which component should you use to filter events before they are sent to subscribers?

Accepted Answer

Event subscription with filters. C is correct because Event Subscriptions in Azure Event Grid allow you to define filters on event types, subject prefixes/suffixes, and advanced filtering (e.g., based on data fields) to control which events are delivered to each subscriber. This filtering happens before the events are sent to the endpoint, ensuring only matching events are routed.

Answer

Event grid domain

Answer

Event grid topic

Answer

Event handler

Question 7

You are using Azure Cache for Redis to cache frequently accessed database query results. You need to ensure that the cache is updated automatically when the underlying data changes. Which pattern should you implement?

Accepted Answer

Cache-aside pattern with cache invalidation. The cache-aside (lazy loading) pattern is the most common approach for caching database queries. In this pattern, the application checks the cache first; on a cache miss, it loads data from the database and stores it in the cache with a TTL. To ensure the cache reflects data changes, the application invalidates (deletes) the cached entry whenever the underlying data is updated, so the next read fetches fresh data. This pattern is explicitly designed for scenarios like Azure Cache for Redis where automatic updates are needed. Option B (read-through) is similar but the cache itself loads data from the database; however, it does not handle cache invalidation on data changes automatically. Option C (event-driven invalidation using Azure Event Grid) is a valid pattern but is more complex and not the standard caching pattern; it requires additional infrastructure to detect changes and publish events. Option D (write-through) updates the cache synchronously on writes, but it does not address automatic updates when data changes outside the cache (e.g., direct database updates). Therefore, the cache-aside pattern with explicit invalidation is the correct choice for automatic cache updates.

Answer

Read-through pattern

Answer

Event-driven cache invalidation using Azure Event Grid

Answer

Write-through pattern

Question 8

You need to authenticate an Azure Function to an Azure SQL Database using a managed identity. The function has a system-assigned managed identity enabled. Which connection string setting should you use in the function's application settings?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;. The connection string `Authentication=Active Directory Managed Identity` tells the SQL client to use the system-assigned managed identity of the Azure Function to acquire an access token from Azure AD, without needing any explicit credentials. This is the standard way to authenticate an Azure resource with a managed identity to Azure SQL Database.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myuser;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=<client-id>;

Question 9

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Accepted Answer

rate-limit policy. The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.

Answer

xml-to-json policy

Answer

cache-lookup policy

Question 10

Refer to the exhibit. You are reviewing an ARM template for a storage account. A security audit requires that all storage accounts enforce TLS 1.2 or higher. Does this configuration meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2. The `minimumTlsVersion` property in the ARM template explicitly enforces the minimum TLS version for requests to the storage account. Setting it to `TLS1_2` ensures that only TLS 1.2 or higher connections are accepted, meeting the security audit requirement. The `supportsHttpsTrafficOnly` property only enforces HTTPS but does not control the TLS version, so it alone is insufficient.

Answer

No, because supportsHttpsTrafficOnly does not enforce TLS version

Answer

No, because minimumTlsVersion is not a valid property

Answer

No, because the property should be minimumTlsVersion: "1.2"

Question 11

Refer to the exhibit. You are creating an Azure Service Bus queue using an ARM template. The requirement is that messages should be automatically dead-lettered after 3 failed delivery attempts. Does this configuration meet the requirement?

Accepted Answer

No, because maxDeliveryCount should be 3. The `maxDeliveryCount` property in Azure Service Bus determines the number of attempts to deliver a message before it is automatically moved to the dead-letter queue. The requirement specifies 3 failed delivery attempts, so `maxDeliveryCount` must be set to 3. The exhibit shows `maxDeliveryCount` set to 10, which does not meet the requirement.

Answer

No, because lockDuration should be shorter

Answer

Yes, because defaultMessageTimeToLive ensures messages expire

Answer

Yes, because maxDeliveryCount is set

Question 12

Your company deploys a microservices architecture on Azure Kubernetes Service (AKS). The application consists of a frontend service, an order service, and a payment service. The order service writes messages to an Azure Service Bus queue, and the payment service processes them. You need to ensure that the payment service can scale independently based on the queue length, and that the processing is fault-tolerant: if the payment service crashes during message processing, the message should not be lost and should be retried. You also need to minimize cost by reducing the number of idle instances. You configure the payment service as an Azure Function triggered by the Service Bus queue. Which configuration options should you set?

Accepted Answer

Set maxDeliveryCount to 5 in the Service Bus queue. Configure the Azure Function's scaling mode to 'Scale based on the number of messages in the queue'.. Setting maxDeliveryCount to 5 on the Service Bus queue ensures that if the payment service crashes during processing, the message is not lost and will be retried up to 5 times. Configuring the Azure Function's scaling mode to 'Scale based on the number of messages in the queue' allows the function to scale out dynamically based on queue length, minimizing idle instances and reducing cost. This combination provides fault-tolerant processing and cost-efficient scaling for the microservices architecture.

Answer

Use an Azure Storage Queue instead of Service Bus. Set the function's batchSize to 10.

Answer

Disable retries completely to avoid duplicate processing.

Answer

Set the function to run on a fixed instance count of 3.

Question 13

You are developing a .NET Core application that needs to authenticate users via Microsoft Entra ID and call Microsoft Graph API. You register an app in the Microsoft Entra admin center and configure the necessary permissions. However, when the app tries to acquire a token, it receives an 'interaction_required' error. What is the most likely cause?

Accepted Answer

The application is requesting admin-restricted permissions without admin consent.. The 'interaction_required' error occurs when the application requests permissions that require admin consent, but the user is not an admin or admin consent has not been granted. In Microsoft Entra ID, certain Graph API permissions (e.g., User.Read.All, Mail.Read) are marked as admin-restricted and require an admin to consent via the admin consent endpoint. Without this consent, the token acquisition fails with this specific error.

Answer

The client secret is expired or invalid.

Answer

The scope parameter is incorrectly formatted.

Answer

The redirect URI does not match the registered redirect URI.

Question 14

You are designing a solution to securely store connection strings for an Azure Function app that connects to Azure Service Bus. The connection string contains a Shared Access Key. The company policy requires that secrets be rotated every 90 days and that no secret is stored in source code or configuration files. The solution should minimize operational overhead. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a managed identity to access it from the Function app.. Azure Key Vault provides a centralized, secure store for secrets like connection strings, and using a managed identity allows the Azure Function app to authenticate to Key Vault without storing any credentials in code or configuration. This approach satisfies the rotation policy by enabling automatic or scheduled secret rotation in Key Vault, and it minimizes operational overhead by eliminating manual credential management.

Answer

Store the connection string in a JSON configuration file and use Azure Policy to enforce encryption.

Answer

Store the connection string in Azure App Configuration with encryption at rest using a customer-managed key.

Answer

Store the connection string as an environment variable in the Function app's application settings.

Question 15

You are developing a web application that uses Azure Cosmos DB for NoSQL. You need to perform a point read by document ID and partition key. Which API method should you use to achieve the best performance and lowest cost?

Accepted Answer

Call ReadItemAsync with the partition key and document ID.. The `ReadItemAsync` method is the most efficient way to perform a point read in Azure Cosmos DB for NoSQL because it directly accesses the document by its partition key and ID, using the resource ID (self-link) for a single request unit (RU) cost of exactly 1 RU for a 1 KB document. This bypasses the query engine entirely, providing the lowest latency and cost.

Answer

Call QueryAsync with a SQL query that filters by ID.

Answer

Call CreateItemAsync and check for conflict.

Answer

Call ReadManyAsync with a list of IDs.