AZ-204 Connect to and consume Azure services and third-party services Practice Test 16 — 15 Questions

Question 1

You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?

Accepted Answer

In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.. The correct approach is to use Key Vault references in the App Service application settings. This allows you to reference a secret stored in Key Vault using a syntax like @Microsoft.KeyVault(SecretUri=...). The App Service will automatically retrieve the secret using the system-assigned managed identity, and no code changes are required. Option A is correct. Option B is incorrect because using App Configuration would require additional setup and code changes to reference the configuration. Option C is incorrect because manually retrieving secrets via SDK requires code changes. Option D is incorrect because environment variables set directly are not rotated automatically.

Answer

Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.

Answer

Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.

Answer

Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.

Question 2

Your company is building a real-time dashboard that displays sales data from multiple stores. The data is generated as events from point-of-sale systems and must be ingested with low latency. The dashboard needs to display aggregated data (e.g., total sales per store per minute) with a maximum delay of 5 seconds from event generation. You have decided to use Azure Event Hubs for ingestion and Azure Stream Analytics for real-time processing. The processed data will be stored in Azure Cosmos DB for the dashboard to query. However, the dashboard requires that the data in Cosmos DB be updated as soon as new aggregations are available. You need to design the output from Azure Stream Analytics to Cosmos DB. Which output configuration should you use?

Accepted Answer

Configure the output to use Cosmos DB SQL API with the document ID set to a concatenation of store ID and minute timestamp, and enable upsert.. Azure Stream Analytics can output to Cosmos DB. To ensure low latency and upserts, you should configure the output to use the Cosmos DB SQL API with a document ID that is a composite key (e.g., storeId + timestamp) to enable upserts. Option A is correct because it specifies the correct API and upsert configuration. Option B is incorrect because the MongoDB API may not support the same performance guarantees. Option C is incorrect because writing to Blob Storage and then using a trigger introduces additional latency. Option D is incorrect because Table API is not suitable for the required query patterns.

Answer

Configure the output to use Cosmos DB MongoDB API and use a unique index on store ID and timestamp.

Answer

Output to Azure Cosmos DB Table API with a partition key of store ID.

Answer

Write the output to Azure Blob Storage and use an Azure Function triggered by blob creation to update Cosmos DB.

Question 3

You are developing a mobile app backend using Azure Functions. The app allows users to upload profile pictures. The pictures are stored in Azure Blob Storage and the metadata (user ID, blob URL, upload timestamp) is stored in Azure SQL Database. You need to implement a process that automatically generates a thumbnail for each uploaded picture and updates the metadata with the thumbnail URL. The thumbnail generation is CPU-intensive and may take up to 30 seconds per image. The solution should be serverless and cost-effective. Which combination of Azure services should you use?

Accepted Answer

Use an Azure Blob Storage trigger to invoke an Azure Function that generates the thumbnail and updates Azure SQL Database.. An Azure Blob Storage trigger can start an Azure Function on blob creation. The function can generate the thumbnail and then update the metadata in Azure SQL Database. This is serverless and scales automatically. Option A is correct. Option B is incorrect because Event Grid can also trigger a function, but the Blob Storage trigger is simpler and directly tied to blob events. Option C is incorrect because using a queue adds unnecessary complexity. Option D is incorrect because using a VM is not serverless.

Answer

Use an Azure VM with a scheduled task to poll for new blobs and generate thumbnails.

Answer

Use an Azure Queue Storage trigger to invoke an Azure Function that processes the image and updates Azure SQL Database.

Answer

Use Azure Event Grid to trigger an Azure Logic App that generates the thumbnail and updates Azure SQL Database.

Question 4

You are developing an app that processes orders. When an order is placed, you need to send a confirmation email and update an inventory database. The email service may be slow but must not delay the order processing. Which approach should you use?

Accepted Answer

Send the email asynchronously via a queue (e.g., Azure Queue Storage).. Option A is correct because queuing the email send decouples the email service from the order processing, allowing the inventory update to proceed immediately. Option B is wrong because synchronous calls would block the order processing. Option C is wrong because the email service is external and cannot be scaled by your app. Option D is wrong because Event Grid is for event-driven architectures but does not provide a queue for work items.

Answer

Scale out the email service to handle the load.

Answer

Use Azure Event Grid to trigger the email.

Answer

Call the email service synchronously and wait for the response.

Question 5

You are deploying a microservice that needs to read secrets (e.g., connection strings) from Azure Key Vault. The service runs on Azure Kubernetes Service (AKS). You want to minimize code changes and automatically rotate secrets. Which approach should you use?

Accepted Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver on AKS.. Option B is correct because the CSI driver allows mounting secrets as volumes or environment variables with automatic rotation without code changes. Option A is wrong because it requires code changes to call the SDK. Option C is wrong because storing secrets in environment variables is insecure. Option D is wrong because Azure App Configuration is for configuration, not secrets.

Answer

Use the Azure Key Vault SDK in the application code to fetch secrets.

Answer

Store secrets as environment variables in the container image.

Answer

Use Azure App Configuration with Key Vault references.

Question 6

Your Azure Function app processes messages from an Azure Service Bus queue. The function is triggered by Service Bus messages. Occasionally, the function throws an unhandled exception after the message is processed but before the function completes. What happens to the message?

Accepted Answer

The message is abandoned and becomes available for other consumers after the lock duration expires.. Option C is correct because the Service Bus trigger completes the message only when the function runs successfully to completion. If an exception occurs, the message is abandoned and becomes visible again after the lock duration expires, causing it to be retried. Option A is wrong because the message is not dead-lettered on exception; it is retried. Option B is wrong because the message is not automatically removed; it remains in the queue. Option D is wrong because the message is not automatically completed.

Answer

The message is moved to the dead-letter queue.

Answer

The message is completed automatically despite the exception.

Answer

The message is automatically removed from the queue.

Question 7

You need to expose an on-premises API securely to external partners without opening firewall ports. Which Azure service should you use?

Accepted Answer

Azure API Management. Option D is correct because Azure API Management can expose APIs securely and integrate with on-premises backends via VPN or ExpressRoute. Option A is wrong because Azure Front Door is for global load balancing and CDN, not for exposing on-premises APIs. Option B is wrong because Azure Application Gateway is a regional load balancer with WAF, but not designed for API exposure. Option C is wrong because Azure Traffic Manager is DNS-based load balancing.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 8

Your application uses Azure Cosmos DB for NoSQL. You need to query items by a property that is not the partition key. The container has 10,000 RU/s. How can you optimize this query to minimize cost and latency?

Accepted Answer

Create a composite index that includes the property and the partition key.. Option B is correct because creating a composite index on the property and the partition key allows the query to be efficient without a full cross-partition scan. Option A is wrong because changing the partition key is a breaking change. Option C is wrong because increasing RU/s does not solve the indexing issue. Option D is wrong because enabling analytical store is for analytical queries, not transactional.

Answer

Increase the RU/s to handle cross-partition queries.

Answer

Change the partition key to the property you query on.

Answer

Enable analytical store and use Synapse Link.

Question 9

You are using Azure Logic Apps to orchestrate a workflow that calls a third-party API. The API occasionally returns HTTP 429 (Too Many Requests). How should you handle this to ensure the workflow completes successfully without manual intervention?

Accepted Answer

Configure a retry policy on the HTTP action with exponential backoff.. Option A is correct because Logic Apps built-in retry policy with exponential backoff handles 429 automatically. Option B is wrong because changing to sequential calls reduces throughput but does not handle retries. Option C is wrong because increasing timeout does not retry. Option D is wrong because using webhook is for async patterns, not retry.

Answer

Increase the timeout value for the HTTP request.

Answer

Change the concurrency setting to 1 to avoid multiple requests.

Answer

Use a webhook action instead of HTTP.

Question 10

You need to authenticate an Azure Function app to call Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you use?

Accepted Answer

Authorization code flow with PKCE. Option C is correct because the authorization code flow is for apps that need to authenticate a user and get an access token for APIs like Graph. Option A is wrong because client credentials flow is for daemon apps without a user. Option B is wrong because device code flow is for devices without a browser. Option D is wrong because implicit flow is deprecated.

Answer

Device code flow

Answer

Client credentials flow

Answer

Implicit flow

Question 11

Your company uses Azure Blob Storage to store sensitive documents. You need to ensure that all access to the storage account is encrypted in transit and that clients must use TLS 1.2 or higher. Which configuration should you enforce?

Accepted Answer

Set the 'Minimum TLS version' to 1.2 in the storage account's configuration.. Option B is correct because the 'Minimum TLS version' property on the storage account enforces TLS 1.2 for all requests. Option A is wrong because HTTPS-only is already default but doesn't enforce TLS version. Option C is wrong because firewall rules control network access, not encryption. Option D is wrong because private endpoint ensures private connectivity but not TLS version.

Answer

Use a private endpoint for the storage account.

Answer

Configure network rules to allow only from trusted IPs.

Answer

Enable 'Secure transfer required' (HTTPS only).

Question 12

You have an Azure App Service web app that uses Azure SQL Database. The connection string is stored in Azure Key Vault. You need to automatically rotate the database password every 30 days without app downtime. Which solution should you implement?

Accepted Answer

Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.. Option D is correct because storing the connection string as a Key Vault reference in App Service configuration allows automatic rotation without restart. Option A is wrong because updating the connection string in code requires redeployment. Option B is wrong because updating App Service settings via CLI does not support automatic rotation. Option C is wrong because using Managed Identity avoids passwords but does not rotate them; it's a better approach but the question specifically asks for password rotation without downtime.

Answer

Use Azure CLI to update the connection string in App Service settings.

Answer

Use Managed Identity to access SQL Database instead of a password.

Answer

Update the connection string in the application code and redeploy.

Question 13

Which TWO Azure services can be used to securely store and retrieve secrets, such as API keys and connection strings, for use in cloud applications?

Accepted Answer

Azure Key Vault. A and D are correct. Azure Key Vault is designed for secrets management. Azure App Configuration can store Key Vault references, effectively storing secrets securely. Option B is wrong because Azure Blob Storage is not designed for secrets; it stores blobs. Option C is wrong because Azure Cosmos DB is a NoSQL database. Option E is wrong because Azure SQL Database is a relational database.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 14

Which TWO approaches can you use to call an external REST API from an Azure Function while ensuring the API key is not exposed in the function code?

Accepted Answer

Store the API key as an environment variable in the function app settings.. B and D are correct. Storing the API key in Key Vault and using Managed Identity to access it ensures the key is not in code. Using environment variables in App Service (function app settings) also keeps the key out of code. Option A is wrong because hardcoding is direct exposure. Option C is wrong because storing in GitHub Secrets is for CI/CD, not runtime. Option E is wrong because using HTTP headers with a hardcoded key still exposes it.

Answer

Store the API key in GitHub repository secrets.

Answer

Hardcode the API key in the function code.

Answer

Pass the API key in an HTTP header and include it in the source code.

Question 15

Which THREE Azure services or features can be used to implement retry logic for transient failures when calling an external API from a .NET Core application?

Accepted Answer

Azure SDK retry policies. A, B, and D are correct. Polly is a .NET library for retry logic. Azure SDKs include built-in retry policies. Azure Logic Apps provides retry policies for connectors. Option C is wrong because Azure Traffic Manager is for DNS load balancing, not retry logic. Option E is wrong because Azure Front Door is a global load balancer, not for application-level retry.

Answer

Azure Traffic Manager

Answer

Azure Front Door