AZ-204 Connect to and consume Azure services and third-party services Practice Test 16 — 15 Questions

Question 1

Your company uses Azure API Management to expose APIs to external partners. You need to implement rate limiting per subscription key to prevent abuse, but you also want to allow burst traffic up to a certain limit. Which policy should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a 'rate-limit' policy with a renewal period of 60 seconds and a burst count of 10.. The 'rate-limit' policy in Azure API Management allows you to set a rate limit (e.g., requests per 60 seconds) with a burst count, enabling short bursts of traffic beyond the steady-state limit. When applied at the product scope, it effectively enforces per-subscription throttling, meeting the requirement to prevent abuse while allowing burst traffic.

Answer

Add a 'quota-per-key' policy with a renewal period of 1 day.

Answer

Add a 'limit' policy with a condition on subscription key.

Answer

Add a 'rate-limit-by-key' policy with a counter key of 'subscription-key'.

Question 2

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

Accepted Answer

Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.. Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Answer

Use the Azure SDK to poll for new blobs from within a continuously running background service.

Answer

Use an Azure VM running a scheduled task to poll for new blobs and perform validation.

Answer

Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.

Question 3

You need to send email notifications from an Azure Function app when a new user registers in your application hosted on Azure App Service. Which Azure service should you use to send the emails?

Accepted Answer

SendGrid. SendGrid is a cloud-based email delivery service that integrates directly with Azure Functions via an output binding, making it the simplest and most cost-effective option for sending transactional emails like registration notifications. It handles SMTP relay, deliverability, and scaling without requiring a dedicated email server or complex configuration.

Answer

Microsoft 365 SMTP relay

Answer

Azure Communication Services

Answer

Azure Logic Apps

Question 4

You are deploying a microservices application to Azure Kubernetes Service (AKS). One service needs to retrieve configuration values from Azure App Configuration. The configuration includes sensitive values that must be stored in Azure Key Vault. The solution should not require application code changes to reference Key Vault. What should you use?

Accepted Answer

Store the configuration values as Key Vault references in Azure App Configuration.. Azure App Configuration supports Key Vault references, which allow you to store a reference to a secret in Key Vault rather than the secret itself. When the application retrieves the configuration value, App Configuration automatically resolves the reference and fetches the secret from Key Vault, requiring no code changes. This satisfies the requirement of storing sensitive values in Key Vault while keeping the application code unchanged.

Answer

Use Azure AD managed identity to access Key Vault directly from the service.

Answer

Store the secrets in Kubernetes Secrets and mount them as environment variables.

Answer

Use the Azure Key Vault SDK directly in the service to retrieve secrets.

Question 5

You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and configure automatic rotation.. Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.

Answer

Store the connection string as an environment variable in the App Service.

Answer

Store the connection string in a web.config file with encrypted configuration.

Answer

Store the connection string in Azure App Configuration and use a managed identity.

Question 6

You are designing a solution that processes orders from an e-commerce website. The solution must guarantee that each order is processed exactly once. Which TWO Azure services can you use to achieve this requirement?

Accepted Answer

Azure Service Bus. Azure Service Bus supports sessions and message deferral, which enable exactly-once processing by ensuring that a message is not removed from the queue until the consumer explicitly completes it after successful processing. If the consumer fails, the message becomes visible again, preventing duplicate processing. This guarantee is achieved through the Peek-Lock receive mode and the use of duplicate detection, which automatically discards duplicate messages within a defined time window.

Answer

Azure Storage Queues

Answer

Azure Event Grid

Answer

Azure Cache for Redis

Question 7

Your company uses Azure API Management to expose APIs to external partners. You need to implement rate limiting per subscription key to prevent abuse, but you also want to allow burst traffic up to a certain limit. Which policy should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

cache-store. (cache-store) is correct because it is part of the caching policy in Azure API Management. When combined with cache-lookup, it stores the response in the internal or external cache after the backend has processed the request, reducing latency and backend load for subsequent identical requests. This directly supports the requirement to improve performance by caching responses.

Answer

set-header

Answer

rate-limit

Question 8

You are a developer at Contoso Ltd. The company has an existing .NET Core web application hosted on Azure App Service that allows users to upload images. The application currently stores images directly to Azure Blob Storage using connection strings stored in the Web.config file. The security team has mandated that all secrets must be stored in Azure Key Vault and rotated automatically. Additionally, the application must be able to access the Key Vault without storing any credentials in the application code or configuration files. The application uses Microsoft Entra ID for user authentication. You need to modify the application to meet these requirements with minimal changes to the application code. You have the following resources: an Azure Key Vault instance with the secrets (storage account connection string) already stored; a managed identity enabled for the App Service. You want to use the Key Vault references feature of Azure App Configuration or direct Key Vault access. Which approach should you take?

Accepted Answer

In the Azure portal, update the App Service application settings to reference the Key Vault secrets using the Key Vault references feature. Enable the system-assigned managed identity for the App Service and grant it Get and List permissions on the Key Vault.. It uses the Key Vault references feature in Azure App Service, which allows you to reference secrets stored in Key Vault directly from application settings without any code changes. By enabling the system-assigned managed identity and granting it Get and List permissions on the Key Vault, the App Service can authenticate to Key Vault without storing any credentials in code or configuration files. This approach meets the security team's mandate for automatic secret rotation (Key Vault references are resolved at runtime, so rotated secrets are automatically picked up) and requires minimal changes to the application code.

Answer

Set the connection string as an environment variable in the App Service using the Azure CLI and rely on the Key Vault backup.

Answer

Create an Azure App Configuration store, import the secrets from Key Vault, and change the application to use the App Configuration provider.

Answer

Modify the application code to use the Azure Identity SDK to authenticate to Key Vault via managed identity and retrieve the connection string.

Question 9

Your company is building a real-time dashboard that displays sales data from multiple stores. The data is generated as events from point-of-sale systems and must be ingested with low latency. The dashboard needs to display aggregated data (e.g., total sales per store per minute) with a maximum delay of 5 seconds from event generation. You have decided to use Azure Event Hubs for ingestion and Azure Stream Analytics for real-time processing. The processed data will be stored in Azure Cosmos DB for the dashboard to query. However, the dashboard requires that the data in Cosmos DB be updated as soon as new aggregations are available. You need to design the output from Azure Stream Analytics to Cosmos DB. Which output configuration should you use?

Accepted Answer

Configure the output to use Cosmos DB SQL API with the document ID set to a concatenation of store ID and minute timestamp, and enable upsert.. It uses the Cosmos DB SQL API with a document ID that uniquely identifies each aggregation (store ID + minute timestamp), and enables upsert. This ensures that when Stream Analytics emits a new aggregation for the same store and minute, it overwrites the existing document, providing low-latency updates to the dashboard. The SQL API supports native upsert semantics, which is the most direct and efficient way to achieve real-time updates without additional services or complex logic.

Answer

Configure the output to use Cosmos DB MongoDB API and use a unique index on store ID and timestamp.

Answer

Output to Azure Cosmos DB Table API with a partition key of store ID.

Answer

Write the output to Azure Blob Storage and use an Azure Function triggered by blob creation to update Cosmos DB.

Question 10

You are developing a mobile app backend using Azure Functions. The app allows users to upload profile pictures. The pictures are stored in Azure Blob Storage and the metadata (user ID, blob URL, upload timestamp) is stored in Azure SQL Database. You need to implement a process that automatically generates a thumbnail for each uploaded picture and updates the metadata with the thumbnail URL. The thumbnail generation is CPU-intensive and may take up to 30 seconds per image. The solution should be serverless and cost-effective. Which combination of Azure services should you use?

Accepted Answer

Use an Azure Blob Storage trigger to invoke an Azure Function that generates the thumbnail and updates Azure SQL Database.. Azure Blob Storage triggers are designed to invoke an Azure Function automatically when a new blob is created, which is ideal for this serverless, event-driven workflow. The function can generate the thumbnail (even with a 30-second CPU-intensive task, as Azure Functions support up to 10-minute execution on the Premium plan) and then update the Azure SQL Database with the thumbnail URL, all without managing infrastructure.

Answer

Use an Azure VM with a scheduled task to poll for new blobs and generate thumbnails.

Answer

Use an Azure Queue Storage trigger to invoke an Azure Function that processes the image and updates Azure SQL Database.

Answer

Use Azure Event Grid to trigger an Azure Logic App that generates the thumbnail and updates Azure SQL Database.

Question 11

You are developing an app that processes orders. When an order is placed, you need to send a confirmation email and update an inventory database. The email service may be slow but must not delay the order processing. Which approach should you use?

Accepted Answer

Send the email asynchronously via a queue (e.g., Azure Queue Storage).. Sending the email asynchronously via a queue (e.g., Azure Queue Storage) decouples the slow email service from the order processing workflow. This ensures the order processing completes immediately without waiting for the email to be sent, meeting the requirement that the email must not delay order processing.

Answer

Scale out the email service to handle the load.

Answer

Use Azure Event Grid to trigger the email.

Answer

Call the email service synchronously and wait for the response.

Question 12

You are deploying a microservice that needs to read secrets (e.g., connection strings) from Azure Key Vault. The service runs on Azure Kubernetes Service (AKS). You want to minimize code changes and automatically rotate secrets. Which approach should you use?

Accepted Answer

Use the Azure Key Vault Provider for Secrets Store CSI Driver on AKS.. The Azure Key Vault Provider for Secrets Store CSI Driver mounts secrets as volumes or environment variables in AKS pods without requiring application code changes. It automatically rotates secrets by syncing with Key Vault at a configurable polling interval, minimizing code changes and enabling seamless secret rotation.

Answer

Use the Azure Key Vault SDK in the application code to fetch secrets.

Answer

Store secrets as environment variables in the container image.

Answer

Use Azure App Configuration with Key Vault references.

Question 13

Your Azure Function app processes messages from an Azure Service Bus queue. The function is triggered by Service Bus messages. Occasionally, the function throws an unhandled exception after the message is processed but before the function completes. What happens to the message?

Accepted Answer

The message is abandoned and becomes available for other consumers after the lock duration expires.. In Azure Functions with a Service Bus trigger, the function runtime manages the lock on the message. If an unhandled exception occurs after the message has been processed but before the function returns, the runtime interprets this as a failure to complete the message. As a result, the message is abandoned, meaning the lock is released, and the message becomes available for redelivery to other consumers after the lock duration expires. This behavior ensures that messages are not lost but can be retried.

Answer

The message is moved to the dead-letter queue.

Answer

The message is completed automatically despite the exception.

Answer

The message is automatically removed from the queue.

Question 14

You need to expose an on-premises API securely to external partners without opening firewall ports. Which Azure service should you use?

Accepted Answer

Azure API Management. Azure API Management is the correct choice because it acts as a secure gateway for exposing on-premises APIs to external partners without opening firewall ports. It can connect to on-premises backends via a VPN or Azure ExpressRoute, and it handles authentication, throttling, and transformation at the gateway layer, keeping the internal network isolated.

Answer

Azure Traffic Manager

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 15

Your application uses Azure Cosmos DB for NoSQL. You need to query items by a property that is not the partition key. The container has 10,000 RU/s. How can you optimize this query to minimize cost and latency?

Accepted Answer

Create a composite index that includes the property and the partition key.. Creating a composite index that includes the queried property and the partition key allows the query to be served efficiently from a single physical partition, avoiding a costly cross-partition fan-out. This reduces both RU consumption and latency, as the query can use the index without scanning all partitions.

Answer

Increase the RU/s to handle cross-partition queries.

Answer

Change the partition key to the property you query on.

Answer

Enable analytical store and use Synapse Link.