AZ-204 Connect to and consume Azure services and third-party services Practice Test 16 — 15 Questions

Question 1

You have an Azure API Management instance that exposes a REST API. You need to secure the API using OAuth 2.0 with Microsoft Entra ID. The API should accept tokens from multiple client applications. Which policy should you add to the inbound processing section?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

. The policy is the correct choice because it validates the OAuth 2.0 token presented in the Authorization header, ensuring that only requests with valid tokens from Microsoft Entra ID are processed. This policy checks the token's signature, issuer, audience, and expiration, and returns a 401 status code if validation fails, which is essential for securing the API against unauthorized access from multiple client applications.

Answer

<xml-to-json>

Answer

<rate-limit>

Answer

<cache-lookup>

Question 2

You are building a solution that uses Azure Cosmos DB for NoSQL. You need to implement a change feed processor to handle real-time updates. The application runs on multiple instances to ensure high availability. Which lease container configuration ensures that each instance processes a distinct set of partitions?

Accepted Answer

Use a separate lease container with partition key /id. The change feed processor uses a lease container to track which partitions each instance is processing. By setting the partition key to /id, each lease document is uniquely identified, allowing the processor to distribute partitions across instances. This ensures that each instance processes a distinct set of partitions, enabling horizontal scaling without duplication.

Answer

Set the partition key of the monitored container to /city

Answer

Configure the change feed to start from the beginning

Answer

Set the lease container's throughput to 1000 RU/s

Question 3

You are using Azure Blob Storage to store large media files. Clients upload files directly to the storage account using SAS tokens. You need to ensure that the SAS token expires 1 hour after creation. Which parameter should you set when generating the SAS token?

Accepted Answer

SignedExpiry (se). The SignedExpiry (se) parameter explicitly defines the expiration time of a SAS token. When generating a SAS token for Azure Blob Storage, setting 'se' to a UTC time 1 hour from creation ensures the token is valid only for that duration, meeting the requirement that clients can upload files directly using the SAS token for exactly 1 hour.

Answer

SignedProtocol (spr)

Answer

IP range (sip)

Answer

SignedStart (st)

Question 4

You are developing a .NET Core application that uses Azure Service Bus queues. You need to implement a dead-lettering mechanism for messages that cannot be processed after 5 delivery attempts. Which property should you set on the queue to automate this?

Accepted Answer

maxDeliveryCount. The maxDeliveryCount property on an Azure Service Bus queue defines the maximum number of attempts to deliver a message before it is automatically moved to the dead-letter queue. Setting this property to 5 ensures that after five failed delivery attempts, the message is dead-lettered, meeting the requirement without custom code.

Answer

defaultMessageTimeToLive

Answer

lockDuration

Answer

requiresDuplicateDetection

Question 5

You are designing a solution that uses Azure Event Grid to handle events from multiple Azure services. The events must be filtered and routed to different endpoints based on event type. Which component should you use to filter events before they are sent to subscribers?

Accepted Answer

Event subscription with filters. C is correct because Event Subscriptions in Azure Event Grid allow you to define filters on event types, subject prefixes/suffixes, and advanced filtering (e.g., based on data fields) to control which events are delivered to each subscriber. This filtering happens before the events are sent to the endpoint, ensuring only matching events are routed.

Answer

Event grid domain

Answer

Event grid topic

Answer

Event handler

Question 6

You need to authenticate an Azure Function to an Azure SQL Database using a managed identity. The function has a system-assigned managed identity enabled. Which connection string setting should you use in the function's application settings?

Accepted Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;. The connection string `Authentication=Active Directory Managed Identity` tells the SQL client to use the system-assigned managed identity of the Azure Function to acquire an access token from Microsoft Entra ID, without needing any explicit credentials. This is the standard way to authenticate an Azure resource with a managed identity to Azure SQL Database.

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Password;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;User Id=myuser;Password=mypassword;

Answer

Server=tcp:myserver.database.windows.net;Database=mydb;Authentication=Active Directory Managed Identity;User Id=<client-id>;

Question 7

Which TWO actions should you take to securely store and retrieve secrets for an Azure App Service application? (Choose two.)

Accepted Answer

Configure a Key Vault access policy for the App Service managed identity. Option A is correct because granting the App Service's system-assigned or user-assigned managed identity an access policy (or RBAC role) on the Key Vault lets the app authenticate to Key Vault without embedding credentials, using the identity token flow. Option C is correct because Azure Key Vault is the dedicated service for securely storing and retrieving secrets, keys, and certificates, with encryption at rest, HSM-backed options, and auditing. Together they form the recommended pattern: store the secret in Key Vault and authorize the app's managed identity to read it. Option B is wrong because plain-text secrets in code are exposed in source control and deployments. Option D is wrong because SAS tokens are for scoped access to Azure Storage resources, not a Key Vault secret-storage mechanism. Option E is wrong because App Service application settings are stored as environment variables in plain text (visible to anyone with portal/ARM read access) and are not a secure secret store.

Answer

Store connection strings as plain text in the application code

Answer

Generate SAS tokens in Key Vault

Answer

Store secrets in the App Service application settings

Question 8

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Accepted Answer

rate-limit policy. The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.

Answer

xml-to-json policy

Answer

cache-lookup policy

Question 9

Refer to the exhibit. You are reviewing an ARM template for a storage account. A security audit requires that all storage accounts enforce TLS 1.2 or higher. Does this configuration meet the requirement?

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2. The `minimumTlsVersion` property in the ARM template explicitly enforces the minimum TLS version for requests to the storage account. Setting it to `TLS1_2` ensures that only TLS 1.2 or higher connections are accepted, meeting the security audit requirement. The `supportsHttpsTrafficOnly` property only enforces HTTPS but does not control the TLS version, so it alone is insufficient.

Answer

No, because supportsHttpsTrafficOnly does not enforce TLS version

Answer

No, because minimumTlsVersion is not a valid property

Answer

No, because the property should be minimumTlsVersion: "1.2"

Question 10

Refer to the exhibit. You are creating an Azure Service Bus queue using an ARM template. The requirement is that messages should be automatically dead-lettered after 3 failed delivery attempts. Does this configuration meet the requirement?

Accepted Answer

No, because maxDeliveryCount should be 3. The `maxDeliveryCount` property in Azure Service Bus determines the number of attempts to deliver a message before it is automatically moved to the dead-letter queue. The requirement specifies 3 failed delivery attempts, so `maxDeliveryCount` must be set to 3. The exhibit shows `maxDeliveryCount` set to 10, which does not meet the requirement.

Answer

No, because lockDuration should be shorter

Answer

Yes, because defaultMessageTimeToLive ensures messages expire

Answer

Yes, because maxDeliveryCount is set

Question 11

You are developing a .NET Core application that needs to authenticate users via Microsoft Entra ID and call Microsoft Graph API. You register an app in the Microsoft Entra admin center and configure the necessary permissions. However, when the app tries to acquire a token, it receives an 'interaction_required' error. What is the most likely cause?

Accepted Answer

The application is requesting admin-restricted permissions without admin consent.. The 'interaction_required' error occurs when the application requests permissions that require admin consent, but the user is not an admin or admin consent has not been granted. In Microsoft Entra ID, certain Graph API permissions (e.g., User.Read.All, Mail.Read) are marked as admin-restricted and require an admin to consent via the admin consent endpoint. Without this consent, the token acquisition fails with this specific error.

Answer

The client secret is expired or invalid.

Answer

The scope parameter is incorrectly formatted.

Answer

The redirect URI does not match the registered redirect URI.

Question 12

You are developing a web application that uses Azure Cosmos DB for NoSQL. You need to perform a point read by document ID and partition key. Which API method should you use to achieve the best performance and lowest cost?

Accepted Answer

Call ReadItemAsync with the partition key and document ID.. The `ReadItemAsync` method is the most efficient way to perform a point read in Azure Cosmos DB for NoSQL because it directly accesses the document by its partition key and ID, using the resource ID (self-link) for a single request unit (RU) cost of exactly 1 RU for a 1 KB document. This bypasses the query engine entirely, providing the lowest latency and cost.

Answer

Call QueryAsync with a SQL query that filters by ID.

Answer

Call CreateItemAsync and check for conflict.

Answer

Call ReadManyAsync with a list of IDs.

Question 13

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

Accepted Answer

Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.. Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Answer

Use the Azure SDK to poll for new blobs from within a continuously running background service.

Answer

Use an Azure VM running a scheduled task to poll for new blobs and perform validation.

Answer

Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.

Question 14

You are deploying a microservices application to Azure Kubernetes Service (AKS). One service needs to retrieve configuration values from Azure App Configuration. The configuration includes sensitive values that must be stored in Azure Key Vault. The solution should not require application code changes to reference Key Vault. What should you use?

Accepted Answer

Store the configuration values as Key Vault references in Azure App Configuration.. Azure App Configuration supports Key Vault references, which allow you to store a reference to a secret in Key Vault rather than the secret itself. When the application retrieves the configuration value, App Configuration automatically resolves the reference and fetches the secret from Key Vault, requiring no code changes. This satisfies the requirement of storing sensitive values in Key Vault while keeping the application code unchanged.

Answer

Use Azure AD managed identity to access Key Vault directly from the service.

Answer

Store the secrets in Kubernetes Secrets and mount them as environment variables.

Answer

Use the Azure Key Vault SDK directly in the service to retrieve secrets.

Question 15

You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and configure automatic rotation.. Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.

Answer

Store the connection string as an environment variable in the App Service.

Answer

Store the connection string in a web.config file with encrypted configuration.

Answer

Store the connection string in Azure App Configuration and use a managed identity.