AZ-204 Connect to and consume Azure services and third-party services Practice Test 17 — 15 Questions

Question 1

You need to send notifications to mobile devices when a new file is uploaded to Azure Blob Storage. Which Azure service should you use to route the event to a notification hub?

Accepted Answer

Azure Event Grid. Option B is correct because Azure Event Grid is designed for event routing from Azure services to handlers like Azure Notification Hubs. Option A is wrong because Azure Service Bus is for messaging. Option C is wrong because Azure Queue Storage is for storage queues. Option D is wrong because Azure Event Hubs is for big data streaming.

Answer

Azure Service Bus

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Question 2

You are developing a solution that needs to consume an external SOAP web service. Which approach should you use to integrate it into a modern .NET Core application?

Accepted Answer

Use the WCF Client (System.ServiceModel) to generate a proxy and call the SOAP service.. Option A is correct because the WCF Client (System.ServiceModel) can be used to consume SOAP services in .NET Core. Option B is wrong because HttpClient is for REST. Option C is wrong because gRPC is for high-performance RPC, not SOAP. Option D is wrong because Azure Logic Apps has a SOAP connector but adds unnecessary complexity.

Answer

Use gRPC client to call the service.

Answer

Use HttpClient to send raw HTTP requests with SOAP envelope.

Answer

Use Azure Logic Apps with a SOAP connector.

Question 3

Your application uses Azure Service Bus topics. You need to ensure that messages are processed in the order they were sent within a session. What must you configure?

Accepted Answer

Enable sessions on the topic and set the SessionId property on messages.. Option B is correct because Service Bus sessions enable FIFO ordering within a session. The sender must set the SessionId property. Option A is wrong because message sessions require sessions to be enabled. Option C is wrong because partitioning is for high availability. Option D is wrong because duplicate detection prevents duplicates but does not guarantee order.

Answer

Enable duplicate detection.

Answer

Enable partitioning on the topic.

Answer

Set the MessageId property to a GUID.

Question 4

Which TWO authentication mechanisms can be used to securely connect an Azure Function app to an Azure SQL Database using managed identities?

Accepted Answer

System-assigned managed identity. System-assigned managed identity and user-assigned managed identity are both supported for Azure SQL Database connections. Service principal and connection strings with keys are not managed identities. Certificate-based authentication is not a managed identity type.

Answer

Service principal with client secret

Answer

Certificate-based authentication

Answer

Connection string with access key

Question 5

Which THREE Azure services can be used to securely store and retrieve secrets, connection strings, and API keys for a cloud-native application?

Accepted Answer

Azure App Configuration. Azure Key Vault, Azure App Configuration, and Azure Managed HSM are designed to store secrets and configuration securely. Azure Cosmos DB and Azure Blob Storage are not primarily for secret management.

Answer

Azure Blob Storage

Answer

Azure Cosmos DB

Question 6

Which TWO authentication methods can be used to call a Microsoft Entra ID-protected web API from a client application?

Accepted Answer

OAuth 2.0 client credentials flow. OAuth 2.0 authorization code flow with PKCE and client credentials flow are both supported for web API access. Implicit flow is deprecated. SAML and Basic auth are not standard for Entra ID API calls.

Answer

HTTP Basic authentication

Answer

OAuth 2.0 implicit flow

Answer

SAML 2.0 bearer assertion flow

Question 7

Which THREE Azure services can be used to send email notifications from an application?

Accepted Answer

Azure Logic Apps. Azure Logic Apps, Azure Functions (with SendGrid), and Azure Communication Services Email can send emails. Azure Event Grid and Azure Service Bus are messaging/event services, not email.

Answer

Azure Event Grid

Answer

Azure Service Bus

Question 8

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

Accepted Answer

Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.. Enable system-assigned managed identity on the Function app, then grant that identity 'Get' and 'List' permissions on the Key Vault secrets. The code uses DefaultAzureCredential to authenticate. Option A is correct. Option B requires storing a client ID, not fully secret-free. Option C requires storing certificate thumbprint. Option D requires storing connection string.

Answer

Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

Answer

Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

Answer

Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

Question 9

Northwind Traders is building a microservices architecture on Azure Kubernetes Service (AKS). One service needs to read messages from an Azure Service Bus queue and write them to an Azure SQL database. The solution must use managed identities for authentication. The AKS cluster is integrated with Microsoft Entra ID. The development team wants to avoid managing service principals and secrets. The team has chosen to use the Azure Identity SDK for authentication. The service will run as a pod in AKS. Which approach should the team use to authenticate to Service Bus and Azure SQL Database?

Accepted Answer

Deploy Azure AD Pod Identity (or Workload Identity) to assign a user-assigned managed identity to the pod. Use DefaultAzureCredential in the code. Grant the identity 'Listen' on Service Bus and 'Connect' on SQL Database.. Use Azure AD Pod Identity or Workload Identity to assign a managed identity to the pod. The code uses DefaultAzureCredential to authenticate to both Service Bus (via Azure.Messaging.ServiceBus) and SQL (via Microsoft.Data.SqlClient). Option A is correct. Option B uses a service principal with secret, not managed identity. Option C uses connection strings. Option D uses certificate, not managed identity.

Answer

Generate a self-signed certificate, upload it to AKS, and use ClientCertificateCredential in the code.

Answer

Store Service Bus connection string and SQL connection string in Azure Key Vault. Use Key Vault SDK to retrieve them at runtime.

Answer

Create a service principal and store its client secret in a Kubernetes secret. Use ClientSecretCredential in the code. Assign the service principal permissions to Service Bus and SQL.

Question 10

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

Accepted Answer

Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.. Enable system-assigned managed identity on the Function app, then assign the 'Storage Blob Data Contributor' role to the identity on the storage account. Remove the connection string from app settings. Use DefaultAzureCredential in code. Option A is correct. Option B is for user-assigned but unnecessary; still correct but not simplest. Option C uses access keys. Option D uses SAS token.

Answer

Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

Answer

Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

Question 11

Adventure Works is developing a payment processing system on Azure. The system uses an Azure Service Bus queue to decouple the frontend from the backend. The frontend sends a message to the queue. A backend service, running as an Azure WebJob, processes the message and calls a third-party payment gateway via HTTPS. The backend must authenticate to the payment gateway using a client certificate stored in Azure Key Vault. The WebJob must be able to access the certificate without storing any secrets in configuration. The WebJob runs in an App Service plan with system-assigned managed identity enabled. Which approach should the team use to retrieve the certificate and authenticate to the payment gateway?

Accepted Answer

In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.. Use the Key Vault SDK with DefaultAzureCredential to download the certificate as X509Certificate2. Use that certificate in HttpClientHandler. Option A is correct. Option B uses a secret identifier, but certificate with private key is better. Option C uses connection strings. Option D uses a service principal with secret.

Answer

Store the certificate as a .pfx file in a blob container with a SAS token. Download the blob using the SAS token and load the certificate.

Answer

Create a service principal with a client secret, store the secret in Key Vault. Use ClientSecretCredential to authenticate to Key Vault and retrieve the certificate.

Answer

Store the certificate thumbprint in application settings. Use the Azure App Service certificate store to load the certificate by thumbprint.

Question 12

Tailwind Traders uses Azure Logic Apps to orchestrate a multi-step business process. The workflow must call an external REST API that requires OAuth 2.0 authentication. The API is registered in Microsoft Entra ID. The Logic App must authenticate using a system-assigned managed identity. The API's app registration has been configured to accept tokens from the managed identity. Which connector should the team use in the Logic App to call the API, and how should they configure authentication?

Accepted Answer

Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.. Use the HTTP connector with 'Managed Identity' authentication type. Select the system-assigned identity. Option A is correct. Option B uses 'Active Directory OAuth' which requires client credentials. Option C uses API Management, unnecessary. Option D uses custom connector, overkill.

Answer

Use the HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret of a service principal.

Answer

Use the custom connector. In the custom connector's authentication, choose 'Managed Identity' and provide the managed identity's principal ID.

Answer

Use the Azure API Management connector. Configure it to use OAuth 2.0 with the managed identity.

Question 13

Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?

Accepted Answer

Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.. For Event Hubs, the managed identity needs 'Azure Event Hubs Data Receiver' role. For Blob Storage, it needs 'Storage Blob Data Contributor' role. Option A is correct. Option B has wrong roles. Option C uses wrong roles. Option D has wrong roles.

Answer

Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.

Answer

Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.

Answer

Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.

Question 14

Litware Inc. has an Azure App Service web app that needs to authenticate users via Microsoft Entra ID. The app uses the Microsoft Authentication Library (MSAL) for .NET. The app must also call Microsoft Graph to read user profiles. The app is registered in Entra ID with delegated permissions for 'User.Read'. The team wants to use the OAuth 2.0 authorization code flow with PKCE. The redirect URI is set to the App Service's URL. The app uses the App Service Authentication feature (EasyAuth) and also custom code. The team notices that after signing in, the app receives an ID token but not an access token for Microsoft Graph. What is the most likely cause?

Accepted Answer

The App Service Authentication feature is not configured to request the 'User.Read' scope. The team must add the scope in the 'Allowed external redirect URLs' or configure the 'Additional login parameters' to include 'scope=User.Read'.. The App Service Authentication feature (EasyAuth) by default only requests the 'openid' and 'profile' scopes. It does not request the 'User.Read' scope for Graph unless configured. The team must configure the 'Allowed token audiences' or scopes in the EasyAuth settings. Option A is correct. Option B is wrong because the app registration does include the scope. Option C is wrong because PKCE is not the issue. Option D is wrong because the redirect URI is correct.

Answer

The app registration in Entra ID is missing the 'User.Read' delegated permission. The team must grant admin consent for the permission.

Answer

The authorization code flow with PKCE is not supported by App Service Authentication. The team should use the implicit flow.

Answer

The redirect URI is incorrect. The team must use the App Service's authentication endpoint instead of the app's URL.

Question 15

Wide World Importers has an Azure API Management (APIM) instance that exposes several APIs. One API is a custom REST API hosted on an Azure App Service. The API requires authentication via a subscription key. APIM is configured to require subscription keys for all APIs. The team wants to offload authentication to APIM so that backend services do not need to validate keys. However, the backend API also needs to know the identity of the calling application for logging. The team decides to use APIM's OAuth 2.0 authorization with Microsoft Entra ID. The backend API should receive the JWT token from APIM. How should the team configure APIM to pass the token to the backend?

Accepted Answer

In the inbound processing policy, add a 'validate-jwt' policy to validate the token. Then add a 'set-header' policy to copy the token from the Authorization header (or from the context) and forward it to the backend.. Use the 'validate-jwt' policy to validate the token, and then use 'set-header' policy to forward the token in the Authorization header. Option A is correct. Option B uses client certificate, not token. Option C removes subscription key but not pass token. Option D uses IP filtering, not token.

Answer

Use the 'ip-filter' policy to restrict access to known IPs. The backend trusts requests from APIM's IP.

Answer

Remove the subscription key requirement for that API. APIM will not pass any authentication information to the backend.

Answer

Configure APIM to use client certificate authentication for the backend. The certificate is presented to the backend, which extracts the identity from the certificate.