AZ-204 Connect to and consume Azure services and third-party services Practice Test 17 — 15 Questions

Question 1

You are using Azure Logic Apps to orchestrate a workflow that calls a third-party API. The API occasionally returns HTTP 429 (Too Many Requests). How should you handle this to ensure the workflow completes successfully without manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a retry policy on the HTTP action with exponential backoff.. Azure Logic Apps supports configuring a retry policy on HTTP actions, and using exponential backoff is the standard approach to handle HTTP 429 responses. The retry policy automatically waits for increasing intervals between attempts, respecting the 'Retry-After' header if present, which allows the third-party API to recover from rate limiting without manual intervention.

Answer

Increase the timeout value for the HTTP request.

Answer

Change the concurrency setting to 1 to avoid multiple requests.

Answer

Use a webhook action instead of HTTP.

Question 2

Your company uses Azure Blob Storage to store sensitive documents. You need to ensure that all access to the storage account is encrypted in transit and that clients must use TLS 1.2 or higher. Which configuration should you enforce?

Accepted Answer

Set the 'Minimum TLS version' to 1.2 in the storage account's configuration.. Setting the 'Minimum TLS version' to 1.2 in the storage account's configuration explicitly enforces that all client connections must use TLS 1.2 or higher, rejecting any requests using older, less secure TLS versions. This directly addresses the requirement to ensure encryption in transit with a specific minimum TLS version, as Azure Blob Storage supports TLS 1.0, 1.1, and 1.2 by default, and this setting overrides that default to enforce the higher standard.

Answer

Use a private endpoint for the storage account.

Answer

Configure network rules to allow only from trusted IPs.

Answer

Enable 'Secure transfer required' (HTTPS only).

Question 3

You have an Azure App Service web app that uses Azure SQL Database. The connection string is stored in Azure Key Vault. You need to automatically rotate the database password every 30 days without app downtime. Which solution should you implement?

Accepted Answer

Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.. Key Vault references in App Service application settings allow the web app to dynamically retrieve the connection string from Key Vault at runtime. By enabling Key Vault's auto-rotation feature (e.g., using a rotation function or event grid trigger), the database password can be rotated every 30 days without any app downtime, as the app reads the latest secret on each request or after a cached secret expires.

Answer

Use Azure CLI to update the connection string in App Service settings.

Answer

Use Managed Identity to access SQL Database instead of a password.

Answer

Update the connection string in the application code and redeploy.

Question 4

Which TWO Azure services can be used to securely store and retrieve secrets, such as API keys and connection strings, for use in cloud applications?

Accepted Answer

Azure Key Vault. Azure Key Vault is a dedicated cloud service for securely storing and accessing secrets like API keys, connection strings, and certificates. It provides hardware security module (HSM)-backed encryption, access control via Azure RBAC and access policies, and integrates with Azure services and applications through REST APIs and SDKs.

Azure App Configuration can also be used to securely retrieve secrets. While it primarily stores application settings and feature flags, it supports referencing secrets stored in Azure Key Vault. This allows applications to retrieve secrets securely through App Configuration, leveraging Key Vault's robust security features without directly accessing Key Vault.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 5

Which TWO approaches can you use to call an external REST API from an Azure Function while ensuring the API key is not exposed in the function code?

Accepted Answer

Store the API key as an environment variable in the function app settings.. Storing the API key in the function app settings (environment variables) keeps it out of the source code and allows the function to access it via the `Environment.GetEnvironmentVariable` method at runtime. Option E is correct because Azure Key Vault, combined with a Managed Identity, provides a secure, auditable, and rotation-friendly way to store secrets without embedding them in code or configuration files.

Answer

Store the API key in GitHub repository secrets.

Answer

Hardcode the API key in the function code.

Answer

Pass the API key in an HTTP header and include it in the source code.

Question 6

You need to send notifications to mobile devices when a new file is uploaded to Azure Blob Storage. Which Azure service should you use to route the event to a notification hub?

Accepted Answer

Azure Event Grid. Azure Event Grid is the correct choice because it provides a fully managed event routing service that can react to Blob Storage events (such as 'BlobCreated') and deliver them directly to Azure Notification Hubs. This enables push notifications to mobile devices without polling or custom middleware, using a publish-subscribe model with low latency.

Answer

Azure Service Bus

Answer

Azure Queue Storage

Answer

Azure Event Hubs

Question 7

You are developing a solution that needs to consume an external SOAP web service. Which approach should you use to integrate it into a modern .NET Core application?

Accepted Answer

Use the WCF Client (System.ServiceModel) to generate a proxy and call the SOAP service.. System.ServiceModel (WCF Client) provides built-in support for SOAP protocols, including WS-* standards, message security, and automatic proxy generation from WSDL. In modern .NET Core (and .NET 5+), the WCF client libraries are available via the System.ServiceModel.Http NuGet package, making it the most appropriate and feature-complete way to consume a SOAP service in a .NET Core application.

Answer

Use gRPC client to call the service.

Answer

Use HttpClient to send raw HTTP requests with SOAP envelope.

Answer

Use Azure Logic Apps with a SOAP connector.

Question 8

Your application uses Azure Service Bus topics. You need to ensure that messages are processed in the order they were sent within a session. What must you configure?

Accepted Answer

Enable sessions on the topic and set the SessionId property on messages.. Azure Service Bus sessions provide strict message ordering and exactly-once processing within a session. By enabling sessions on the topic and setting the SessionId property on each message, all messages with the same SessionId are processed in FIFO order, ensuring they are received in the exact sequence they were sent.

Answer

Enable duplicate detection.

Answer

Enable partitioning on the topic.

Answer

Set the MessageId property to a GUID.

Question 9

Which THREE Azure services can be used to send email notifications from an application?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides built-in connectors (e.g., Office 365 Outlook, SMTP, SendGrid) that allow you to design workflows to send email notifications without writing custom code. You can trigger these workflows from various sources (HTTP requests, timers, Azure services) and include conditional logic, making it a serverless, low-code solution for email notifications.

Answer

Azure Event Grid

Answer

Azure Service Bus

Question 10

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

Accepted Answer

Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.. It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.

Answer

Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

Answer

Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

Answer

Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

Question 11

Northwind Traders is building a microservices architecture on Azure Kubernetes Service (AKS). One service needs to read messages from an Azure Service Bus queue and write them to an Azure SQL database. The solution must use managed identities for authentication. The AKS cluster is integrated with Microsoft Entra ID. The development team wants to avoid managing service principals and secrets. The team has chosen to use the Azure Identity SDK for authentication. The service will run as a pod in AKS. Which approach should the team use to authenticate to Service Bus and Azure SQL Database?

Accepted Answer

Deploy Azure AD Pod Identity (or Workload Identity) to assign a user-assigned managed identity to the pod. Use DefaultAzureCredential in the code. Grant the identity 'Listen' on Service Bus and 'Connect' on SQL Database.. Azure AD Pod Identity (or Workload Identity) allows you to assign a user-assigned managed identity to a pod, eliminating the need to manage service principals or secrets. The DefaultAzureCredential from the Azure Identity SDK automatically uses the pod's managed identity to authenticate to Azure services. Granting the identity 'Listen' on Service Bus and 'Connect' on SQL Database provides the minimum required permissions for the service to read messages and write to the database.

Answer

Generate a self-signed certificate, upload it to AKS, and use ClientCertificateCredential in the code.

Answer

Store Service Bus connection string and SQL connection string in Azure Key Vault. Use Key Vault SDK to retrieve them at runtime.

Answer

Create a service principal and store its client secret in a Kubernetes secret. Use ClientSecretCredential in the code. Assign the service principal permissions to Service Bus and SQL.

Question 12

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

Accepted Answer

Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.. It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.

Answer

Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

Answer

Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

Question 13

Adventure Works is developing a payment processing system on Azure. The system uses an Azure Service Bus queue to decouple the frontend from the backend. The frontend sends a message to the queue. A backend service, running as an Azure WebJob, processes the message and calls a third-party payment gateway via HTTPS. The backend must authenticate to the payment gateway using a client certificate stored in Azure Key Vault. The WebJob must be able to access the certificate without storing any secrets in configuration. The WebJob runs in an App Service plan with system-assigned managed identity enabled. Which approach should the team use to retrieve the certificate and authenticate to the payment gateway?

Accepted Answer

In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.. The WebJob can use its system-assigned managed identity to authenticate to Azure Key Vault without storing any secrets. The SecretClient from Azure.Security.KeyVault.Secrets retrieves the certificate as a secret, which can be parsed into an X509Certificate2 object. This certificate is then used in an HttpClientHandler to authenticate to the payment gateway via HTTPS, fulfilling all requirements securely.

Answer

Store the certificate as a .pfx file in a blob container with a SAS token. Download the blob using the SAS token and load the certificate.

Answer

Create a service principal with a client secret, store the secret in Key Vault. Use ClientSecretCredential to authenticate to Key Vault and retrieve the certificate.

Answer

Store the certificate thumbprint in application settings. Use the Azure App Service certificate store to load the certificate by thumbprint.

Question 14

Tailwind Traders uses Azure Logic Apps to orchestrate a multi-step business process. The workflow must call an external REST API that requires OAuth 2.0 authentication. The API is registered in Microsoft Entra ID. The Logic App must authenticate using a system-assigned managed identity. The API's app registration has been configured to accept tokens from the managed identity. Which connector should the team use in the Logic App to call the API, and how should they configure authentication?

Accepted Answer

Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.. The HTTP connector with 'Managed Identity' authentication is the correct choice because the Logic App needs to call an external REST API that accepts tokens from a system-assigned managed identity. By selecting 'Managed Identity' and setting the audience to the API's Application ID URI, the Logic App automatically acquires an access token from Microsoft Entra ID using the system-assigned identity, without needing to manage credentials. This aligns with the requirement for OAuth 2.0 authentication using a managed identity.

Answer

Use the HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret of a service principal.

Answer

Use the custom connector. In the custom connector's authentication, choose 'Managed Identity' and provide the managed identity's principal ID.

Answer

Use the Azure API Management connector. Configure it to use OAuth 2.0 with the managed identity.

Question 15

Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?

Accepted Answer

Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.. The function uses an Event Hubs trigger, which requires the 'Azure Event Hubs Data Receiver' role to read messages from the Event Hubs namespace. To write data to Azure Blob Storage, the 'Storage Blob Data Contributor' role is needed on the storage account. Both roles are assigned to the function app's system-assigned managed identity, enabling secure, keyless authentication.

Answer

Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.

Answer

Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.

Answer

Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.