AZ-204 Connect to and consume Azure services and third-party services Practice Test 18 — 15 Questions

Question 1

Your application uses Azure Service Bus topics. You need to ensure that messages are processed in the order they were sent within a session. What must you configure?

Accepted Answer

Enable sessions on the topic and set the SessionId property on messages.. Azure Service Bus sessions provide strict message ordering and exactly-once processing within a session. By enabling sessions on the topic and setting the SessionId property on each message, all messages with the same SessionId are processed in FIFO order, ensuring they are received in the exact sequence they were sent.

Answer

Enable duplicate detection.

Answer

Enable partitioning on the topic.

Answer

Set the MessageId property to a GUID.

Question 2

Which TWO authentication mechanisms can be used to securely connect an Azure Function app to an Azure SQL Database using managed identities?

Accepted Answer

System-assigned managed identity. It creates an identity directly in Microsoft Entra ID tied to the Function app's lifecycle, allowing the app to authenticate to Azure SQL Database via the Active Directory Managed Identity authentication method without storing credentials. Option B (User-assigned managed identity) is also correct because it is a standalone Azure resource that can be assigned to the Function app, enabling the same passwordless Entra ID token-based authentication to Azure SQL Database and supporting identity reuse across resources. Option C (Service principal with client secret) is not a managed identity mechanism and requires storing and rotating a secret, so it does not meet the managed identity requirement. Option D (Certificate-based authentication) is a separate credential-based approach that is not a managed identity and requires managing certificates. Option E (Connection string with access key) uses SQL credentials or keys rather than managed identities and does not provide the passwordless Entra ID authentication described.

Answer

Service principal with client secret

Answer

Certificate-based authentication

Answer

Connection string with access key

Question 3

Which THREE Azure services can be used to send email notifications from an application?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides built-in connectors (e.g., Office 365 Outlook, SMTP, SendGrid) that allow you to design workflows to send email notifications without writing custom code. You can trigger these workflows from various sources (HTTP requests, timers, Azure services) and include conditional logic, making it a serverless, low-code solution for email notifications.

Answer

Azure Event Grid

Answer

Azure Service Bus

Question 4

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

Accepted Answer

Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.. It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.

Answer

Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

Answer

Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

Answer

Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

Question 5

Northwind Traders is building a microservices architecture on Azure Kubernetes Service (AKS). One service needs to read messages from an Azure Service Bus queue and write them to an Azure SQL database. The solution must use managed identities for authentication. The AKS cluster is integrated with Microsoft Entra ID. The development team wants to avoid managing service principals and secrets. The team has chosen to use the Azure Identity SDK for authentication. The service will run as a pod in AKS. Which approach should the team use to authenticate to Service Bus and Azure SQL Database?

Accepted Answer

Deploy Azure AD Pod Identity (or Workload Identity) to assign a user-assigned managed identity to the pod. Use DefaultAzureCredential in the code. Grant the identity 'Listen' on Service Bus and 'Connect' on SQL Database.. Microsoft Entra ID Pod Identity (or Workload Identity) allows you to assign a user-assigned managed identity to a pod, eliminating the need to manage service principals or secrets. The DefaultAzureCredential from the Azure Identity SDK automatically uses the pod's managed identity to authenticate to Azure services. Granting the identity 'Listen' on Service Bus and 'Connect' on SQL Database provides the minimum required permissions for the service to read messages and write to the database.

Answer

Generate a self-signed certificate, upload it to AKS, and use ClientCertificateCredential in the code.

Answer

Store Service Bus connection string and SQL connection string in Azure Key Vault. Use Key Vault SDK to retrieve them at runtime.

Answer

Create a service principal and store its client secret in a Kubernetes secret. Use ClientSecretCredential in the code. Assign the service principal permissions to Service Bus and SQL.

Question 6

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

Accepted Answer

Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.. It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.

Answer

Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

Answer

Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

Answer

Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

Question 7

Tailwind Traders uses Azure Logic Apps to orchestrate a multi-step business process. The workflow must call an external REST API that requires OAuth 2.0 authentication. The API is registered in Microsoft Entra ID. The Logic App must authenticate using a system-assigned managed identity. The API's app registration has been configured to accept tokens from the managed identity. Which connector should the team use in the Logic App to call the API, and how should they configure authentication?

Accepted Answer

Use the HTTP connector. In the connector's authentication settings, choose 'Managed Identity' and select the system-assigned identity. Set the audience to the API's Application ID URI.. The HTTP connector with 'Managed Identity' authentication is the correct choice because the Logic App needs to call an external REST API that accepts tokens from a system-assigned managed identity. By selecting 'Managed Identity' and setting the audience to the API's Application ID URI, the Logic App automatically acquires an access token from Microsoft Entra ID using the system-assigned identity, without needing to manage credentials. This aligns with the requirement for OAuth 2.0 authentication using a managed identity.

Answer

Use the HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret of a service principal.

Answer

Use the custom connector. In the custom connector's authentication, choose 'Managed Identity' and provide the managed identity's principal ID.

Answer

Use the Azure API Management connector. Configure it to use OAuth 2.0 with the managed identity.

Question 8

Contoso is building a serverless application using Azure Functions. One function needs to read messages from an Azure Event Hub and store them in Azure Blob Storage. The function uses the Event Hubs trigger. The team wants to authenticate to both Event Hubs and Blob Storage using managed identities. The Function app has system-assigned managed identity enabled. Which role assignments are required on the Event Hubs namespace and the storage account?

Accepted Answer

Assign the 'Azure Event Hubs Data Receiver' role to the managed identity on the Event Hubs namespace. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account.. The function uses an Event Hubs trigger, which requires the 'Azure Event Hubs Data Receiver' role to read messages from the Event Hubs namespace. To write data to Azure Blob Storage, the 'Storage Blob Data Contributor' role is needed on the storage account. Both roles are assigned to the function app's system-assigned managed identity, enabling secure, keyless authentication.

Answer

Assign the 'Azure Event Hubs Data Sender' role and 'Storage Blob Data Reader' role.

Answer

Assign the 'Azure Event Hubs Data Reader' role (which does not exist) and 'Storage Blob Data Contributor' role.

Answer

Assign the 'Azure Event Hubs Data Owner' role and 'Storage Blob Data Owner' role.

Question 9

Wide World Importers has an Azure API Management (APIM) instance that exposes several APIs. One API is a custom REST API hosted on an Azure App Service. The API requires authentication via a subscription key. APIM is configured to require subscription keys for all APIs. The team wants to offload authentication to APIM so that backend services do not need to validate keys. However, the backend API also needs to know the identity of the calling application for logging. The team decides to use APIM's OAuth 2.0 authorization with Microsoft Entra ID. The backend API should receive the JWT token from APIM. How should the team configure APIM to pass the token to the backend?

Accepted Answer

In the inbound processing policy, add a 'validate-jwt' policy to validate the token. Then add a 'set-header' policy to copy the token from the Authorization header (or from the context) and forward it to the backend.. APIM can use the 'validate-jwt' policy to verify the OAuth 2.0 token from Microsoft Entra ID, and then a 'set-header' policy to forward the original JWT token (e.g., from the Authorization header or context variable) to the backend. This offloads authentication from the backend while preserving the caller's identity for logging, as the backend receives the token without needing to validate it again.

Answer

Use the 'ip-filter' policy to restrict access to known IPs. The backend trusts requests from APIM's IP.

Answer

Remove the subscription key requirement for that API. APIM will not pass any authentication information to the backend.

Answer

Configure APIM to use client certificate authentication for the backend. The certificate is presented to the backend, which extracts the identity from the certificate.

Question 10

Avanade is developing a .NET Core console application that runs on an Azure VM. The application needs to read a secret from Azure Key Vault. The VM has a system-assigned managed identity enabled. The managed identity has been granted 'Get' and 'List' permissions on the Key Vault secrets. The code uses the Azure.Identity and Azure.Security.KeyVault.Secrets NuGet packages. Which code snippet should the developer use to authenticate to Key Vault?

Accepted Answer

var client = new SecretClient(new Uri(keyVaultUrl), new DefaultAzureCredential());. DefaultAzureCredential attempts multiple authentication sources in order, including EnvironmentCredential, ManagedIdentityCredential, and others. Since the VM has a system-assigned managed identity enabled and the code runs in that environment, DefaultAzureCredential will automatically fall through to ManagedIdentityCredential and authenticate using the managed identity's token endpoint. This provides the most flexible and recommended approach for Azure SDK authentication.

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new EnvironmentCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ManagedIdentityCredential());

Answer

var client = new SecretClient(new Uri(keyVaultUrl), new ClientSecretCredential(tenantId, clientId, clientSecret));

Question 11

Coho Vineyard has an Azure Logic App that processes orders. The workflow must call a third-party API that uses Basic authentication. The credentials (username and password) must be stored securely in Azure Key Vault. The Logic App uses a system-assigned managed identity. The managed identity has been granted 'Get' permission on the Key Vault secrets. Which approach should the team use to pass the credentials to the third-party API?

Accepted Answer

Add a Key Vault connector step to retrieve the secret containing the password. Then use an HTTP connector with 'Basic' authentication type. In the authentication parameters, reference the secret for the password.. The correct approach is to retrieve the secret from Key Vault using the Logic App's managed identity (which already has Get permission), then configure the HTTP connector with Basic authentication and reference the retrieved secret for the password. This keeps credentials out of the workflow definition and uses the managed identity for secure Key Vault access.

Answer

Use an HTTP connector with 'Active Directory OAuth' authentication. Provide the client ID and client secret.

Answer

Use managed identity authentication on the HTTP connector. The third-party API must support managed identity.

Answer

Store the username and password directly in the Logic App's connection settings for the HTTP connector.

Question 12

You develop an app that uses Azure Cosmos DB for NoSQL. The app requires reading a specific item by ID with low latency. You need to ensure the query is as fast as possible. What should you use?

Accepted Answer

Use a point read with the item's ID and partition key.. A point read by ID and partition key is the fastest operation in Cosmos DB, directly accessing the item without query engine overhead. Option A is wrong because stored procedures still involve query processing and are not as fast as point reads. Option B is wrong because cross-partition queries add latency. Option D is wrong because even with a composite index, a SQL query requires query engine processing, whereas a point read is a direct lookup.

Answer

Use a stored procedure that reads the item.

Answer

Use a SQL query filtering by ID without partition key.

Answer

Use a SQL query with a composite index on ID.

Question 13

Your company uses Azure Service Bus topics and subscriptions to send order notifications. You notice that some messages are not being delivered to a subscription. The subscription has a SQL filter that matches messages with a 'region' property equal to 'EU'. You verify that the messages have 'region' set to 'eu' (lowercase). What is the most likely cause?

Accepted Answer

The SQL filter is case-sensitive and 'EU' does not match 'eu'.. The SQL filter in Azure Service Bus is case-sensitive by default. The filter condition 'region = ''EU''' requires an exact match, including case. Since the messages have 'region' set to 'eu' (lowercase), they do not satisfy the filter condition and are therefore not delivered to the subscription. This is the most likely cause of the missing messages.

Answer

The subscription is disabled.

Answer

The subscription has no filter defined.

Answer

The subscription has a correlation filter instead.

Question 14

You are building a solution that processes images uploaded to Azure Blob Storage. Each image must be analyzed by Azure AI Vision (Computer Vision). You need to trigger the analysis automatically when a new blob is created. Which Azure service should you use?

Accepted Answer

Azure Functions. Azure Functions is the correct choice because it provides a serverless compute service that can be triggered directly by Azure Event Grid when a new blob is created. This allows you to run custom code (e.g., calling Azure AI Vision APIs) in response to the blob storage event without managing infrastructure. The integration is native and efficient, with Event Grid delivering the event to the function via an HTTP trigger or Event Grid trigger binding.

Answer

Azure Event Grid

Answer

Azure Logic Apps

Answer

Azure WebJobs

Question 15

Which THREE components are required to implement a secure authentication flow for a single-page application (SPA) using Microsoft Entra ID to call Microsoft Graph? (Choose three.)

Accepted Answer

Authorization endpoint. Option B (Authorization endpoint) is required because the SPA must redirect the user to the Microsoft Entra ID authorization endpoint (https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize) to initiate the OAuth 2.0 authorization code flow with PKCE and obtain user consent. Option C (Client ID / Application ID) is required because every app registration in Microsoft Entra ID is uniquely identified by its Application (client) ID, which the SPA sends in the authorization and token requests to identify itself. Option E (Token endpoint) is required because the SPA must exchange the authorization code (with the PKCE code_verifier) at the token endpoint (https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token) to receive the access token used to call Microsoft Graph. Option A (Client certificate) is not needed, as certificates are used for confidential client or daemon/service authentication, not for browser-based SPAs. Option D (Client secret) is not needed and is in fact prohibited for SPAs, since public clients cannot securely store secrets; PKCE replaces the secret in this flow.

Answer

Client certificate

Answer

Client secret