AZ-204 Connect to and consume Azure services and third-party services Practice Test 2 — 15 Questions

Question 1

Which TWO are best practices for securing an Azure API Management instance?

Accepted Answer

Require subscription keys for all APIs. Option B is correct because requiring subscription keys for all APIs ensures that every request to an API is authenticated at the gateway level, allowing API Management to validate the caller's identity and reject unauthorized traffic before it reaches backend services. Option D is correct because integrating OAuth 2.0 with Microsoft Entra ID (Microsoft Entra ID) provides strong, token-based authentication for API consumers, enabling fine-grained authorization via scopes and roles rather than relying on static shared secrets. Option A is incorrect because the management endpoint should never be exposed publicly; it must be restricted to trusted networks or specific IP ranges, since it grants administrative control over the API Management instance. Option C is incorrect as a best practice for securing the instance itself: rate limiting (via rate-limit or quota policies) mitigates abuse and throttling but does not authenticate callers or prevent brute force against credentials, which is the role of authentication and strong key/token policies. Option E is incorrect because sharing API keys via email exposes secrets in plaintext and violates secure secret-handling practices; keys should be distributed through secure channels such as Azure Key Vault or a developer portal with proper access controls.

Answer

Expose the management endpoint publicly for easy configuration

Answer

Set rate limits to prevent brute force attacks

Answer

Share API keys with partners via email

Question 2

You are deploying this ARM template. After deployment, you want to ensure that all traffic to the storage account uses HTTPS. However, you notice that HTTP requests are still accepted. What is the most likely reason?

Accepted Answer

The property 'supportsHttpsTrafficOnly' is misspelled. The ARM template property 'supportsHttpsTrafficOnly' (or 'enableHttpsTrafficOnly') enforces that all requests to the storage account must use HTTPS. If this property is set to 'true', any requests made over HTTP will be rejected, regardless of the storage account's network firewall rules (IP addresses or virtual networks). Network rules control *who* can access the storage account, not *which protocol* they must use. If HTTP requests are still accepted after deployment, it indicates that the 'supportsHttpsTrafficOnly' property was not effectively enabled or configured correctly in the ARM template.

Answer

The storage account's network rules allow HTTP traffic from certain IP addresses

Answer

The property should be set on the blob service, not the storage account

Answer

The API version does not support this property

Question 3

A company runs a microservices application on Azure Kubernetes Service (AKS). One service needs to securely access an Azure SQL Database. The solution should avoid storing connection strings in code or configuration. What should they use?

Accepted Answer

Azure AD Pod Identity (aad-pod-identity). The provided explanation accurately describes the functionality and benefits of Microsoft Entra ID Workload Identity. However, it does not justify the specific technology named in option D ('Microsoft Entra ID Pod Identity'), which is outdated. The explanation should either be updated to accurately describe Microsoft Entra ID Pod Identity, or option D should be updated to 'Microsoft Entra ID Workload Identity' to align with the explanation and current best practices.

Answer

Azure Key Vault with a secret store CSI driver

Answer

Virtual machine managed identity

Answer

Kubernetes secrets

Question 4

Which THREE actions should be taken to secure an Azure App Service web app that accesses an Azure SQL Database? (Choose three.)

Accepted Answer

Enable Managed Identity for the App Service.. Option B is correct because enabling a system-assigned or user-assigned Managed Identity on the App Service lets the app authenticate to Azure SQL Database via Microsoft Entra ID without embedding credentials, and the identity can be granted a contained database user with the needed roles. Option C is correct because Azure Key Vault centralizes secret storage and access, and App Service can reference Key Vault secrets directly through Key Vault references in application settings, so connection strings and other secrets are never hard-coded in code or config files. Option D is correct because configuring the Azure SQL Database firewall to allow Azure services permits connections from Azure-hosted resources such as the App Service (and is required when the app connects over the public endpoint), while still restricting access to non-Azure origins. Option A is not among the correct answers because storing a connection string in App Service application settings leaves the secret in plaintext configuration rather than in a managed vault, which is weaker than the Key Vault reference approach. Option E is incorrect because disabling TLS 1.2 would downgrade transport security; App Service should enforce TLS 1.2 or higher, not turn it off.

Answer

Store the connection string in App Service application settings.

Answer

Disable TLS 1.2 on the App Service.

Question 5

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. For continuous deployment from GitHub to Azure App Service, a GitHub Actions workflow file must exist in the repository to define the build and deploy steps. Without it, merging a pull request does not trigger any deployment. The ARM template alone does not create the workflow.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.

Question 6

Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)

Accepted Answer

Grant the managed identity the 'Key Vault Secrets User' role.. Option B is correct because assigning the managed identity the 'Key Vault Secrets User' RBAC role grants least-privilege read access to secret values, which is exactly what the App Service needs to retrieve secrets from Key Vault. Option C is correct because enabling a system-assigned or user-assigned managed identity on the App Service creates the Microsoft Entra ID identity that Key Vault RBAC or access policies can authorize, eliminating the need to store credentials. Option D is correct because DefaultAzureCredential in the application code automatically discovers the App Service managed identity via the IDENTITY_ENDPOINT/IDENTITY_HEADER environment variables and uses it to authenticate to Key Vault without embedding secrets. Option A is not required for secure access because network restrictions are a defense-in-depth control, not an authentication mechanism, and the App Service's outbound IPs can change; RBAC plus managed identity already secures access. Option E is incorrect because storing a client secret in App Service application settings reintroduces the credential-management risk that managed identity is designed to eliminate.

Answer

Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.

Answer

Store the Key Vault URL and a client secret in App Service application settings.

Question 7

Your company has an Azure Logic App that processes orders by calling a third-party REST API using an HTTP trigger. Recently, the API provider changed their authentication to require OAuth 2.0 with client credentials. The Logic App currently uses a basic authentication header. What should you do to update the Logic App?

Accepted Answer

Use Azure API Management to proxy the API and add OAuth support. The 'Active Directory OAuth' authentication in Logic Apps is used for authenticating to services protected by Microsoft Entra ID (Azure AD) using the Logic App's managed identity. It does not support obtaining tokens from an arbitrary third-party OAuth 2.0 provider via client credentials flow. For a generic third-party API, the Logic App would need to implement a multi-step process to first acquire a token from the third-party's token endpoint and then use it. Option A, using Azure API Management, is a valid architectural solution. API Management can be configured to handle the OAuth 2.0 client credentials flow, acquiring a token from the third-party provider and injecting it into requests to the backend API, thus centralizing authentication logic. Options B and D are incorrect as they do not address the authentication requirement securely or relevantly.

Answer

Add the client ID and client secret as query parameters

Answer

Configure the Logic App to use a managed identity and update the HTTP action authentication to 'Active Directory OAuth'

Answer

Replace the HTTP trigger with a Service Bus queue

Question 8

Your organization uses Azure API Management (APIM) to expose internal APIs to external partners. You need to ensure that only partners with a valid subscription key can access the APIs. Additionally, you want to log all requests for auditing. Which APIM policy should you implement?

Accepted Answer

Apply a policy and a policy. Subscription key validation is a built-in feature of Azure API Management, enforced at the product level when an API is associated with a product that requires a subscription; therefore, no specific policy is needed for this requirement. For logging all requests for auditing, the policy is the correct choice. Option A suggests applying a policy, which is used for validating JSON Web Tokens, not subscription keys. Since the stem specifically asks for subscription key validation, and this is handled inherently by APIM without a policy, and is inappropriate, Option A is incorrect. No provided option fully and correctly addresses both requirements as stated in the stem.

Answer

Apply an <ip-filter> policy

Answer

Apply a <rate-limit> policy

Answer

Apply a <cors> policy

Question 9

A developer writes an Azure Function that uses the Azure.Storage.Blobs SDK to upload a file to Blob Storage. The function runs locally but fails when deployed to Azure with a '403 Forbidden' error. What is the most likely cause?

Accepted Answer

The function app does not have the correct RBAC role on the storage account. The 403 Forbidden error when an Azure Function runs in Azure but not locally typically indicates an authorization failure. By default, Azure Functions use managed identity to access storage accounts, and the function app's system-assigned managed identity must be granted the appropriate RBAC role (e.g., Storage Blob Data Contributor) on the storage account. Without this role, the SDK's request to Blob Storage is denied, resulting in a 403.

Answer

The Azure.Storage.Blobs SDK version is deprecated

Answer

The function runtime version is incompatible

Answer

The storage account is behind a firewall and the function app's outbound IP is not whitelisted

Question 10

Which THREE Azure services can be used to trigger an Azure Function when a new blob is uploaded to a storage account?

Accepted Answer

Azure Blob Storage trigger (Event Grid based). Option C is correct because the Azure Blob Storage trigger for Azure Functions, when configured with the Event Grid-based source, fires the function directly whenever a blob is created in a monitored container. Option D is correct because Event Hubs can capture or relay blob-creation events (for example, via Event Grid routing to an Event Hub), and an Azure Function with an Event Hubs trigger can then be invoked by those events. Option E is correct because Event Grid is the native eventing backbone for Blob Storage events such as Microsoft.Storage.BlobCreated, and an Azure Function with an Event Grid trigger subscribes to those events to run on each new blob. Option A is not correct because a Service Bus queue is a general messaging queue that is not natively wired to Blob Storage creation events and would require custom code to publish messages. Option B is not correct because Logic Apps is a workflow orchestration service, not a trigger type for Azure Functions reacting to blob uploads.

Answer

Azure Service Bus queue

Answer

Azure Logic Apps

Question 11

A company wants to send email notifications from an Azure Function app. The function app runs on a Consumption plan. Which service should be used to send emails?

Accepted Answer

Azure Communication Services. SendGrid is a third-party email delivery service that integrates directly with Azure Functions via an output binding or API, making it a simple and cost-effective option for sending emails from a Consumption plan function app. It handles SMTP relay, deliverability, and scaling. Azure Communication Services (ACS) also now offers an Email service, which is a first-party Azure solution for sending emails, making it another viable option for this scenario. Both services align well with the Consumption plan's pay-per-use model.

Answer

Azure Logic Apps

Answer

Microsoft Graph API

Question 12

A company uses Azure API Management (APIM) to expose a set of REST APIs. A new requirement mandates that all API calls must be throttled per user based on usage tiers (Free, Basic, Premium). User identity is provided via a JWT token. Which policy should the developer configure in APIM to enforce this throttling?

Accepted Answer

rate-limit-by-key policy. The rate-limit-by-key policy is correct because it allows throttling based on a specific key extracted from the request, such as the user identity from a JWT token. This policy enables per-user rate limiting by using a policy expression to extract the 'sub' claim or a custom claim from the JWT as the counter key, which maps directly to the usage tiers requirement.

Answer

rate-limit policy

Answer

quota-by-key policy

Answer

IP-based throttling

Question 13

Which TWO Azure services can be used to store and manage secrets, such as API keys and connection strings? (Choose 2)

Accepted Answer

Azure Key Vault. Azure Key Vault is the dedicated service for securely storing and managing secrets, keys, and certificates. Managed Identity, on the other hand, is an authentication mechanism that provides an identity for Azure resources to access secrets stored elsewhere, such as Key Vault. It does not store secrets itself. Therefore, only Azure Key Vault qualifies as a service for storing and managing secrets among the given options.

Answer

Azure App Configuration

Answer

Azure Storage

Answer

Azure SQL Database

Answer

Azure Managed Identity

Question 14

Refer to the exhibit. A developer deploys this ARM template to create a web app with a connection string to Azure Cosmos DB. The deployment succeeds but the web app cannot connect to Cosmos DB. What is the most likely cause?

Accepted Answer

The connection string should use a secret reference to Azure Key Vault. The ARM template likely includes a connection string that directly embeds the Cosmos DB account key using the listKeys function. However, for security and proper configuration, the connection string should reference a secret in Azure Key Vault rather than exposing the key in the template or app settings. When the connection string is not correctly retrieved (e.g., due to missing Key Vault reference), the web app cannot authenticate to Cosmos DB, causing connection failures. The correct approach is to use a Key Vault secret reference in the app settings, ensuring the key is securely managed and accessible.

Answer

The listKeys function is used incorrectly

Answer

The web app name parameter is missing

Answer

The listKeys function requires a different API version

Question 15

Which TWO Azure services can be used to implement a pub/sub messaging pattern?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (A) is correct because a topic supports the publish/subscribe pattern: publishers send messages to the topic, and multiple independent subscriptions (with optional filters/rules) each receive a copy, enabling one-to-many fan-out. Azure Event Grid (E) is correct because it is a fully managed event-routing service built on a publish/subscribe model, where publishers emit events to topics and event subscriptions push those events to multiple subscribers via handlers such as Functions, Logic Apps, or webhooks. Azure Blob Storage (B) is object storage, not a messaging broker, so it does not provide pub/sub semantics. Azure Queue Storage (D) implements point-to-point queuing where each message is consumed by a single receiver, not fan-out pub/sub. Azure Event Hubs (C) is a high-throughput event-streaming/ingestion service using partitions and consumer groups; while it supports multiple consumers reading a stream, it is designed for telemetry streaming rather than the classic pub/sub topic-subscription model, so it is not marked correct here.

Answer

Azure Blob Storage

Answer

Azure Event Hubs

Answer

Azure Queue Storage