AZ-204 Connect to and consume Azure services and third-party services Practice Test 3 — 15 Questions

Question 1

You are designing a solution that needs to relay events from an on-premises system to Azure Event Grid. The on-premises system cannot make outbound HTTPS calls. Which Azure service should you use as a bridge?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Event Grid on-premises. Azure Event Grid on-premises, deployed via Azure Arc, allows you to host Event Grid topics and subscriptions on your local Kubernetes cluster. The on-premises system (event source) can publish events to this *local* Event Grid instance, which does not require the source system itself to make direct outbound HTTPS calls to Azure. The Event Grid on Arc instance then acts as a bridge, forwarding these events to Azure Event Grid in the cloud. While the Event Grid on Arc instance itself requires outbound HTTPS connectivity to Azure for management and event forwarding, this architecture isolates the outbound connectivity requirement from the event-generating application.

Answer

Azure VPN Gateway

Answer

Azure Relay

Answer

Azure ExpressRoute

Question 2

Which TWO are valid ways to authenticate an Azure app to an Azure resource using managed identities?

Accepted Answer

System-assigned managed identity. Options B and E are correct because Azure managed identities come in exactly two flavors: a system-assigned managed identity, which is created and tied to the lifecycle of a single Azure resource (such as a VM or App Service), and a user-assigned managed identity, which is a standalone Azure resource that can be assigned to one or more Azure resources. Both types authenticate to Azure resources by obtaining Microsoft Entra ID (Microsoft Entra ID) access tokens via the Instance Metadata Service (IMDS) endpoint or the identity endpoint, so they are the valid managed identity authentication methods. Option A is not a distinct managed identity type; it merely describes the token mechanism that both system- and user-assigned identities use, so it is not one of the two managed identity options. Option C (client certificate) is a credential used by app registrations/service principals, not a managed identity. Option D (connection string) is a configuration secret containing credentials for services like Storage or SQL, and is not a managed identity authentication method.

Answer

Managed identity using Azure AD tokens

Answer

Client certificate

Answer

Connection string

Question 3

You are using Azure Cache for Redis to cache frequently accessed database query results. You need to ensure that the cache is updated automatically when the underlying data changes. Which pattern should you implement?

Accepted Answer

Cache-aside pattern with cache invalidation. The cache-aside pattern with cache invalidation lets the application read from the cache first and, on a miss, fetch from the database and populate the cache. When underlying data changes, the application explicitly invalidates or updates the cache entry, ensuring subsequent reads get fresh data. This is the standard pattern for keeping Azure Cache for Redis consistent with a backing database.

Answer

Read-through pattern

Answer

Event-driven cache invalidation using Azure Event Grid

Answer

Write-through pattern

Question 4

Which TWO scenarios require the use of Azure Event Hubs over Azure Service Bus? (Choose two.)

Accepted Answer

Capturing event data to Azure Blob Storage for long-term retention. Option A is correct because Event Hubs natively supports the Event Hubs Capture feature, which automatically writes streaming data to Azure Blob Storage (or Azure Data Lake Storage) for long-term retention without custom consumer code, whereas Service Bus has no equivalent built-in archival-to-blob capability. Option B is correct because Event Hubs is designed for massive-scale telemetry ingestion, handling millions of events per second with partitioned throughput units and AMQP/Kafka endpoints, while Service Bus is optimized for transactional enterprise messaging at lower throughput. Option C is not correct because FIFO ordering with sessions is a Service Bus feature (sessions and message ordering), not an Event Hubs capability. Option D is not correct because publish-subscribe with multiple independent subscribers is a Service Bus pattern (topics and subscriptions), whereas Event Hubs uses consumer groups on a single partition-based stream. Option E is not correct because dead-lettering failed messages is a Service Bus feature (dead-letter queue), which Event Hubs does not provide.

Answer

Processing messages in FIFO order with sessions

Answer

Implementing a publish-subscribe pattern with multiple subscribers

Answer

Dead-lettering messages that fail processing

Question 5

Your company deploys a microservices architecture on Azure Kubernetes Service (AKS). The application consists of a frontend service, an order service, and a payment service. The order service writes messages to an Azure Service Bus queue, and the payment service processes them. You need to ensure that the payment service can scale independently based on the queue length, and that the processing is fault-tolerant: if the payment service crashes during message processing, the message should not be lost and should be retried. You also need to minimize cost by reducing the number of idle instances. You configure the payment service as an Azure Function triggered by the Service Bus queue. Which configuration options should you set?

Accepted Answer

Set maxDeliveryCount to 5 in the Service Bus queue. Configure the Azure Function's scaling mode to 'Scale based on the number of messages in the queue'.. Setting maxDeliveryCount to 5 on the Service Bus queue ensures that if the payment service crashes during processing, the message is not lost and will be retried up to 5 times. Configuring the Azure Function's scaling mode to 'Scale based on the number of messages in the queue' allows the function to scale out dynamically based on queue length, minimizing idle instances and reducing cost. This combination provides fault-tolerant processing and cost-efficient scaling for the microservices architecture.

Answer

Use an Azure Storage Queue instead of Service Bus. Set the function's batchSize to 10.

Answer

Disable retries completely to avoid duplicate processing.

Answer

Set the function to run on a fixed instance count of 3.

Question 6

You are designing a solution to securely store connection strings for an Azure Function app that connects to Azure Service Bus. The connection string contains a Shared Access Key. The company policy requires that secrets be rotated every 90 days and that no secret is stored in source code or configuration files. The solution should minimize operational overhead. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a managed identity to access it from the Function app.. Azure Key Vault provides a centralized, secure store for secrets like connection strings, and using a managed identity allows the Azure Function app to authenticate to Key Vault without storing any credentials in code or configuration. This approach satisfies the rotation policy by enabling automatic or scheduled secret rotation in Key Vault, and it minimizes operational overhead by eliminating manual credential management.

Answer

Store the connection string in a JSON configuration file and use Azure Policy to enforce encryption.

Answer

Store the connection string in Azure App Configuration with encryption at rest using a customer-managed key.

Answer

Store the connection string as an environment variable in the Function app's application settings.

Question 7

Your company uses Azure API Management to expose APIs to external partners. You need to implement rate limiting per subscription key to prevent abuse, but you also want to allow burst traffic up to a certain limit. Which policy should you configure?

Accepted Answer

Add a 'rate-limit' policy with a renewal period of 60 seconds and a burst count of 10.. The 'rate-limit' policy in Azure API Management allows you to set a rate limit (e.g., requests per 60 seconds) with a burst count, enabling short bursts of traffic beyond the steady-state limit. When applied at the product scope, it effectively enforces per-subscription throttling, meeting the requirement to prevent abuse while allowing burst traffic.

Answer

Add a 'quota-per-key' policy with a renewal period of 1 day.

Answer

Add a 'limit' policy with a condition on subscription key.

Answer

Add a 'rate-limit-by-key' policy with a counter key of 'subscription-key'.

Question 8

You need to send email notifications from an Azure Function app when a new user registers in your application hosted on Azure App Service. Which Azure service should you use to send the emails?

Accepted Answer

SendGrid. SendGrid is a cloud-based email delivery service that integrates directly with Azure Functions via an output binding, making it the simplest and most cost-effective option for sending transactional emails like registration notifications. It handles SMTP relay, deliverability, and scaling without requiring a dedicated email server or complex configuration.

Answer

Microsoft 365 SMTP relay

Answer

Azure Communication Services

Answer

Azure Logic Apps

Question 9

Your application uses Azure Cache for Redis to cache session state. You notice that after a scaling operation, some users are prompted to log in again. What is the most likely cause?

Accepted Answer

The cache was scaled without enabling data persistence, causing session data to be lost.. While Azure Cache for Redis generally attempts to preserve data during scaling operations, certain scenarios (such as changing tiers, scaling down, or specific re-provisioning events) can lead to data loss. If data persistence (like RDB or AOF) is not enabled or properly configured, the cache might be re-provisioned without migrating existing data, or data might be lost during the process. When session state stored in Redis is lost, users are forced to re-authenticate.

Answer

The cache's connection string changed, causing applications to connect to a new cache.

Answer

The cache was scaled to a tier that does not support session state.

Answer

The cache's primary key changed during scaling, invalidating existing sessions.

Question 10

You are designing a solution that processes orders from an e-commerce website. The solution must guarantee that each order is processed exactly once. Which TWO Azure services can you use to achieve this requirement?

Accepted Answer

Azure Service Bus. Azure Service Bus (A) is correct because it supports exactly-once processing semantics through features like duplicate detection (DuplicateDetectionHistoryTimeWindow) and Peek-Lock with message settlement, ensuring a message is delivered and completed only once. Azure Event Hubs (E) is correct because it provides at-least-once delivery with the ability to achieve exactly-once processing when consumers use checkpointing and idempotent processing, and it supports exactly-once semantics via the EventProcessorClient with checkpoint store. Azure Storage Queues (B) only guarantees at-least-once delivery and does not natively support exactly-once processing. Azure Event Grid (C) is a reactive event routing service with at-least-once delivery and no exactly-once guarantee. Azure Cache for Redis (D) is an in-memory data store and not a message queuing service for guaranteed exactly-once order processing.

Answer

Azure Storage Queues

Answer

Azure Event Grid

Answer

Azure Cache for Redis

Question 11

You are developing a solution that uses Azure Functions to process messages from Azure Service Bus. Which TWO configurations are required to ensure the function scales out to handle high throughput?

Accepted Answer

Set the maxConcurrentCalls property to a value greater than 1.. To scale out Azure Functions with Service Bus, you need to set the maxConcurrentCalls property to a value greater than 1 (option B) to allow the function to process multiple messages concurrently. Additionally, you should configure the batch size to a value greater than 1 (option D) so that the function retrieves and processes multiple messages per invocation, increasing throughput and enabling better scaling. Enabling sessions (option A) is not required for general scaling and can actually limit concurrency due to session locking. Using a managed identity (option C) is for authentication, not scaling. A Premium App Service plan (option E) is not required because the Consumption plan scales automatically. Therefore, the correct answers are B and D.

Answer

Enable sessions on the Service Bus queue.

Answer

Use a managed identity to connect to Service Bus.

Answer

Use a Premium App Service plan for the function app.

Question 12

You need to authenticate an Azure Function app to call Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for public clients, such as native and single-page applications, that need to call Microsoft Graph on behalf of a signed-in user. It securely exchanges an authorization code for an access token, and PKCE prevents authorization code interception attacks by requiring a cryptographically random code verifier. This flow is ideal when an Azure Function acts as a backend for such a public client, receiving a user's delegated identity to call the API. While Azure Functions can also act as confidential clients using the Authorization Code Flow (without PKCE), the inclusion of PKCE in this option makes it the most secure and recommended choice for scenarios involving public clients and user delegation.

Answer

Device code flow

Answer

Client credentials flow

Answer

Implicit flow

Question 13

You have an Azure App Service web app that uses Azure SQL Database. The connection string is stored in Azure Key Vault. You need to automatically rotate the database password every 30 days without app downtime. Which solution should you implement?

Accepted Answer

Store the connection string as a Key Vault reference in App Service application settings and use Key Vault's auto-rotation.. Key Vault references in App Service application settings allow the web app to dynamically retrieve the connection string from Key Vault at runtime. By enabling Key Vault's auto-rotation feature (e.g., using a rotation function or event grid trigger), the database password can be rotated every 30 days without any app downtime, as the app reads the latest secret on each request or after a cached secret expires.

Answer

Use Azure CLI to update the connection string in App Service settings.

Answer

Use Managed Identity to access SQL Database instead of a password.

Answer

Update the connection string in the application code and redeploy.

Question 14

Which TWO Azure services can be used to securely store and retrieve secrets, such as API keys and connection strings, for use in cloud applications?

Accepted Answer

Azure Key Vault. Azure Key Vault (B) is the primary Azure service designed for securely storing and retrieving secrets such as API keys, connection strings, passwords, and certificates, using hardware security modules (HSMs) and fine-grained access policies or Azure RBAC. Azure App Configuration (D) is also correct because it provides a centralized store for configuration settings and supports Key Vault references, allowing applications to securely retrieve secrets alongside other configuration data. Azure Cosmos DB (A) is a globally distributed NoSQL database, not a secrets management service. Azure Blob Storage (C) is object storage for unstructured data and lacks native secret-management features. Azure SQL Database (E) is a relational database platform, not intended for storing application secrets securely.

Answer

Azure Cosmos DB

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 15

Which THREE Azure services can be used to securely store and retrieve secrets, connection strings, and API keys for a cloud-native application?

Accepted Answer

Azure App Configuration. Azure App Configuration (B) is correct because it provides a managed service for centrally storing application settings and, with its Key Vault references feature, can securely retrieve secrets, connection strings, and API keys without exposing them in code. Azure Managed HSM (C) is correct because it is a FIPS 140-2 Level 3 validated, single-tenant hardware security module service that stores and safeguards cryptographic keys and secrets with full customer control over the security domain. Azure Key Vault (E) is correct because it is purpose-built to securely store and retrieve secrets, connection strings, API keys, and certificates using RBAC, access policies, and soft-delete/purge protection. Azure Blob Storage (A) is not appropriate because it is general-purpose object storage without native secret-management semantics or built-in secret versioning/access controls for credentials. Azure Cosmos DB (D) is a globally distributed NoSQL database, not a dedicated secrets store, so it lacks the specialized secret protection and management features required here.

Answer

Azure Blob Storage

Answer

Azure Cosmos DB