AZ-204 Connect to and consume Azure services and third-party services Practice Test 3 — 15 Questions

Question 1

You are building an Azure Logic App that needs to call a third-party REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Use the 'Get secret' action from the Azure Key Vault connector, configured to authenticate with a managed identity. Then pass the output to the 'HTTP' action's header as 'X-API-Key'.. Option A is correct because it uses the Azure Key Vault connector's 'Get secret' action with managed identity authentication to securely retrieve the API key at runtime. The output is then passed directly into the HTTP action's 'X-API-Key' header, ensuring the secret is never exposed in the Logic App definition or logs. This approach follows the principle of least privilege and avoids hardcoding secrets.

Answer

Create an API connection for the external API, providing the API key in the connection parameters. Then use that connection in the Logic App.

Answer

Store the API key directly in the Logic App definition's 'constants' section and reference it in the HTTP action.

Answer

Use the 'HTTP' action with 'Managed Identity' authentication type, and configure the external API to accept Microsoft Entra ID tokens.

Question 2

You are building an Azure Logic App that needs to call an external REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Add a 'Get secret' action from Key Vault to retrieve the secret, then use the 'HTTP' action and set the 'X-API-Key' header to the secret value using a dynamic expression.. Option A is correct because it uses the native 'Get secret' action from Azure Key Vault to securely retrieve the API key at runtime, leveraging the Logic App's managed identity for authentication. The secret value can then be dynamically injected into the 'X-API-Key' header of the subsequent HTTP action using an expression like `@{outputs('Get_secret')?['value']}`. This approach follows the principle of least privilege and avoids hardcoding secrets or exposing them in configuration.

Answer

Configure the HTTP action to use managed identity authentication and set the 'Audience' to the Key Vault URL. This will automatically pass the API key as the Authorization header.

Answer

Store the API key in an Azure App Service application setting and reference it from the Logic App using the 'appsetting' function.

Answer

Use the 'Invoke an HTTP endpoint' action with Application Insights dependency tracking enabled. The API key is automatically logged by Application Insights.

Question 3

You are building an application that subscribes to an Azure Event Grid topic using a custom webhook endpoint. The endpoint is a web API hosted on Azure App Service. You need to ensure that only Event Grid can invoke your webhook endpoint, preventing unauthorized requests. What should you implement in your webhook endpoint?

Accepted Answer

Validate the Aeg-SasKey header against a shared secret known to Event Grid. Option B is correct because Event Grid sends an Aeg-SasKey header with each request to a custom webhook endpoint. By validating this header against a pre-configured shared secret (the same key used when creating the event subscription), the endpoint can confirm that the request originated from Event Grid. This prevents unauthorized actors from invoking the webhook, as they would not possess the shared secret.

Answer

IP address filtering to allow only the Azure Event Grid service tag

Answer

Require a client certificate that you upload to Event Grid

Answer

Use an OAuth 2.0 token from Microsoft Entra ID

Question 4

Your company has a set of REST APIs that are exposed through Azure API Management (APIM). One of the backend APIs is secured and requires an OAuth 2.0 access token from Microsoft Entra ID. The APIM instance has a system-assigned managed identity with permissions to request tokens for the backend API's scope. You need to configure APIM to automatically obtain a token and pass it to the backend API when requests come in. What should you do?

Accepted Answer

Add a set-backend-service policy with the authentication-managed-identity attribute. Option A is correct because the `set-backend-service` policy with the `authentication-managed-identity` attribute allows APIM to use its system-assigned managed identity to obtain an OAuth 2.0 access token from Microsoft Entra ID for the specified backend API scope. This token is automatically attached to the backend request as an Authorization header, enabling secure access without manual token management.

Answer

Configure the backend API's subscription key in policy

Answer

Use a validate-jwt policy to check incoming token

Answer

Create a named value with the token and reference it in policy

Question 5

You are developing a worker role that processes events from an Azure Event Hub. The worker runs on multiple virtual machines to ensure high availability. Each partition of the Event Hub should be processed by only one instance at a time, and events from the same partition must be processed in order. You need to manage partition leasing and checkpointing efficiently. Which Azure SDK class should you use?

Accepted Answer

EventProcessorHost. The EventProcessorHost (EPH) class is designed specifically for scenarios requiring distributed processing of Event Hub partitions across multiple instances. It manages partition leasing to ensure each partition is processed by only one instance at a time, handles checkpointing to track progress, and guarantees ordered processing within a partition. This makes it the correct choice for high-availability worker roles that must avoid duplicate processing and maintain event order.

Answer

EventHubClient

Answer

PartitionReceiver

Answer

EventHubConsumerClient

Question 6

You are building an event-driven application that needs to publish messages to multiple independent subscribers. Each subscriber must be able to filter messages based on custom properties, and each subscriber must receive all messages that match its filter, even if other subscribers have different filters. The solution must guarantee message delivery. Which Azure messaging service should you use?

Accepted Answer

Azure Service Bus Topics and Subscriptions. Azure Service Bus Topics and Subscriptions are designed for publish-subscribe messaging where multiple independent subscribers each receive a copy of every message that matches their filter criteria. The topic allows publishing messages with custom properties, and each subscription can define a SQL-like filter (using the `SqlFilter` class) to select only relevant messages. This ensures that all subscribers receive all messages matching their filter, with guaranteed delivery via the broker's persistent storage and at-least-once delivery semantics.

Answer

Azure Queue Storage

Answer

Azure Service Bus Queues

Answer

Azure Event Hubs

Question 7

You are developing a web application that relies on a third-party weather API. The API has a rate limit of 10 requests per second per API key. You need to ensure your application never exceeds this limit and also caches responses for 10 minutes to reduce call frequency. Which combination of Azure services should you implement?

Accepted Answer

Azure API Management with rate-limit and caching policies.. Azure API Management (APIM) provides built-in rate-limit and caching policies that directly address the requirements: the `rate-limit` policy enforces a per-key request quota (e.g., 10 calls/second), and the `cache-store`/`cache-lookup` policies cache responses for a configurable duration (e.g., 10 minutes). This eliminates the need for custom throttling logic or external caching services, making it the most straightforward and maintainable solution.

Answer

Azure Functions with Durable Functions to throttle calls and a static in-memory cache.

Answer

Azure Logic Apps with a retry policy and a cache using Azure Redis Cache.

Answer

Azure Traffic Manager to distribute requests and Azure Front Door for caching.

Question 8

You are using Azure Event Grid to respond to blob storage events (blob created). You need to ensure that only JPEG image files trigger a function for processing, while other files are ignored. The number of files is high, and you want to minimize cost and latency. How should you filter events?

Accepted Answer

Configure Advanced Filters on the Event Grid subscription with a 'subjectEndsWith' condition set to '.jpg' or '.jpeg'.. Option B is correct because Azure Event Grid supports advanced filtering on event properties, including 'subjectEndsWith', which allows you to filter events at the service level before they are delivered to the endpoint. This ensures that only blob creation events for files ending with '.jpg' or '.jpeg' trigger the function, reducing unnecessary invocations, cost, and latency. By filtering at the Event Grid level, you avoid processing unwanted events entirely, which is more efficient than filtering within the function code.

Answer

Create the function to check the blob extension at the start of the function code and return early if it's not a JPEG.

Answer

Create separate event subscriptions for each file extension and point them to different functions.

Answer

Use Event Hubs capture to filter files before sending events.

Question 9

You manage a set of APIs using Azure API Management (APIM). One backend API requires an API key passed in the 'X-API-Key' header. The API key is stored securely in a named value in APIM. You need to configure APIM to add this header to all requests to that backend without exposing the key to API consumers. Which policy should you add to the inbound processing for that API?

Accepted Answer

set-header. The 'set-header' policy in Azure API Management allows you to add, modify, or remove HTTP headers on requests or responses. By placing this policy in the inbound processing section, you can inject the 'X-API-Key' header with the value retrieved from a named value (using the '{{NamedValue}}' syntax) without exposing the key to API consumers, as the policy executes on the gateway side.

Answer

set-backend-service

Answer

authentication-basic

Answer

validate-jwt

Question 10

You are building an Azure Logic App that needs to call an external API secured with OAuth 2.0 client credentials flow. You have registered an application in Microsoft Entra ID with client ID 'myClientId' and client secret stored in Key Vault. Which action should you use to authenticate?

Accepted Answer

HTTP action with Active Directory OAuth authentication. Option A is correct because the HTTP action in Azure Logic Apps supports an 'Active Directory OAuth' authentication type that directly implements the OAuth 2.0 client credentials flow. By providing the tenant ID, client ID, and referencing the client secret from Key Vault (via a secure parameter or connection reference), the Logic App can obtain an access token from Microsoft Entra ID and authenticate to the external API without custom code.

Answer

HTTP action with Managed Identity authentication

Answer

Invoke the API through Azure API Management

Answer

Use the Microsoft Entra ID OAuth 2.0 connector

Question 11

You have an Azure Event Grid topic that receives storage blob created events. You only want to process events for files with a '.jpg' extension. You need to minimize cost and latency. How should you filter the events?

Accepted Answer

Configure a subject filter in the Event Grid subscription with suffix '.jpg'. Option A is correct because Event Grid subscriptions support subject filtering with prefix and suffix matching, allowing you to filter events at the Event Grid service level before they are delivered to your endpoint. By configuring a subject filter with suffix '.jpg', only blob created events for files ending in '.jpg' are sent to your Azure Function, minimizing both cost (fewer invocations) and latency (no unnecessary processing). This approach avoids the overhead of receiving and discarding unwanted events in your function code.

Answer

Filter inside the Azure Function code by checking the blob name extension

Answer

Use Azure Service Bus topics instead of Event Grid, with a filter on message properties

Answer

Create separate Event Grid topics for JPEG files and route only JPEG events

Question 12

You are building an Azure Logic App that calls an external REST API secured with the OAuth 2.0 client credentials flow. You have registered an app in Microsoft Entra ID with client ID and client secret stored in Azure Key Vault. The Logic App uses a system-assigned managed identity with Get permission on the secret. Which action should you use in the Logic App designer to authenticate to the API?

Accepted Answer

HTTP action with 'Active Directory OAuth' authentication type, referencing the client ID and client secret. Option A is correct because the OAuth 2.0 client credentials flow requires a client ID and client secret to obtain an access token from Microsoft Entra ID. The HTTP action's 'Active Directory OAuth' authentication type directly supports this flow, allowing you to reference the client ID and the client secret stored in Azure Key Vault. The Logic App's system-assigned managed identity has Get permission on the secret, enabling it to retrieve the secret at runtime without exposing it in the workflow definition.

Answer

HTTP action with 'Managed Identity' authentication type

Answer

Invoke an API with OAuth predefined connector

Answer

HTTP action with 'Basic' authentication and pass the secret as password

Question 13

You are building an Azure Logic App that processes orders. When an order is placed, the Logic App must send a message to an Azure Service Bus queue. The queue is secured using managed identity. Which connector action should you use?

Accepted Answer

Service Bus connector with managed identity authentication. The Service Bus connector with managed identity authentication is correct because it allows the Logic App to authenticate to the Azure Service Bus queue using an Azure AD managed identity, eliminating the need for secrets or SAS tokens. This is the recommended approach for securing Service Bus resources when using Azure services, as it leverages Azure RBAC for fine-grained access control and aligns with the principle of least privilege.

Answer

HTTP action with SAS token

Answer

Azure Functions connector

Answer

Event Grid connector

Question 14

You are building a solution that processes events from multiple Azure Event Hubs. Events must be dispatched to different downstream services based on the event type. You need a serverless solution that can handle high throughput and uses managed identity to authenticate to Event Hubs. Which Azure service should you use?

Accepted Answer

Azure Functions (Event Hubs trigger) with managed identity. Azure Functions with an Event Hubs trigger supports managed identity authentication, enabling secure, passwordless connections to Event Hubs. It is a serverless, event-driven compute service that can scale to handle high throughput by processing events in parallel across multiple partitions. This makes it the ideal choice for dispatching events to downstream services based on event type.

Answer

Azure Stream Analytics

Answer

Azure Logic Apps (Event Hubs connector)

Answer

Azure Data Factory

Question 15

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used?

Accepted Answer

Azure Service Bus topic. Azure Service Bus topics support a publish/subscribe pattern where multiple independent subscribers can each receive a copy of the same message. This decouples the publisher from subscribers, allowing new subscribers to be added later without modifying the publisher. The topic's subscription mechanism ensures each subscriber processes the event independently.

Answer

Azure Blob Storage lifecycle policy

Answer

Azure Storage Queue

Answer

Azure Cache for Redis list only