AZ-204 Connect to and consume Azure services and third-party services Practice Test 3 — 15 Questions

Question 1

You need to authenticate an Azure Function app to call Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you use?

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for public clients, such as native and single-page applications, that need to call Microsoft Graph on behalf of a signed-in user. It securely exchanges an authorization code for an access token, and PKCE prevents authorization code interception attacks by requiring a cryptographically random code verifier. This flow is ideal when an Azure Function acts as a backend for such a public client, receiving a user's delegated identity to call the API. While Azure Functions can also act as confidential clients using the Authorization Code Flow (without PKCE), the inclusion of PKCE in this option makes it the most secure and recommended choice for scenarios involving public clients and user delegation.

Answer

Device code flow

Answer

Client credentials flow

Answer

Implicit flow

Question 2

Which THREE Azure services or features can be used to implement retry logic for transient failures when calling an external API from a .NET Core application?

Accepted Answer

Azure SDK retry policies. The Azure SDKs for .NET Core include built-in retry policies that can be configured for transient fault handling when calling Azure services (which are external APIs from the application's perspective). These policies automatically retry failed operations based on exponential backoff or fixed intervals, reducing the need for custom retry logic.

Azure Logic Apps provide built-in retry policies for actions, including HTTP actions to call external APIs. A .NET Core application can trigger a Logic App to perform an external API call, effectively leveraging the Logic App's retry capabilities for that operation.

Polly is a popular open-source .NET resilience and transient-fault-handling library. It can be easily integrated into .NET Core applications (often via `HttpClientFactory`) to implement various policies like retries, circuit breakers, and timeouts when calling any external API, whether Azure or third-party.

Answer

Azure Traffic Manager

Answer

Azure Front Door

Question 3

Which TWO authentication mechanisms can be used to securely connect an Azure Function app to an Azure SQL Database using managed identities?

Accepted Answer

System-assigned managed identity. Both system-assigned and user-assigned managed identities are correct because they are the two types of managed identities in Azure. Azure Functions can be configured with either a system-assigned identity (tied directly to the function app's lifecycle) or a user-assigned identity (a standalone Azure resource that can be assigned to multiple resources). Both types allow the function app to obtain Azure AD tokens from the Azure Instance Metadata Service (IMDS) endpoint and use them to authenticate to Azure SQL Database via Azure AD authentication, thereby eliminating the need to store or manage any credentials like connection strings with passwords or client secrets.

Answer

Service principal with client secret

Answer

Certificate-based authentication

Answer

Connection string with access key

Question 4

Which THREE Azure services can be used to securely store and retrieve secrets, connection strings, and API keys for a cloud-native application?

Accepted Answer

Azure App Configuration. Azure Key Vault is a fundamental service for securely storing and managing secrets (such as passwords, connection strings, and API keys), cryptographic keys, and SSL/TLS certificates, offering centralized management, fine-grained access control, and auditing. Azure App Configuration is designed for centrally managing application settings and feature flags; it can store connection strings and API keys directly or, more securely, reference secrets stored in Azure Key Vault, providing a unified configuration experience. Azure Managed HSM provides a highly secure, FIPS 140-2 Level 3 validated hardware security module for safeguarding cryptographic keys, which are a critical type of secret for many cloud-native applications requiring high assurance for their cryptographic operations.

Answer

Azure Blob Storage

Answer

Azure Cosmos DB

Question 5

Which TWO authentication methods can be used to call a Microsoft Entra ID-protected web API from a client application?

Accepted Answer

OAuth 2.0 client credentials flow. The OAuth 2.0 client credentials flow (C) is designed for server-to-server (machine-to-machine) authentication, where a client application (such as a daemon or service) authenticates with its own credentials (client ID and client secret or certificate) to obtain an access token directly from Microsoft Entra ID. This flow does not require a user context, making it ideal for calling a protected web API from a non-interactive client application.

The OAuth 2.0 authorization code flow with PKCE (E) is the recommended and most secure flow for client applications (both public clients like mobile/desktop apps and confidential clients like web apps) to obtain an access token on behalf of a user. The client redirects the user to Microsoft Entra ID for authentication and consent, receives an authorization code, and then exchanges it for an access token. PKCE (Proof Key for Code Exchange) adds an essential layer of security, especially for public clients, by mitigating authorization code interception attacks, making it the standard for modern interactive client applications calling protected APIs.

Answer

HTTP Basic authentication

Answer

OAuth 2.0 implicit flow

Answer

SAML 2.0 bearer assertion flow

Question 6

Litware Inc. has an Azure App Service web app that needs to authenticate users via Microsoft Entra ID. The app uses the Microsoft Authentication Library (MSAL) for .NET. The app must also call Microsoft Graph to read user profiles. The app is registered in Entra ID with delegated permissions for 'User.Read'. The team wants to use the OAuth 2.0 authorization code flow with PKCE. The redirect URI is set to the App Service's URL. The app uses the App Service Authentication feature (EasyAuth) and also custom code. The team notices that after signing in, the app receives an ID token but not an access token for Microsoft Graph. What is the most likely cause?

Accepted Answer

The App Service Authentication feature is not configured to request the 'User.Read' scope. The team must configure the 'Additional login parameters' to include 'scope=User.Read'.. B is correct because App Service Authentication (EasyAuth) intercepts the OAuth 2.0 authorization code flow and, by default, only issues an ID token for the app itself. To obtain an access token for Microsoft Graph, the 'User.Read' scope must be explicitly requested during the authentication request. This is done by configuring the 'Additional login parameters' in the App Service Authentication settings to include 'scope=User.Read', which tells the Microsoft identity platform to include that delegated permission in the token response.

Answer

The app registration in Entra ID is missing the 'User.Read' delegated permission. The team must grant admin consent for the permission.

Answer

The authorization code flow with PKCE is not supported by App Service Authentication. The team should use the implicit flow.

Answer

The redirect URI is incorrect. The team must use the App Service's authentication endpoint instead of the app's URL.

Question 7

Which THREE components are required to implement a secure authentication flow for a single-page application (SPA) using Microsoft Entra ID to call Microsoft Graph? (Choose three.)

Accepted Answer

Authorization endpoint. The **Client ID (Application ID)** is essential as it uniquely identifies the SPA to Microsoft Entra ID, allowing it to register and authenticate. The **Authorization endpoint** is required because it initiates the OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange), which is the recommended authentication flow for SPAs. The SPA redirects the user to this endpoint to obtain an authorization code after user consent. The **Token endpoint** is then used by the SPA to exchange the received authorization code (along with the PKCE code verifier) for access tokens, ID tokens, and refresh tokens, which are necessary to call Microsoft Graph and maintain user sessions. Without these components, the SPA cannot securely obtain user consent or access tokens.

Answer

Client certificate

Answer

Client secret

Question 8

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

Accepted Answer

Sessions. Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Answer

Scheduled messages

Answer

Dead-letter queue

Answer

Auto-forwarding

Question 9

You manage an API in Azure API Management. You need to cache API responses such that different responses are returned based on the product subscription key used by the caller. Which set of policies should you implement?

Accepted Answer

Set a 'cache-lookup' policy in the inbound section and a 'cache-store' policy in the outbound section, using the subscription key as a cache vary-by parameter.. Caching API responses based on the subscription key ensures that each caller receives a cached response unique to their subscription. The 'cache-lookup' policy in the inbound section checks the cache before forwarding the request, and the 'cache-store' policy in the outbound section stores the response after it is generated. By specifying the subscription key as a vary-by parameter, the cache key includes the subscription key, so different keys produce different cached entries.

Answer

Set a 'cache-store' policy in the inbound section and a 'cache-lookup' policy in the outbound section.

Answer

Set both 'cache-lookup' and 'cache-store' policies in the inbound section.

Answer

Set only a 'cache-store' policy in the backend section.

Question 10

A company uses Azure Logic Apps to integrate with a third-party REST API. The API has a rate limit of 100 requests per minute. You need to ensure that the Logic App respects this limit. Which connector feature should you configure?

Accepted Answer

Concurrency control.. Concurrency control in Azure Logic Apps allows you to limit the number of concurrent workflow instances (when applied to the trigger) or parallel iterations (when applied to a 'For each' loop). By configuring this setting, you can proactively manage the rate at which requests are sent to an external API, helping to prevent exceeding rate limits. For example, if each Logic App run makes one API call, setting the concurrency limit on the trigger to a value that aligns with the rate limit (e.g., 100, if runs are short and the trigger fires frequently) can help throttle the overall request volume by queuing additional runs. This proactively manages the request volume, unlike a retry policy which reacts to failures.

Answer

Retry policy.

Answer

Swagger connector.

Answer

API Management.

Question 11

You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?

Accepted Answer

Azure Service Bus.. Azure Service Bus is the correct choice because it supports exactly-once delivery through duplicate detection and can fan out notifications to multiple subscribers using topics and subscriptions. It also provides built-in retry logic on failures. While Event Grid offers at-least-once delivery, only Service Bus can guarantee exactly-once when properly configured.

Answer

Azure Event Grid.

Answer

Azure Notification Hubs.

Answer

Azure Queue Storage.

Question 12

You manage an API in Azure API Management. The API response varies depending on the caller's subscription key. You need to cache responses per subscription key to reduce backend load. Which policy configuration should you use?

Accepted Answer

Set cache key to include the subscription key. Azure API Management's caching policy allows you to customize the cache key using the `@(context.Subscription.Id)` expression. By setting the cache key to include the subscription key, each caller's responses are cached separately based on their unique subscription, ensuring that variations in the API response per subscription key are preserved while reducing backend load.

Answer

Use a global cache with no variation

Answer

Disable caching and rely on the backend

Answer

Use rate limiting policy

Question 13

You have an order processing system using Azure Service Bus. Each order generates multiple messages that must be processed in order and by the same consumer. Which Service Bus feature ensures this?

Accepted Answer

Message sessions. Message sessions in Azure Service Bus enable ordered, sequential processing of related messages by a single consumer. When messages belong to the same session, they are guaranteed to be delivered in order and are locked to a single consumer until the session is complete, ensuring that all messages for a given order are processed by the same consumer without interleaving.

Answer

Topics and subscriptions

Answer

Dead-letter queues

Answer

Auto-forwarding

Question 14

A company uses Azure Service Bus to receive order messages. Each order message must be processed exactly once, and duplicate messages are not tolerated due to financial transactions. However, the order processing system sometimes fails and retries, leading to potential duplicates. What Service Bus feature should be enabled on the message to support idempotent processing?

Accepted Answer

Duplicate detection. B is correct because Azure Service Bus's duplicate detection feature uses a user-defined MessageId to identify and discard duplicate messages within a specified time window (default 10 minutes, configurable up to 7 days). This ensures exactly-once processing by preventing the same order message from being processed multiple times, even if the sender retries due to failures.

Answer

Scheduled delivery

Answer

Message sessions

Answer

Auto-forwarding

Question 15

A company exposes an internal REST API to external partners using Azure API Management. They need to enforce a rate limit of 100 requests per minute per subscription. Which policy should they add?

Accepted Answer

Rate limit policy. The Rate limit policy (option B) is correct because it enforces a per-subscription key rate limit of 100 requests per minute, which is exactly what the scenario requires. Azure API Management's rate-limit policy counts requests against the specified duration and blocks additional calls once the limit is exceeded, returning a 429 Too Many Requests response.

Answer

CORS policy

Answer

Throttling policy

Answer

Validate JWT policy