AZ-204 Connect to and consume Azure services and third-party services Practice Test 4 — 15 Questions

Question 1

You manage an API in Azure API Management. You need to enforce a rate limit of 200 requests per minute for each subscription key. Which policy should you include in the inbound policy section?

Accepted Answer

policy. The policy in Azure API Management is specifically designed to enforce a per-subscription key rate limit, such as 200 requests per minute. It operates on a sliding window counter to smooth traffic and is applied in the inbound section to evaluate each request before it reaches the backend. This matches the requirement exactly.

Answer

<quota> policy

Answer

<limit-concurrency> policy

Answer

<throttle> policy

Question 2

You are building a serverless workflow using Azure Logic Apps. The workflow must start when a new blob is uploaded to a specific container in Azure Blob Storage. Which trigger should you configure?

Accepted Answer

When a blob is created or modified (blob trigger). The 'When a blob is created or modified (blob trigger)' is the native Azure Logic Apps trigger designed to start a workflow automatically when a new blob is uploaded or an existing blob is modified in a specified Azure Blob Storage container. This trigger uses the Azure Blob Storage event subscription to detect changes and is the appropriate choice for event-driven serverless workflows that respond to blob storage events.

Answer

HTTP request trigger

Answer

Recurrence trigger

Answer

Service Bus trigger

Question 3

You are building an Azure Logic App that must send a confirmation email to users after a purchase. Your company uses Office 365 for email and you want to use the corporate email address. Which connector should you use?

Accepted Answer

Office 365 Outlook. The Office 365 Outlook connector is the correct choice because it provides direct, managed integration with Office 365 email services, allowing the Logic App to send emails using the corporate email address without needing to configure SMTP server details or handle authentication manually. This connector supports OAuth 2.0 authentication, which is the recommended and secure method for accessing Office 365 resources, and it is specifically designed for enterprise Office 365 accounts.

Answer

SMTP

Answer

SendGrid

Answer

Outlook.com

Question 4

A company uses Azure Logic Apps to automate business processes. They need to call an external REST API that requires OAuth 2.0 client credentials grant. Which connector should they use with minimal configuration?

Accepted Answer

HTTP connector. The HTTP connector in Azure Logic Apps supports OAuth 2.0 client credentials grant natively with minimal configuration. You can directly set the authentication type to 'Active Directory OAuth' and provide the tenant ID, client ID, client secret, and audience/resource URI. This avoids the need for custom code or additional connectors.

Answer

HTTP + Swagger connector

Answer

Azure Functions connector

Answer

Custom connector

Question 5

A company uses Azure Service Bus to decouple microservices. They need to ensure that messages are processed in the order they are received, and that each message is handled by exactly one consumer instance even when the system scales out. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus enforce first-in-first-out (FIFO) ordering and guarantee that all messages with the same session ID are processed by a single consumer instance. This ensures strict message ordering and exactly-once processing per session, even when multiple consumers are scaled out. Without sessions, competing consumers would break ordering because messages could be processed by different instances concurrently.

Answer

Topics

Answer

Dead-letter queue

Answer

Duplicate detection

Question 6

You are building an Azure Logic App that must send an email notification when a new file is added to a SharePoint Online document library. Which connector and trigger should you use?

Accepted Answer

Use the SharePoint connector with the 'When a file is created' trigger. The SharePoint connector's 'When a file is created' trigger is the correct choice because it directly monitors a SharePoint Online document library for new file additions and initiates the Logic App workflow automatically. This trigger uses SharePoint's webhook capabilities to receive real-time notifications, eliminating the need for polling or manual intervention.

Answer

Use the Office 365 Outlook connector with the 'When a new email arrives' trigger

Answer

Use the Azure Blob Storage connector with the 'When a blob is added or modified' trigger

Answer

Use the HTTP connector with a manual trigger and poll SharePoint's REST API

Question 7

You are building a mobile app backend using Azure Functions. The function must send push notifications to devices using the Notification Hubs service. You need to authenticate the function to Notification Hubs using the principle of least privilege. What should you use?

Accepted Answer

Use a managed identity assigned to the Function App to access Notification Hubs.. Using a managed identity assigned to the Function App allows it to authenticate to Azure Notification Hubs without storing any credentials in code or configuration. This follows the principle of least privilege by granting only the necessary permissions (e.g., via Azure RBAC role assignments like 'Notification Hubs Data Sender') and eliminates the risk of connection string leakage. Managed identities are the recommended approach for Azure services to securely access other Azure resources.

Answer

Store the Notification Hubs connection string in Application Settings.

Answer

Create a shared access signature (SAS) token for the Notification Hub.

Answer

Use Microsoft Entra ID OAuth 2.0 client credentials flow.

Question 8

You are building an Azure Logic App that must connect to a third-party CRM system using a custom API. The API requires an API key in the header of every request. You need to securely store the API key and reference it in the Logic App. Which approach should you use?

Accepted Answer

Store the API key in Azure Key Vault and reference it with a dynamic expression.. Azure Key Vault provides a secure, centralized store for secrets like API keys, and Logic Apps can reference these secrets at runtime using a dynamic expression (e.g., `@Microsoft.KeyVault(SecretUri=...)`). This avoids exposing the key in plaintext within the Logic App definition or configuration, aligning with Azure security best practices for managed identities and secret management.

Answer

Store the API key in the Azure Logic App's definition file.

Answer

Use a parameter and a connection reference in the Logic App.

Answer

Hardcode the API key in the HTTP action.

Question 9

You are building an integration solution that connects an on-premises SQL Server database to Azure Data Factory. The on-premises network does not allow direct inbound connections from Azure. You need to securely transfer data from the database to Azure Blob Storage. Which data factory component should you use?

Accepted Answer

Self-hosted Integration Runtime. The Self-hosted Integration Runtime (SHIR) is required because the on-premises SQL Server database resides in a network that blocks direct inbound connections from Azure. SHIR acts as a bridge, running on a local machine or VM within the on-premises network, enabling Azure Data Factory to securely connect to the database via outbound HTTPS (port 443) or the Microsoft Service Bus. It handles data movement and transformation without exposing the on-premises network to inbound traffic.

Answer

Azure Integration Runtime

Answer

Azure-SSIS Integration Runtime

Answer

Azure Data Lake Storage connector

Question 10

Your company uses Azure Logic Apps to automate a business process. The process needs to call an external REST API that requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault secret and a managed identity. Azure Key Vault securely stores secrets like API keys, and using a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials in code or configuration. This follows the principle of least privilege and eliminates the need to manage secrets in connection strings or parameter files.

Answer

Store the API key in the Logic App's definition as a constant

Answer

Hardcode the API key in a parameter file

Answer

Use an Azure Storage account table to store the key

Question 11

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

Accepted Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to true. Service Bus sessions provide first-in-first-out (FIFO) ordering and exactly-once processing. By enabling sessions (IsSessionsEnabled = true) and using PeekLock mode, the Logic App can lock a message while processing, ensuring it is not delivered to other consumers, and sessions guarantee that messages with the same session ID are processed in order. This meets the requirement of processing each message exactly once and in the order received.

Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to false

Answer

Use a Service Bus trigger with the 'ReceiveAndDelete' mode

Answer

Use an Event Grid trigger for Service Bus

Question 12

You are building an Azure Logic App that must send email notifications via Office 365 when a new order is placed. You need to securely store the Office 365 credentials and reference them in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault connector with a managed identity assigned to the Logic App. Using an Azure Key Vault connector with a managed identity assigned to the Logic App allows you to securely store Office 365 credentials in Key Vault and authenticate to it without hardcoding secrets or managing credentials. The managed identity provides an Azure AD-backed identity for the Logic App, eliminating the need for username/password in connection strings and enabling secure, auditable access to secrets.

Answer

Store the credentials in a variable within the Logic App designer

Answer

Use an Azure Key Vault action with a connection that uses a username and password

Answer

Store the credentials in an Azure Storage table and fetch them in the Logic App

Question 13

You are building an Azure Logic App that must call a third-party REST API. The API requires an API key passed as a query parameter. You need to store the API key securely and automatically add it to each request. Which approach should you use?

Accepted Answer

Use Azure Key Vault and the Key Vault connector to retrieve the secret dynamically.. Azure Key Vault provides a secure, centralized service for storing secrets like API keys, and the Key Vault connector in Logic Apps allows you to dynamically retrieve the secret at runtime without exposing it in the workflow definition. This approach ensures the API key is never hardcoded or stored in plaintext, meeting security best practices for accessing third-party APIs.

Answer

Hardcode the API key in the Logic App definition.

Answer

Store the API key in an Azure Storage Table and reference it from the Logic App.

Answer

Use an environment variable in the Logic App.

Question 14

You are building an Azure Logic App that must call an external API secured with OAuth 2.0 Client Credentials flow. The external API is registered in a different Microsoft Entra ID tenant. You need to obtain an access token and add it to the request headers. Which action and authentication configuration should you use?

Accepted Answer

Use the HTTP action with Active Directory OAuth authentication, providing the tenant ID, client ID, and client secret.. The HTTP action's Active Directory OAuth authentication type directly supports the OAuth 2.0 Client Credentials flow for cross-tenant scenarios. By providing the tenant ID, client ID, and client secret, the Logic App runtime can obtain an access token from the external tenant's token endpoint and automatically inject it into the Authorization header as a Bearer token. This is the only built-in authentication option in the HTTP action that handles the client credentials grant without custom code.

Answer

Use the HTTP action with Managed Identity authentication.

Answer

Use the HTTP + Swagger connector to import the API definition.

Answer

Use the Azure Key Vault - Get secret action to retrieve a token.

Question 15

Your company uses Azure Logic Apps to automate workflows. A workflow must call an external REST API that requires an API key in the header. You need to securely store the API key and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use the Key Vault connector to retrieve it dynamically in the Logic App.. Azure Key Vault provides a secure, centralized store for secrets like API keys, and the Logic App Key Vault connector retrieves the key at runtime without exposing it in the workflow definition. This approach ensures the secret is never stored in plain text within the Logic App's JSON definition or source control, aligning with Azure security best practices for managed identities and access policies.

Answer

Store the API key in plain text directly in the Logic App HTTP action header.

Answer

Store the API key in an App Service application setting and reference it using the 'appsetting' expression.

Answer

Create an Azure Function with the API key hardcoded as an environment variable and call it from the Logic App.