AZ-204 Connect to and consume Azure services and third-party services Practice Test 6 — 15 Questions

Question 1

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

Accepted Answer

Increase the time-to-live (TTL) for cached items. Increasing TTL keeps data in cache longer, reducing misses. Option A is wrong because increasing cache size does not guarantee better hit ratio. Option C is wrong because manual invalidation may increase misses. Option D is wrong because eviction policy affects which data is removed, not hit ratio directly.

Answer

Increase the cache size

Answer

Implement cache-aside pattern with manual invalidation

Answer

Change the eviction policy to allkeys-lfu

Question 2

A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?

Accepted Answer

Application settings. App Settings in Azure App Service allow storing connection strings securely. Option B is wrong because Key Vault references are used but require additional setup. Option C is wrong because App Configuration is for configuration management. Option D is wrong because Environment variables are not persistent in App Service.

Answer

Key Vault references

Answer

Environment variables

Answer

Azure App Configuration

Question 3

A company has an Azure Function app that processes messages from an Azure Storage queue. The function fails intermittently with timeout exceptions when the queue has many messages. What is the best approach to handle this?

Accepted Answer

Increase the batch size in the function's host.json. Increasing the batch size allows the function to process more messages per invocation, improving throughput. Option A is wrong because scaling out may cause more timeouts. Option C is wrong because reducing batch size would increase timeouts. Option D is wrong because premium plan increases cost but does not directly solve timeouts.

Answer

Upgrade to a Premium plan

Answer

Decrease the batch size to reduce processing time per batch

Answer

Scale out the function app to multiple instances

Question 4

Which TWO services can be used to implement a publish-subscribe messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics and Azure Event Grid both support publish-subscribe. Option B is wrong because Storage Queues use point-to-point. Option D is wrong because Event Hubs is for event ingestion, not pub-sub. Option E is wrong because Azure Queue Storage is point-to-point.

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 5

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. Option B is correct because an app registration in Microsoft Entra ID (formerly Azure AD) is required to define the application identity, configure API permissions for Microsoft Graph, and obtain a client ID and tenant ID. This registration is the foundation for OAuth 2.0 authentication flows, enabling the Azure Function to request an access token for Microsoft Graph.

Answer

Azure API Management

Answer

Azure SQL Database

Question 6

Which TWO approaches can be used to securely connect an Azure web app to an on-premises database without exposing it to the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway and Azure ExpressRoute create secure connections between Azure and on-premises networks. Option B is wrong because Hybrid Connections require a relay agent. Option D is wrong because App Service Hybrid Connections are for specific services, not general connectivity. Option E is wrong because public endpoints expose the database to internet.

Answer

Azure API Management

Answer

Public IP address with firewall rules

Answer

Azure App Service Hybrid Connections

Question 7

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

Accepted Answer

Use an endpoint and an access key from Azure Communication Services.. Azure Communication Services uses an endpoint and an access key for authentication. Connection strings are not used; Azure AD is supported but requires additional setup; managed identity is an option but not the simplest for this scenario.

Answer

Use an Azure AD service principal with client secret.

Answer

Use a connection string from the Azure portal.

Answer

Use a managed identity for Azure resources.

Question 8

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault can store the certificate, and the Managed Identity of the Function app can authenticate to Key Vault. Automatic rotation requires Key Vault's certificate auto-rotation feature. Option A is the best combination.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 9

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

Accepted Answer

Configure a retry policy in the Logic App action to retry on failure with exponential backoff.. Gmail has sending limits; to avoid hitting them, use a retry policy with exponential backoff in Logic Apps. Option A is the correct approach. Option B is not available; Option C is unnecessary if retries are configured; Option D is not a standard feature.

Answer

Use Azure Queue Storage to buffer messages and process them asynchronously.

Answer

Use a webhook instead of a connector to send emails directly via Gmail API.

Answer

Increase the Gmail API quota by contacting Google support.

Question 10

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. APIM can transform SOAP to REST using policies. For WS-Security, you can use the 'set-header' policy to add the UsernameToken. Option C is correct because you need to pass credentials to the backend. Option A is not possible; Option B is not needed; Option D is for OAuth.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 11

You develop an IoT solution using Azure IoT Hub. Devices send telemetry data that must be processed by a custom Azure Function. You need to ensure that the Function processes messages in order per device and exactly once. Which IoT Hub feature should you use?

Accepted Answer

Use IoT Hub's built-in Event Hub-compatible endpoint with a consumer group that has one partition per device.. IoT Hub's Event Hub-compatible endpoint supports consumer groups, but for ordered processing per device, you need to partition by device ID. Option D is correct because using the built-in endpoint with a consumer group per partition ensures ordering. Option A does not guarantee exactly once; Option B is for device management; Option C is for cloud-to-device.

Answer

Use IoT Hub message routing to send messages to a Service Bus queue, and process from the queue.

Answer

Use IoT Hub direct methods to invoke the Function per device.

Answer

Use IoT Hub device twins to store telemetry and trigger the Function on twin changes.

Question 12

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in an App Service application setting.. Option D is correct because App Service application settings are encrypted at rest and can be updated directly in the Azure portal or via CLI without redeploying the app. The app reads the setting at runtime from environment variables, making it easy to rotate the API key by simply changing the setting value. This approach satisfies the requirements of secure storage and rotation without redeployment.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.

Answer

Store the API key in a configuration file in the application code.

Question 13

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

Accepted Answer

Set custom headers in the event subscription's 'Delivery Properties' configuration.. Event Grid supports custom headers in event subscriptions via the 'includedEventTypes' and 'subjectBeginsWith' filters, but for custom headers, you need to use the 'Advanced Filter' or 'Delivery Properties'. Option C is correct because you can set custom headers in the event subscription. Option A is not supported; Option B is for dead-lettering; Option D is for filtering.

Answer

Use Event Grid's 'Advanced Filters' to add custom headers to events.

Answer

Use Event Grid domains to route events to the third-party service.

Answer

Configure a dead-letter destination to handle delivery failures.

Question 14

Your team is migrating a legacy application to Azure. The application uses a proprietary database that is not supported by Azure SQL or Cosmos DB. You need to provide a managed database service with minimal rearchitecture. Which Azure service should you use?

Accepted Answer

Azure Virtual Machines with the database software installed. Azure Database Migration Service helps migrate databases to Azure, but for unsupported databases, you can use Azure Virtual Machines to host the database. Option B is correct. Option A is for SQL servers; Option C is for PostgreSQL/MySQL; Option D is a migration tool, not a hosting service.

Answer

Azure Database for MySQL

Answer

Azure Database Migration Service

Answer

Azure SQL Database

Question 15

You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?

Accepted Answer

Store the key in an environment variable on the hosting machine.. Option B is correct because storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.

Answer

Store the key in a text file in the application directory.

Answer

Use Azure AD authentication instead of a key.

Answer

Hardcode the key in the Python source code.