AZ-204 Connect to and consume Azure services and third-party services Practice Test 8 — 15 Questions

Question 1

A developer is building a solution that sends emails via SendGrid from Azure. Which Azure service should they use to integrate with SendGrid?

Accepted Answer

Azure Logic Apps. Azure Logic Apps provides a managed connector for SendGrid that simplifies integration by offering pre-built triggers and actions for sending emails. This allows developers to create automated workflows without writing custom code, making it the ideal choice for integrating SendGrid with Azure services.

Answer

Azure API Management

Answer

Azure Functions

Answer

Azure Event Grid

Question 2

An application uses Azure Event Hubs to ingest telemetry data. The team wants to process the data in near real-time and store aggregated results in Azure SQL Database. Which Azure service should they use?

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is a fully managed stream processing engine designed for real-time analytics on high-throughput data from sources like Event Hubs. It can ingest telemetry data, apply SQL-based queries for aggregation (e.g., tumbling windows), and output results directly to Azure SQL Database with exactly-once semantics, meeting the near-real-time requirement.

Answer

Azure HDInsight

Answer

Azure Functions

Answer

Azure Data Lake Storage Gen2

Question 3

A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?

Accepted Answer

Managed Identity. Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Azure AD automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.

Answer

ACR Tasks

Answer

ACR admin keys

Answer

Service principal with password

Question 4

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

Accepted Answer

Store in Azure Key Vault. Azure Key Vault is the secure store for secrets like client secrets. Option A is wrong because environment variables are not secure. Option B is wrong because App Configuration is for configuration. Option D is wrong because Managed Identity does not store secrets; it provides identity.

Answer

Store in application settings as environment variable

Answer

Store in Azure App Configuration

Answer

Use Managed Identity

Question 5

A company uses Azure Service Bus for messaging between microservices. They need to ensure that messages are processed in order within a partition. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus provide strict message ordering and first-in-first-out (FIFO) guarantees within a session. By setting the SessionId property on messages, all messages with the same session ID are processed sequentially by a single receiver, ensuring order is preserved even across multiple partitions or competing consumers.

Answer

Duplicate detection

Answer

Partitioning

Answer

Dead-letter queue

Question 6

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

Accepted Answer

Increase the time-to-live (TTL) for cached items. High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Answer

Increase the cache size

Answer

Implement cache-aside pattern with manual invalidation

Answer

Change the eviction policy to allkeys-lfu

Question 7

A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?

Accepted Answer

Key Vault references. Key Vault references in Azure App Service allow the web app to securely retrieve secrets, such as connection strings, from Azure Key Vault. This is considered a best practice for managing sensitive information, as Key Vault provides centralized secret management, access control, auditing, and secret rotation capabilities. The App Service can resolve these references at runtime, injecting the secret into the application as an environment variable without storing it directly in the App Service configuration or code. Option C (Application settings) can store connection strings and are encrypted at rest, but Key Vault offers superior security and management features specifically for secrets. Option B (Environment variables) are not a persistent or managed solution for configuration in App Service. Option D (Azure App Configuration) is a centralized configuration service, but Key Vault is specifically designed for secrets and is more directly integrated for this purpose with App Service via references.

Answer

Environment variables

Answer

Application settings

Answer

Azure App Configuration

Question 8

A company has an Azure Function app that processes messages from an Azure Storage queue. The function fails intermittently with timeout exceptions when the queue has many messages. What is the best approach to handle this?

Accepted Answer

Increase the batch size in the function's host.json. Increasing the batch size in host.json allows the function to retrieve more messages per invocation, reducing the number of polling cycles and improving throughput. This directly addresses timeout exceptions under high queue load by processing messages more efficiently within the function's execution time limit.

Answer

Upgrade to a Premium plan

Answer

Decrease the batch size to reduce processing time per batch

Answer

Scale out the function app to multiple instances

Question 9

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

Accepted Answer

Use an endpoint and an access key from Azure Communication Services.. Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Answer

Use an Azure AD service principal with client secret.

Answer

Use a connection string from the Azure portal.

Answer

Use a managed identity for Azure resources.

Question 10

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault provides secure storage for client certificates with built-in automatic rotation capabilities, and using Managed Identity allows the Azure Function app to authenticate to Key Vault without storing any secrets in code or configuration. This combination satisfies the OAuth 2.0 client credentials flow requirement by enabling the Function app to retrieve the certificate dynamically and sign the JWT token.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 11

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

Accepted Answer

Configure a retry policy in the Logic App action to retry on failure with exponential backoff.. To handle Gmail's sending limits in Azure Logic Apps, you should configure a retry policy with exponential backoff on the Gmail connector action. This automatically retries failed sends due to rate limiting, spacing out retries to avoid further limits. Option A (Azure Queue Storage) is unnecessary because Logic Apps can handle retries natively. Option B (webhook) bypasses the connector but doesn't address limits inherently. Option C (increasing quota) is possible but not a built-in solution and may not be available. Thus, D is correct.

Answer

Use Azure Queue Storage to buffer messages and process them asynchronously.

Answer

Use a webhook instead of a connector to send emails directly via Gmail API.

Answer

Increase the Gmail API quota by contacting Google support.

Question 12

You develop an IoT solution using Azure IoT Hub. Devices send telemetry data that must be processed by a custom Azure Function. You need to ensure that the Function processes messages in order per device and exactly once. Which IoT Hub feature should you use?

Accepted Answer

Use IoT Hub's built-in Event Hub-compatible endpoint with a consumer group that has one partition per device.. IoT Hub's built-in Event Hub-compatible endpoint supports partitioning, and by using a consumer group with one partition per device, you can guarantee per-device ordering and exactly-once processing. The Event Hub model ensures that messages from the same device (same partition key) are delivered in order and can be checkpointed to avoid duplicates.

Answer

Use IoT Hub message routing to send messages to a Service Bus queue, and process from the queue.

Answer

Use IoT Hub direct methods to invoke the Function per device.

Answer

Use IoT Hub device twins to store telemetry and trigger the Function on twin changes.

Question 13

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.. Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements. This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in a configuration file in the application code.

Answer

Store the API key in an App Service application setting.

Question 14

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

Accepted Answer

Set custom headers in the event subscription's 'Delivery Properties' configuration.. Azure Event Grid allows you to specify custom HTTP headers in the 'Delivery Properties' section of an event subscription. This feature lets you add static or dynamic headers (e.g., authentication tokens or correlation IDs) that are included in the HTTPS POST request to the subscriber's endpoint. It directly addresses the requirement for custom headers without needing any additional infrastructure.

Answer

Use Event Grid's 'Advanced Filters' to add custom headers to events.

Answer

Use Event Grid domains to route events to the third-party service.

Answer

Configure a dead-letter destination to handle delivery failures.

Question 15

Your team is migrating a legacy application to Azure. The application uses a proprietary database that is not supported by Azure SQL or Cosmos DB. You need to provide a managed database service with minimal rearchitecture. Which Azure service should you use?

Accepted Answer

Azure Virtual Machines with the database software installed. Azure Virtual Machines (IaaS) is the correct choice because the proprietary database is not supported by any Azure PaaS database service. By deploying the database software on a VM, you retain full control over the database engine and configuration, enabling a lift-and-shift migration with minimal rearchitecture. This approach avoids the need to rewrite application code or adapt to a different database schema.

Answer

Azure Database for MySQL

Answer

Azure Database Migration Service

Answer

Azure SQL Database