AZ-204 Connect to and consume Azure services and third-party services Practice Test 9 — 15 Questions

Question 1

An application uses Azure Event Hubs to ingest telemetry data. The team wants to process the data in near real-time and store aggregated results in Azure SQL Database. Which Azure service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Stream Analytics. Azure Stream Analytics is the correct choice because it is a fully managed stream processing engine designed for real-time analytics on high-throughput data from sources like Event Hubs. It can ingest telemetry data, apply SQL-based queries for aggregation (e.g., tumbling windows), and output results directly to Azure SQL Database with exactly-once semantics, meeting the near-real-time requirement.

Answer

Azure HDInsight

Answer

Azure Functions

Answer

Azure Data Lake Storage Gen2

Question 2

A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?

Accepted Answer

Managed Identity. Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Microsoft Entra ID automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.

Answer

ACR Tasks

Answer

ACR admin keys

Answer

Service principal with password

Question 3

A company uses Azure Service Bus for messaging between microservices. They need to ensure that messages are processed in order within a partition. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus provide strict message ordering and first-in-first-out (FIFO) guarantees within a session. By setting the SessionId property on messages, all messages with the same session ID are processed sequentially by a single receiver, ensuring order is preserved even across multiple partitions or competing consumers.

Answer

Duplicate detection

Answer

Partitioning

Answer

Dead-letter queue

Question 4

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

Accepted Answer

Increase the time-to-live (TTL) for cached items. High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Answer

Increase the cache size

Answer

Implement cache-aside pattern with manual invalidation

Answer

Change the eviction policy to allkeys-lfu

Question 5

A developer needs to deploy a web app that uses Azure SQL Database. They want to connect to the database using a connection string without storing it in code. Which feature of Azure App Service should they use?

Accepted Answer

Key Vault references. Key Vault references in Azure App Service allow an app setting to point to a secret stored in Azure Key Vault, so the connection string is never stored in code or in plaintext app settings. The App Service resolves the reference at runtime using the app's managed identity, which must have GET permission on the Key Vault secret. This is the recommended pattern for injecting secrets into App Service without hardcoding them.

Answer

Environment variables

Answer

Application settings

Answer

Azure App Configuration

Question 6

A company has an Azure Function app that processes messages from an Azure Storage queue. The function fails intermittently with timeout exceptions when the queue has many messages. What is the best approach to handle this?

Accepted Answer

Increase the batch size in the function's host.json. Increasing the batch size in host.json allows the function to retrieve more messages per invocation, reducing the number of polling cycles and improving throughput. This directly addresses timeout exceptions under high queue load by processing messages more efficiently within the function's execution time limit.

Answer

Upgrade to a Premium plan

Answer

Decrease the batch size to reduce processing time per batch

Answer

Scale out the function app to multiple instances

Question 7

Which TWO services can be used to implement a publish-subscribe messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (C) implement publish-subscribe natively: a topic receives messages from publishers and fans them out to multiple subscriptions, each of which can have filters/rules, so multiple independent subscribers each get a copy. Azure Event Grid (D) is also a publish-subscribe service, using topics and event subscriptions to push events to multiple handlers via a push delivery model. Azure Storage Queues (A) and Azure Queue Storage (E) are the same point-to-point queue service, where each message is consumed by only one receiver, so they do not provide pub-sub fan-out. Azure Event Hubs (B) is a streaming/event-ingestion service using partitions and consumer groups; while multiple consumers can read the stream, it is not a true publish-subscribe topic/subscription pattern with per-subscriber filtering like Service Bus Topics or Event Grid.

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 8

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

Accepted Answer

Use an endpoint and an access key from Azure Communication Services.. Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Answer

Use an Azure AD service principal with client secret.

Answer

Use a connection string from the Azure portal.

Answer

Use a managed identity for Azure resources.

Question 9

Your Azure Function app needs to call a third-party REST API that requires OAuth 2.0 client credentials flow. The API expects a JWT token signed with a client certificate. You want to store the certificate securely and rotate it automatically. Which Azure service and feature should you use?

Accepted Answer

Store the certificate in Azure Key Vault with automatic rotation enabled, and use Managed Identity to access it from the Function app.. Azure Key Vault provides secure storage for client certificates with built-in automatic rotation capabilities, and using Managed Identity allows the Azure Function app to authenticate to Key Vault without storing any secrets in code or configuration. This combination satisfies the OAuth 2.0 client credentials flow requirement by enabling the Function app to retrieve the certificate dynamically and sign the JWT token.

Answer

Store the certificate in Azure Cosmos DB as a document, and retrieve it using the Cosmos DB SDK.

Answer

Store the certificate in Azure App Service as a TLS/SSL binding, and use the WEBSITE_LOAD_CERTIFICATES app setting.

Answer

Store the certificate in Azure Storage as a blob, and reference it from the Function app using a SAS token.

Question 10

You develop an IoT solution using Azure IoT Hub. Devices send telemetry data that must be processed by a custom Azure Function. You need to ensure that the Function processes messages in order per device and exactly once. Which IoT Hub feature should you use?

Accepted Answer

Use IoT Hub's built-in Event Hub-compatible endpoint with a consumer group that has one partition per device.. IoT Hub's built-in Event Hub-compatible endpoint supports partitioning, and by using a consumer group with one partition per device, you can guarantee per-device ordering and exactly-once processing. The Event Hub model ensures that messages from the same device (same partition key) are delivered in order and can be checkpointed to avoid duplicates.

Answer

Use IoT Hub message routing to send messages to a Service Bus queue, and process from the queue.

Answer

Use IoT Hub direct methods to invoke the Function per device.

Answer

Use IoT Hub device twins to store telemetry and trigger the Function on twin changes.

Question 11

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it.. Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements. This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Answer

Store the API key in Azure SQL Database and query it at startup.

Answer

Store the API key in a configuration file in the application code.

Answer

Store the API key in an App Service application setting.

Question 12

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

Accepted Answer

Set custom headers in the event subscription's 'Delivery Properties' configuration.. Azure Event Grid allows you to specify custom HTTP headers in the 'Delivery Properties' section of an event subscription. This feature lets you add static or dynamic headers (e.g., authentication tokens or correlation IDs) that are included in the HTTPS POST request to the subscriber's endpoint. It directly addresses the requirement for custom headers without needing any additional infrastructure.

Answer

Use Event Grid's 'Advanced Filters' to add custom headers to events.

Answer

Use Event Grid domains to route events to the third-party service.

Answer

Configure a dead-letter destination to handle delivery failures.

Question 13

Your team is migrating a legacy application to Azure. The application uses a proprietary database that is not supported by Azure SQL or Cosmos DB. You need to provide a managed database service with minimal rearchitecture. Which Azure service should you use?

Accepted Answer

Azure Virtual Machines with the database software installed. Azure Virtual Machines (IaaS) is the correct choice because the proprietary database is not supported by any Azure PaaS database service. By deploying the database software on a VM, you retain full control over the database engine and configuration, enabling a lift-and-shift migration with minimal rearchitecture. This approach avoids the need to rewrite application code or adapt to a different database schema.

Answer

Azure Database for MySQL

Answer

Azure Database Migration Service

Answer

Azure SQL Database

Question 14

You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?

Accepted Answer

Store the key in an environment variable on the hosting machine.. Storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Microsoft Entra ID is explicitly configured.

Answer

Store the key in a text file in the application directory.

Answer

Use Azure AD authentication instead of a key.

Answer

Hardcode the key in the Python source code.

Question 15

Which TWO are valid ways to authenticate to Azure Service Bus from an application? (Choose two.)

Accepted Answer

Using Azure AD and a managed identity.. Option B is correct because Azure Service Bus supports Microsoft Entra ID (Azure AD) authentication, and an application running on an Azure resource can use its managed identity to obtain a token for the Service Bus data plane without handling secrets. Option E is correct because Service Bus natively supports Shared Access Signature (SAS) authentication, where the connection string contains a SAS key name and key value that authorize access to the namespace or specific entities. Option A is not valid because Service Bus does not accept an X.509 certificate directly in a connection string; certificate-based credentials are used with Microsoft Entra ID, not embedded in the connection string. Option C is wrong because a SAS key from Azure Event Hubs is scoped to Event Hubs and cannot authenticate to Service Bus. Option D is wrong because a storage account access key authorizes access to Azure Storage services, not Service Bus.

Answer

Using an X.509 certificate directly in the connection string.

Answer

Using a connection string with a SAS key from Azure Event Hubs.

Answer

Using a storage account access key.