AZ-204 Connect to and consume Azure services and third-party services Practice Test 9 — 15 Questions

Question 1

Which TWO Azure services can be used to implement a pub/sub messaging pattern for decoupling microservices? (Choose two.)

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (A) and Azure Event Grid (D) support pub/sub. Storage Queue (B) is point-to-point. Event Hubs (C) is for telemetry but can be used for pub/sub, but not the typical choice. Azure Logic Apps (E) is an integration service, not a messaging broker.

Answer

Azure Storage Queue

Answer

Azure Event Hubs

Answer

Azure Logic Apps

Question 2

Which THREE actions should be taken to secure an Azure App Service web app that accesses an Azure SQL Database? (Choose three.)

Accepted Answer

Enable Managed Identity for the App Service.. Enable Managed Identity (A), configure firewall (C), and use Azure Key Vault (E) are security best practices. Use connection strings in app settings (B) is less secure. Disable TLS (D) is insecure.

Answer

Store the connection string in App Service application settings.

Answer

Disable TLS 1.2 on the App Service.

Question 3

Which TWO Azure services can be used to trigger an Azure Function in response to a new blob being added to an Azure Storage account? (Choose two.)

Accepted Answer

Azure Blob Storage trigger. Azure Blob Storage trigger (A) and Azure Event Grid subscription (D) can trigger functions on blob creation. Timer trigger (B) is time-based. HTTP trigger (C) is for HTTP requests. Queue trigger (E) is for queue messages.

Answer

HTTP trigger

Answer

Queue trigger

Answer

Timer trigger

Question 4

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. The GitHub Actions configuration is set but the ARM template does not include a workflow file path. The most likely issue is missing a GitHub Actions workflow file in the repo (option C). Option A: isManualIntegration is false, so it should be automated. Option B: runtime is correct. Option D: branch is main, which is typical.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.

Question 5

Refer to the exhibit. You are deploying an API in Azure API Management using an ARM template. The API is configured to use OAuth 2.0 authentication. The deployment fails with a validation error. What is the most likely cause?

Accepted Answer

The authorization server 'auth-server-1' is not defined in the template.. The dependsOn references an authorization server, but the authorization server resource might not be defined in the template (option C). Option A: protocols is correct. Option B: serviceUrl is valid. Option D: dependsOn syntax is correct.

Answer

The serviceUrl is not a valid URL.

Answer

The dependsOn array uses resourceId incorrectly.

Answer

The protocols array does not include http.

Question 6

Refer to the exhibit. An Azure OpenAI Service account is deployed with this ARM template. After deployment, a developer tries to call the OpenAI endpoint from an Azure App Service that has no public IP. The request is blocked. What change should be made to allow access?

Accepted Answer

Configure a private endpoint for the OpenAI account.. The network ACLs only allow a specific IP range. To allow an Azure service without a public IP, you should use a private endpoint (option D). Option A is correct but not listed; option B: changing defaultAction to Allow would allow all traffic, which is insecure. Option C: adding the App Service's outbound IP is not reliable due to dynamic IPs. Option D is the best practice.

Answer

Add a service tag for App Service in the ipRules.

Answer

Change the defaultAction to Allow.

Answer

Add the App Service's outbound IP address to the ipRules.

Question 7

You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?

Accepted Answer

DefaultAzureCredential. The correct answer is DefaultAzureCredential because it automatically uses the managed identity of the App Service when running in Azure, and falls back to other credential types for local development. Option A is wrong because interactive browser authentication requires user interaction and is not suitable for background services. Option B is wrong because client secret authentication is not recommended for managed identities. Option D is wrong because shared access signature is for storage access, not Key Vault.

Answer

SharedAccessSignatureCredential

Answer

InteractiveBrowserCredential

Answer

ClientSecretCredential

Question 8

You are configuring an Azure Event Grid subscription to trigger an Azure Function when a blob is created in a storage account. However, the function is not being triggered. You have verified that the function endpoint is reachable and the storage account is in the same region. What is the most likely cause?

Accepted Answer

The Event Grid subscription does not have the required RBAC role on the function.. Option C is correct because Event Grid requires explicit permission to invoke the function endpoint. If the Event Grid subscription's managed identity or service principal does not have the 'EventGrid Data Sender' role on the function, the invocation will fail silently. Option A is wrong because Event Grid can trigger functions even with public network access disabled as long as private endpoints are configured. Option B is wrong because the AzureWebJobsStorage connection string is for function runtime storage, not for Event Grid triggers. Option D is wrong because blob versioning is not required for Event Grid triggers.

Answer

The storage account has public network access disabled.

Answer

The AzureWebJobsStorage connection string is missing from the function app settings.

Answer

Blob versioning is not enabled on the storage account.

Question 9

You are designing a solution that requires asynchronous processing of messages from an Azure Service Bus queue. The solution must guarantee at-least-once delivery and handle poison messages automatically. Which combination of Service Bus features should you use?

Accepted Answer

PeekLock mode with dead-letter queue. Option D is correct because PeekLock mode locks the message during processing, preventing other consumers from processing it; if processing fails, the lock expires and the message becomes available again, achieving at-least-once delivery. The dead-letter queue automatically captures messages that exceed the maximum delivery count (poison messages). Option A is wrong because ReceiveAndDelete does not guarantee at-least-once delivery; if processing fails after deletion, the message is lost. Option B is wrong because sessions are for ordered processing, not poison handling. Option C is wrong because automatic forwarding is for routing, not poison handling.

Answer

ReceiveAndDelete mode with a separate dead-letter queue

Answer

ReceiveAndDelete mode with automatic forwarding

Answer

PeekLock mode with sessions

Question 10

You are developing an application that needs to store and retrieve large binary objects (up to 5 TB) in Azure Blob Storage. The application requires the ability to access data from any URL via HTTP/HTTPS. Which Blob Storage access tier should you use?

Accepted Answer

Hot. Option B is correct because the Hot tier is optimized for frequent access and supports instant retrieval, which matches the requirement for accessing data from any URL. Option A is wrong because the Cool tier is for infrequent access with a 30-day minimum storage duration and higher access costs. Option C is wrong because the Archive tier is for rarely accessed data with hours-long retrieval latency, not suitable for instant HTTP access. Option D is wrong because the Premium tier is for low-latency, high-transaction scenarios and is more expensive, not necessary for this use case.

Answer

Archive

Answer

Cool

Answer

Premium

Question 11

You are implementing a custom API that calls a downstream API secured with OAuth 2.0. The downstream API requires a client credentials grant flow. You need to securely store the client secret and obtain an access token. What should you use?

Accepted Answer

Azure Key Vault to store the secret and MSAL to obtain the token. Option B is correct because Azure Key Vault securely stores the client secret, and the Microsoft Authentication Library (MSAL) can be used to obtain an access token using the client credentials flow. Option A is wrong because App Configuration is for feature flags and configuration, not for secrets. Option C is wrong because managed identity is for Azure resources, but the downstream API may not support managed identity authentication; client credentials flow requires a client secret. Option D is wrong because Certificate Manager is not an Azure service.

Answer

Azure App Configuration to store the secret and the Azure Identity SDK to obtain the token

Answer

Managed identity to access the downstream API directly

Answer

Azure Certificate Manager to store the secret and the HttpClient to obtain the token

Question 12

You are using Azure API Management to expose a legacy SOAP API as a RESTful API. The SOAP API has complex XML schemas. You need to transform the SOAP response to JSON. Which policy should you use?

Accepted Answer

set-body. Option D is correct because the set-body policy allows you to transform the response body using a Liquid template or XSLT, which can convert SOAP XML to JSON. Option A is wrong because the convert-to-json policy is not a standard API Management policy; it does not exist. Option B is wrong because the transform-body policy does not exist; the correct policy is set-body. Option C is wrong because the return-response policy is for returning a custom response, not for transforming the body.

Answer

transform-body

Answer

return-response

Answer

convert-to-json

Question 13

You need to process large volumes of streaming data from IoT devices in near real-time. The processed data must be stored in Azure Cosmos DB for further analysis. Which Azure service should you use for stream processing?

Accepted Answer

Azure Stream Analytics. Option C is correct because Azure Stream Analytics is designed for real-time stream processing and can output directly to Azure Cosmos DB. Option A is wrong because Azure Data Lake Storage is a storage service, not a stream processing service. Option B is wrong because Azure Databricks is a big data analytics platform, but it is not the most straightforward for simple stream processing to Cosmos DB; it requires more configuration. Option D is wrong because Azure Batch is for batch processing, not streaming.

Answer

Azure Batch

Answer

Azure Databricks

Answer

Azure Data Lake Storage

Question 14

You are developing a microservice that needs to publish events to multiple subscribers. Each subscriber should receive the event independently and at its own pace. The event must be retained for up to 7 days. Which Azure messaging service should you use?

Accepted Answer

Azure Event Grid. Option D is correct because Event Grid supports event publishing to multiple subscribers, each receiving the event independently, and has a retention period of up to 7 days by default (configurable up to 7 days). Option A is wrong because Service Bus queues are for point-to-point communication, not pub/sub. Option B is wrong because Event Hubs is for streaming large volumes of data, not for discrete event fan-out. Option C is wrong because Service Bus topics support pub/sub, but the default retention is up to 14 days, but the requirement is for 7 days; however, Event Grid is more appropriate for discrete events and has simpler integration.

Answer

Azure Service Bus queue

Answer

Azure Service Bus topic

Answer

Azure Event Hubs

Question 15

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

Accepted Answer

The storage account is behind a firewall and the Cognitive Search service IP is not allowed.. Option A is correct because if the storage account is behind a firewall, the Cognitive Search service must be granted access via firewall rules or by using a managed identity with appropriate permissions. The suggested resolution is to add the Cognitive Search service's IP address to the storage account firewall rules. Option B is wrong because the indexer does not require the search service to be in the same region. Option C is wrong because the indexer uses the storage account connection string, not a search service key, to access the data source. Option D is wrong because the indexer configuration does not need to specify the storage account key separately if using a connection string.

Answer

The Cognitive Search service is in a different region than the storage account.

Answer

The Cognitive Search service's admin key is missing.

Answer

The indexer configuration is missing the storage account key.