AZ-204 Connect to and consume Azure services and third-party services Practice Test 9 — 15 Questions

Question 1

You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?

Accepted Answer

Store the key in an environment variable on the hosting machine.. Storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.

Answer

Store the key in a text file in the application directory.

Answer

Use Azure AD authentication instead of a key.

Answer

Hardcode the key in the Python source code.

Question 2

You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?

Accepted Answer

The App Service does not have a managed identity enabled and the Key Vault access policy is missing.. An Azure App Service must have a managed identity enabled and the Key Vault must have an access policy granting that identity the 'Get' permission for secrets. Without these, the App Service cannot authenticate to Key Vault, causing the deployment to fail with an access error.

Answer

The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.

Answer

The ARM template cannot use Key Vault references in app settings.

Answer

The secret name in the URI does not match the actual secret name.

Question 3

You are querying Azure Monitor metrics using Kusto Query Language (KQL). The query is supposed to return average metric values per hour per resource provider, but it returns no results. What is the most likely issue?

Accepted Answer

The table name should be 'AzureMetrics' instead of 'metrics'.. C is correct because the Azure Monitor metrics table is named 'AzureMetrics', not 'metrics'. When querying Azure Monitor metrics using KQL, referencing the wrong table name will result in no results being returned, as the query engine cannot find the specified table.

Answer

The ORDER BY clause should be before GROUP BY.

Answer

The 'bin' function is used incorrectly; it should be 'bin(TimeGenerated, 1h)' without the alias.

Answer

The GROUP BY clause cannot include a computed column like 'bin'.

Question 4

Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?

Accepted Answer

Microsoft Entra Workload ID (formerly Azure AD Pod Identity). Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.

Answer

Service principal with certificate stored in the pod

Answer

User-assigned managed identity on the node resource group

Answer

System-assigned managed identity on AKS cluster

Question 5

A web app running on Azure App Service must integrate with Microsoft Graph API to read user profiles. The app is registered in Microsoft Entra ID and uses the OAuth 2.0 authorization code flow. However, after deployment, the app fails to acquire tokens. What is the most likely cause?

Accepted Answer

The redirect URI is not configured in the app registration. The OAuth 2.0 authorization code flow requires a redirect URI to be registered in the app registration in Microsoft Entra ID. This URI is where the authorization server sends the authorization code after user consent. If the redirect URI is missing or mismatched, the token acquisition fails because the authorization server cannot validate the callback endpoint, causing the authentication request to be rejected.

Answer

The API permission for User.Read is not granted

Answer

The app is using the client credentials flow instead of authorization code flow

Answer

The client secret is expired

Question 6

You are developing a solution that processes events from Azure Event Hubs and stores them in Azure Blob Storage. The processing must be idempotent and exactly-once. Which approach should you use?

Accepted Answer

Use EventProcessorHost with checkpointing and blob leases to track processed events. The EventProcessorHost (EPH) pattern with checkpointing and blob leases provides the foundation for exactly-once processing in Event Hubs. Checkpointing records the offset of the last successfully processed event in Azure Blob Storage, while blob leases ensure partition ownership and prevent duplicate processing by competing consumers. This combination allows the processor to resume from the last checkpoint after a failure, guaranteeing that each event is processed exactly once.

Answer

Use Azure Functions with Event Hubs trigger and store events in batches

Answer

Use a simple consumer group and delete events after reading from Event Hubs

Answer

Implement a transactional outbox pattern with Azure SQL Database

Question 7

Your company wants to send email notifications to users via a third-party email service (SendGrid) from an Azure Logic App. What is the recommended way to securely store the SendGrid API key?

Accepted Answer

Store the API key in Azure Key Vault and use a managed identity to retrieve it. Azure Key Vault securely stores secrets and can be accessed by Logic Apps via managed identity, providing the most secure and recommended approach. Option B is wrong because app settings are less secure and can be exposed in configuration files or logs. Option C is wrong because hardcoding secrets in workflow definitions is insecure and violates best practices. Option D is wrong because environment variables are not specifically designed for secret management and lack the security controls of Key Vault.

Answer

Store the API key in an App Setting of the Logic App

Answer

Hardcode the API key in the Logic App workflow definition

Answer

Store the API key in an environment variable on the integration service environment

Question 8

You are developing a mobile app that uses Azure Cognitive Services to analyze images. The app must authenticate to the Computer Vision API using a key that is rotated monthly. What is the best practice for handling the key?

Accepted Answer

Store the key in Azure App Configuration with Key Vault references and retrieve it at runtime. Azure App Configuration with Key Vault references provides a secure, centralized way to store and rotate secrets like API keys without embedding them in code or requiring redeployment. A secure backend service (e.g., an Azure Function or App Service) that the mobile app interacts with would retrieve the key at runtime via a managed identity, ensuring the key is never stored locally on the mobile device and can be rotated monthly by updating Key Vault, with App Configuration automatically fetching the latest version. The mobile app would then call this backend service, which in turn authenticates to Cognitive Services.

Answer

Use a system-assigned managed identity and acquire a token for Cognitive Services

Answer

Prompt the user to enter the key on first launch

Answer

Store the key in the mobile app's local secure storage after initial retrieval

Question 9

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

Accepted Answer

Enable sessions on the queue and use peek-lock mode with automatic complete on success. Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Answer

Use auto-forwarding to a dead-letter queue on failure

Answer

Partition the queue and use multiple functions to process each partition in order

Answer

Use receive and delete mode to ensure each message is processed only once

Question 10

Your company uses Azure API Management to expose APIs to external partners. You need to enforce throttling limits per subscription key. Which policy should you add?

Accepted Answer

rate-limit by key policy with @(context.Subscription.Id) as counter key. The `rate-limit by key` policy in Azure API Management allows you to enforce throttling limits based on a specific counter key. Using `@(context.Subscription.Id)` as the counter key ensures that each subscription key is tracked individually, enabling per-subscription throttling as required.

Answer

rate-limit policy with IP address filtering

Answer

rate-limit by key policy with no counter key

Answer

validate-jwt policy with claims check

Question 11

You are developing a serverless application using Azure Functions that processes orders. Each order must be validated by calling a third-party API. If the third-party API is unavailable, the function should retry with exponential backoff. How should you implement this?

Accepted Answer

Implement retry logic with exponential backoff and circuit breaker using Polly within the function. It uses the Polly library to implement retry logic with exponential backoff and circuit breaker, which is a lightweight and flexible approach. Option B is incorrect because the trigger binding's automatic retries are for infrastructure failures (e.g., message delivery), not for application-level errors like API unavailability. Option C is incorrect because a long timeout does not handle transient faults; it just waits. Option D is incorrect because, while Azure Durable Functions does support retry via CallActivityWithRetryAsync, it introduces unnecessary complexity (orchestration overhead) for a simple HTTP call that can be handled directly with a library like Polly.

Answer

Enable automatic retries on the function's trigger binding

Answer

Configure the function to have a long timeout and hope the API responds

Answer

Use Azure Durable Functions to orchestrate the retry

Question 12

Your Azure App Service app uses SignalR Service to push real-time updates to clients. You notice that some clients are disconnected after 30 minutes of inactivity. What is the most likely cause and solution?

Accepted Answer

The Azure SignalR Service has a default client timeout of 30 minutes; configure the ClientTimeout setting in the SignalR service. The Azure SignalR Service has a default idle client timeout of 30 minutes. When a client connection remains idle (no data frames sent or received) for this duration, the service proactively closes the connection to conserve resources. To prevent this, you must configure the `ClientTimeout` setting in the SignalR service to a higher value or implement keep-alive mechanisms such as ping frames from the client.

Answer

The app service plan is scaled down, causing idle connections to drop

Answer

The app service plan has an idle timeout of 30 minutes

Answer

The SignalR service is in serverless mode, which disconnects idle clients

Question 13

Which THREE services can be used to implement a pub/sub messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics supports a pub/sub pattern by allowing multiple subscriptions to receive copies of messages sent to a topic. Each subscription acts as a logical queue, and messages are automatically routed to all subscriptions that match the filtering rules, enabling decoupled communication between publishers and subscribers.

Answer

Azure Notification Hubs

Answer

Azure Queue Storage

Question 14

Which TWO are best practices for securing an Azure API Management instance?

Accepted Answer

Require subscription keys for all APIs. Correct answers: B and D. Requiring subscription keys helps secure APIs by enforcing a per-call authentication mechanism. OAuth 2.0 with Azure AD provides robust, token‑based authentication for API consumers. Option A (exposing the management endpoint) is insecure and should be restricted. Option C (rate limits) prevent resource exhaustion, not brute‑force attacks—that’s a different security control. Option E (sharing keys via email) is a security risk and not a best practice.

Answer

Expose the management endpoint publicly for easy configuration

Answer

Set rate limits to prevent brute force attacks

Answer

Share API keys with partners via email

Question 15

You are reviewing an Azure Policy definition that applies to storage accounts. The policy has an effect of 'deny' and specifies network ACLs. What is the intended behavior of this policy?

Accepted Answer

Deny creation of storage accounts that do not have a virtual network rule allowing vnet1 and default action set to Deny. The Azure Policy definition with effect 'deny' and network ACL conditions will block the creation of any storage account that does not include a virtual network rule allowing 'vnet1' and does not have the default action set to 'Deny'. This ensures that only storage accounts with the specified network restrictions are permitted, enforcing a security baseline that denies all traffic except from the allowed virtual network.

Answer

Allow all storage accounts to be created regardless of network rules

Answer

Deny all traffic to storage accounts

Answer

Allow only traffic from the specified virtual network