AZ-204 Connect to and consume Azure services and third-party services — Timed 10 Questions

Question 1

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 2

Match each Azure caching service to its description.

Accepted Answer

Azure Cache for Redis: A distributed in-memory data store that supports caching, session state, and pub/sub messaging.. The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Answer

Azure Cache for Redis: A global content delivery network that accelerates static file delivery.

Answer

Azure CDN: A distributed in-memory cache that provides Redis-like functionality for session state.

Question 3

Which TWO services can be used to implement a publish-subscribe messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics (C) natively implements a publish-subscribe pattern through topics and subscriptions, where each message published to a topic is delivered to all subscriptions that match the filtering rules. This allows multiple independent subscribers to receive the same message. Azure Event Grid (D) is also a publish-subscribe service, designed for event routing. Publishers send events to Event Grid, which then delivers them to multiple subscribers (event handlers) that have subscribed to specific event types or sources, enabling event-driven architectures.

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Answer

Azure Queue Storage

Question 4

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. To authenticate an Azure Function app to call Microsoft Graph API securely, three components are typically involved:
1.  **Azure Managed Identity (E)**: This is the recommended way for Azure resources like Function Apps to authenticate to services that support Microsoft Entra ID authentication, including Microsoft Graph. It provides an automatically managed identity for the Function App, eliminating the need to manage credentials directly.
2.  **Microsoft Entra ID app registration (B)**: While a Managed Identity creates a Service Principal in Microsoft Entra ID (visible under Enterprise Applications), the concept of an 'app registration' broadly refers to defining an application's identity and configuring its API permissions within Microsoft Entra ID. The Managed Identity's Service Principal must be granted the necessary Microsoft Graph API permissions within Microsoft Entra ID to access the API.
3.  **Azure Key Vault (D)**: Although Managed Identities eliminate the need to manage secrets for their own authentication to services like Microsoft Graph, Azure Functions often require other sensitive configuration data (e.g., connection strings, other API keys for different services). Azure Key Vault is the secure service for storing such secrets, and the Azure Function (using its Managed Identity) can securely access these secrets from Key Vault. Therefore, Key Vault is a critical component for a robust and secure Azure Function application, even if not directly for the Managed Identity's token acquisition for Graph.

Answer

Azure API Management

Answer

Azure SQL Database

Question 5

Which TWO approaches can be used to securely connect an Azure web app to an on-premises database without exposing it to the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway establishes an encrypted IPSec/IKE tunnel over the public internet between the Azure virtual network and the on-premises network, enabling secure site-to-site connectivity. Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, bypassing the public internet entirely. Both approaches allow an Azure web app to securely connect to an on-premises database through the virtual network without exposing the database to the internet, maintaining security and compliance.

Answer

Azure API Management

Answer

Public IP address with firewall rules

Answer

Azure App Service Hybrid Connections

Question 6

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. The WS-Security UsernameToken must be added as an XML element within the <soap:Header> section of the SOAP message, which is part of the HTTP request body. To achieve this in Azure API Management, policies like 'set-body' or 'find-and-replace' are typically used to modify the XML content of the request body before it is sent to the backend SOAP service. The 'set-header' policy is designed for manipulating HTTP headers, not for modifying the internal structure of the SOAP message body.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 7

Which TWO are valid ways to authenticate to Azure Service Bus from an application? (Choose two.)

Accepted Answer

Using Azure AD and a managed identity.. Azure Service Bus supports authentication via Azure AD, which allows applications to use a managed identity (either system-assigned or user-assigned) to obtain an OAuth 2.0 token. This eliminates the need for hard-coded secrets and provides a secure, identity-based authentication mechanism integrated with Azure RBAC. Additionally, Service Bus supports authentication using a connection string that includes a Shared Access Signature (SAS) key, which grants specific permissions to access Service Bus entities.

Answer

Using an X.509 certificate directly in the connection string.

Answer

Using a connection string with a SAS key from Azure Event Hubs.

Answer

Using a storage account access key.

Question 8

Which THREE are benefits of using Azure API Management for consuming third-party APIs? (Choose three.)

Accepted Answer

Transforming request and response formats (e.g., XML to JSON).. Azure API Management offers several benefits when consuming third-party APIs. It can transform request and response formats (e.g., XML to JSON) using policies, adapting the third-party API's data format to your application's requirements. It also allows for implementing rate limiting and throttling policies to manage consumption and avoid exceeding third-party API quotas. Furthermore, APIM can cache responses, significantly reducing latency for consumers and decreasing the load on the external API.

Answer

Automatically scaling the third-party API based on demand.

Answer

Providing a global load balancer for the third-party API.

Question 9

Which TWO are correct ways to securely store and access secrets for Azure Functions? (Choose two.)

Accepted Answer

Use a Key Vault reference in the Function App settings.. Azure Functions can use Key Vault references in Application Settings to securely reference secrets stored in Azure Key Vault. This allows the function to retrieve secrets at runtime without storing them in code or configuration files, leveraging managed identities for authentication and authorization. Additionally, secrets can be stored directly in Function App Application Settings, which are encrypted at rest by Azure and protected by Azure RBAC, providing a secure storage mechanism.

Answer

Use Environment.ExpandEnvironmentVariables in the code.

Answer

Store secrets in the Function App code as constants.

Answer

Store secrets in a local.settings.json file and deploy it.

Question 10

You run the following PowerShell script to upload a blob to Azure Storage:

```powershell
$context = New-AzStorageContext -StorageAccountName 'mystorageaccount' -StorageAccountKey 'fakekey...'
Set-AzStorageBlobContent -Context $context -Container 'mycontainer' -Blob 'myblob' -File 'This is the file content'
```

The script fails with an error.

Which part of the script is causing the failure?

Accepted Answer

The -File parameter should be a file path, not a string.. The script fails because the `-File` parameter of `Set-AzStorageBlobContent` expects a local file path, but the script passes raw content as a string literal. The cmdlet cannot find a file with that path, so it throws an error.

Answer

The storage account name 'mystorageaccount' is invalid.

Answer

The connection string format is incorrect.

Answer

The container name 'mycontainer' does not exist.