AZ-204 Connect to and consume Azure services and third-party services — Timed 25 Questions

Question 1

You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?

25 minute time limit — choose an answer to begin.

Accepted Answer

Azure Service Bus.. Azure Service Bus is the correct choice because it supports exactly-once delivery through duplicate detection and can fan out notifications to multiple subscribers using topics and subscriptions. It also provides built-in retry logic on failures. While Event Grid offers at-least-once delivery, only Service Bus can guarantee exactly-once when properly configured.

Answer

Azure Event Grid.

Answer

Azure Notification Hubs.

Answer

Azure Queue Storage.

Question 2

Your company uses Azure Logic Apps to automate workflows. A workflow must call an external REST API that requires an API key in the header. You need to securely store the API key and reference it in the Logic App without exposing it in the workflow definition. What should you do?

Accepted Answer

Store the API key in Azure Key Vault and use the Key Vault connector to retrieve it dynamically in the Logic App.. Azure Key Vault provides a secure, centralized store for secrets like API keys, and the Logic App Key Vault connector retrieves the key at runtime without exposing it in the workflow definition. This approach ensures the secret is never stored in plain text within the Logic App's JSON definition or source control, aligning with Azure security best practices for managed identities and access policies.

Answer

Store the API key in plain text directly in the Logic App HTTP action header.

Answer

Store the API key in an App Service application setting and reference it using the 'appsetting' expression.

Answer

Create an Azure Function with the API key hardcoded as an environment variable and call it from the Logic App.

Question 3

You are building an Azure Logic App that needs to call an external HTTP API secured with OAuth 2.0 Client Credentials flow. The client ID and client secret are stored in Azure Key Vault. You need to obtain an access token and include it in the Authorization header of each request. Which combination of actions should you use within the Logic App?

Accepted Answer

Use an HTTP action with the OAuth 2.0 authentication type. Set the client secret parameter to a secure reference to the Key Vault secret.. The HTTP action in Azure Logic Apps natively supports the OAuth 2.0 authentication type, which can directly handle the Client Credentials flow. By setting the client secret parameter to a secure reference (e.g., `@Microsoft.KeyVault(SecretUri=...)`) pointing to the secret stored in Azure Key Vault, you avoid exposing credentials in the workflow definition. The Logic Apps runtime automatically retrieves the secret from Key Vault, obtains an access token from the token endpoint, and includes it in the Authorization header of each request without requiring custom token management.

Answer

Use two HTTP actions: first, call the token endpoint with credentials to get a token, then use the token in the second action. Store credentials in a string variable.

Answer

Use the HTTP action with managed identity authentication.

Answer

Use the 'Invoke an Microsoft Entra ID protected API' connector with the client credentials grant type.

Question 4

You are developing a worker role that processes events from an Azure Event Hub. The worker runs on multiple virtual machines to ensure high availability. Each partition of the Event Hub should be processed by only one instance at a time, and events from the same partition must be processed in order. You need to manage partition leasing and checkpointing efficiently. Which Azure SDK class should you use?

Accepted Answer

EventProcessorHost. The EventProcessorHost (EPH) class is designed specifically for scenarios requiring distributed processing of Event Hub partitions across multiple instances. It manages partition leasing to ensure each partition is processed by only one instance at a time, handles checkpointing to track progress, and guarantees ordered processing within a partition. This makes it the correct choice for high-availability worker roles that must avoid duplicate processing and maintain event order.

Answer

EventHubClient

Answer

PartitionReceiver

Answer

EventHubConsumerClient

Question 5

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue is correct because it allows the function to handle transient failures safely by automatically moving messages that exceed the maximum number of delivery attempts to a dead-letter queue. This prevents infinite retries and ensures that problematic messages are isolated for manual inspection, while the function can continue processing other messages without blocking. The max delivery count setting in Azure Service Bus controls how many times a message is delivered before being dead-lettered, which is essential for managing transient failures without losing data.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 6

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

Accepted Answer

API Management rate-limit or quota policy. Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on the subscription key. This directly protects backend services from excessive traffic by enforcing per-subscription call rates and quotas, which aligns with the requirement to throttle clients by subscription.

Answer

Blob soft delete

Answer

Application Insights sampling

Answer

Private DNS zone only

Question 7

A function consumes messages from Azure Service Bus. Which two settings help handle transient failures safely?

Accepted Answer

Configure max delivery count with a dead-letter queue. Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Answer

Disable lock renewal for long processing

Answer

Use anonymous sender access

Question 8

Match each Azure caching service to its description.

Accepted Answer

Azure Cache for Redis: A distributed in-memory data store that supports caching, session state, and pub/sub messaging.. The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Answer

Azure Cache for Redis: A global content delivery network that accelerates static file delivery.

Answer

Azure CDN: A distributed in-memory cache that provides Redis-like functionality for session state.

Question 9

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

Accepted Answer

Store in Azure Key Vault. Azure Key Vault is the correct choice because it is purpose-built for securely storing secrets like OAuth2 client secrets, with encryption at rest, access policies, RBAC, and auditing. The Function app can retrieve the secret at runtime using its Managed Identity, so the secret never appears in code or configuration files. This satisfies the security requirement for the client credentials flow.

Answer

Store in application settings as environment variable

Answer

Store in Azure App Configuration

Answer

Use Managed Identity

Question 10

A developer needs to authenticate an Azure Function app to call Microsoft Graph API. Which THREE components are required?

Accepted Answer

Microsoft Entra ID app registration. Option B (Microsoft Entra ID app registration) is required because Microsoft Graph API is protected by the Microsoft identity platform, so the Function app must authenticate against an app registration that defines the client identity, permissions (such as Microsoft Graph application or delegated permissions), and credentials. Option E (Azure Managed Identity) is correct because it lets the Function app obtain tokens from Microsoft Entra ID without storing secrets, and the managed identity's service principal can be granted Microsoft Graph permissions. Option D (Azure Key Vault) is correct because when a client secret or certificate is used instead of managed identity, the secret must be stored and retrieved securely, which is the standard role of Key Vault in this scenario. Option A (Azure API Management) is not required because API Management is an API gateway for publishing, securing, and monitoring APIs, not a prerequisite for a Function app to authenticate to Microsoft Graph. Option C (Azure SQL Database) is not required because it is a relational database service unrelated to obtaining or managing Microsoft Graph authentication credentials.

Answer

Azure API Management

Answer

Azure SQL Database

Question 11

Which TWO approaches can be used to securely connect an Azure web app to an on-premises database without exposing it to the internet?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway (C) is correct because it establishes an encrypted site-to-site IPsec/IKE tunnel between the Azure virtual network and the on-premises network, letting the web app reach the database over private RFC 1918 addresses without any public exposure. Azure ExpressRoute (E) is correct because it provides a dedicated private circuit through a connectivity provider, so traffic between Azure and on-premises never traverses the public internet. Azure API Management (A) is an API gateway/publishing layer, not a private network transport, so it does not by itself create a private path to an on-premises database. A public IP address with firewall rules (B) still exposes the database endpoint to the internet, which the scenario explicitly forbids. Azure App Service Hybrid Connections (D) uses the Hybrid Connection Manager and outbound relay over TCP port 443 through Azure Service Bus, which is a relay-based path rather than the private network connectivity required here.

Answer

Azure API Management

Answer

Public IP address with firewall rules

Answer

Azure App Service Hybrid Connections

Question 12

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

Accepted Answer

Configure a retry policy in the Logic App action to retry on failure with exponential backoff.. Configuring a retry policy with exponential backoff on the Logic App action handles transient failures and rate-limiting responses from the Gmail connector, allowing the action to retry after increasing delays. This is the built-in mechanism for dealing with throttling and temporary errors without changing the architecture.

Answer

Use Azure Queue Storage to buffer messages and process them asynchronously.

Answer

Use a webhook instead of a connector to send emails directly via Gmail API.

Answer

Increase the Gmail API quota by contacting Google support.

Question 13

You are implementing Azure API Management (APIM) to expose a legacy SOAP service as a modern REST API. The SOAP service requires WS-Security UsernameToken authentication. How should you configure APIM to handle this?

Accepted Answer

Use a 'set-header' policy to add the WS-Security UsernameToken to the backend request.. The WS-Security UsernameToken must be added as an XML element within the <soap:Header> section of the SOAP message, which is part of the HTTP request body. To achieve this in Azure API Management, policies like 'set-body' or 'find-and-replace' are typically used to modify the XML content of the request body before it is sent to the backend SOAP service. The 'set-header' policy is designed for manipulating HTTP headers, not for modifying the internal structure of the SOAP message body.

Answer

Use the 'convert-soap-to-rest' policy and configure OAuth2 for the backend.

Answer

Create a custom connector in Power Automate and import it to APIM.

Answer

Configure APIM with a client certificate and use the 'validate-client-certificate' policy.

Question 14

Which TWO are correct ways to securely store and access secrets for Azure Functions? (Choose two.)

Accepted Answer

Use a Key Vault reference in the Function App settings.. Option B is correct because Azure Functions natively supports Key Vault references in application settings: you configure a setting whose value uses the syntax @Microsoft.KeyVault(SecretUri=https://.vault.azure.net/secrets//), and the Functions runtime resolves it via the Function App's managed identity, so secrets never appear in code or config files. Option D is correct because App Settings are encrypted at rest by the platform and can be marked as slot-sticky (deployment slot setting) so they don't swap between slots, and combining them with access restrictions limits which VNEs/IPs can reach the app, providing a secure store-and-access pattern for secrets. Option A is not a secret-storage mechanism — Environment.ExpandEnvironmentVariables merely expands variables already present in the process environment, so it neither stores nor protects secrets. Option C is wrong because hardcoding secrets as constants embeds them in source control and the deployed package, exposing them to anyone with code access. Option E is wrong because local.settings.json is intended for local development only and is excluded from deployment by default; committing or deploying it leaks secrets into the deployment artifact.

Answer

Use Environment.ExpandEnvironmentVariables in the code.

Answer

Store secrets in the Function App code as constants.

Answer

Store secrets in a local.settings.json file and deploy it.

Question 15

Which TWO authentication mechanisms can be used to authenticate an Azure Function to Azure Storage?

Accepted Answer

Storage account connection string with account key. Option C is correct because an Azure Storage connection string containing the account key (AccountKey=...) is a standard credential that an Azure Function can use to authenticate to Blob, Queue, Table, or File storage, since the account key authorizes full access to the storage account. Option E is correct because a system-assigned managed identity lets the Function app obtain an Microsoft Entra ID token from the instance metadata endpoint (IMDS) and access Storage via Azure RBAC roles such as Storage Blob Data Contributor, eliminating secrets. Option A is not applicable because client certificates are not a supported authentication mechanism for Azure Storage data-plane access. Option B is not correct in this context because a SAS token is a delegated, time-limited authorization credential rather than an authentication mechanism that authenticates the Function's identity to Storage. Option D is not correct because the client credentials flow requires an app registration with a client secret or certificate, and while it can yield an Microsoft Entra ID token, it is not the mechanism used by a Function's managed identity; the supported Microsoft Entra ID path for Functions is the managed identity described in E.

Answer

Client certificate

Answer

Shared access signature (SAS) token

Answer

Azure AD token acquired via client credentials flow

Question 16

Which TWO are best practices for securing an Azure API Management instance?

Accepted Answer

Require subscription keys for all APIs. Option B is correct because requiring subscription keys for all APIs ensures that every request to an API is authenticated at the gateway level, allowing API Management to validate the caller's identity and reject unauthorized traffic before it reaches backend services. Option D is correct because integrating OAuth 2.0 with Microsoft Entra ID (Microsoft Entra ID) provides strong, token-based authentication for API consumers, enabling fine-grained authorization via scopes and roles rather than relying on static shared secrets. Option A is incorrect because the management endpoint should never be exposed publicly; it must be restricted to trusted networks or specific IP ranges, since it grants administrative control over the API Management instance. Option C is incorrect as a best practice for securing the instance itself: rate limiting (via rate-limit or quota policies) mitigates abuse and throttling but does not authenticate callers or prevent brute force against credentials, which is the role of authentication and strong key/token policies. Option E is incorrect because sharing API keys via email exposes secrets in plaintext and violates secure secret-handling practices; keys should be distributed through secure channels such as Azure Key Vault or a developer portal with proper access controls.

Answer

Expose the management endpoint publicly for easy configuration

Answer

Set rate limits to prevent brute force attacks

Answer

Share API keys with partners via email

Question 17

You are deploying this ARM template. After deployment, you want to ensure that all traffic to the storage account uses HTTPS. However, you notice that HTTP requests are still accepted. What is the most likely reason?

Accepted Answer

The property 'supportsHttpsTrafficOnly' is misspelled. The ARM template property 'supportsHttpsTrafficOnly' (or 'enableHttpsTrafficOnly') enforces that all requests to the storage account must use HTTPS. If this property is set to 'true', any requests made over HTTP will be rejected, regardless of the storage account's network firewall rules (IP addresses or virtual networks). Network rules control *who* can access the storage account, not *which protocol* they must use. If HTTP requests are still accepted after deployment, it indicates that the 'supportsHttpsTrafficOnly' property was not effectively enabled or configured correctly in the ARM template.

Answer

The storage account's network rules allow HTTP traffic from certain IP addresses

Answer

The property should be set on the blob service, not the storage account

Answer

The API version does not support this property

Question 18

A company runs a microservices application on Azure Kubernetes Service (AKS). One service needs to securely access an Azure SQL Database. The solution should avoid storing connection strings in code or configuration. What should they use?

Accepted Answer

Azure AD Pod Identity (aad-pod-identity). The provided explanation accurately describes the functionality and benefits of Microsoft Entra ID Workload Identity. However, it does not justify the specific technology named in option D ('Microsoft Entra ID Pod Identity'), which is outdated. The explanation should either be updated to accurately describe Microsoft Entra ID Pod Identity, or option D should be updated to 'Microsoft Entra ID Workload Identity' to align with the explanation and current best practices.

Answer

Azure Key Vault with a secret store CSI driver

Answer

Virtual machine managed identity

Answer

Kubernetes secrets

Question 19

Which THREE actions should be taken to secure an Azure App Service web app that accesses an Azure SQL Database? (Choose three.)

Accepted Answer

Enable Managed Identity for the App Service.. Option B is correct because enabling a system-assigned or user-assigned Managed Identity on the App Service lets the app authenticate to Azure SQL Database via Microsoft Entra ID without embedding credentials, and the identity can be granted a contained database user with the needed roles. Option C is correct because Azure Key Vault centralizes secret storage and access, and App Service can reference Key Vault secrets directly through Key Vault references in application settings, so connection strings and other secrets are never hard-coded in code or config files. Option D is correct because configuring the Azure SQL Database firewall to allow Azure services permits connections from Azure-hosted resources such as the App Service (and is required when the app connects over the public endpoint), while still restricting access to non-Azure origins. Option A is not among the correct answers because storing a connection string in App Service application settings leaves the secret in plaintext configuration rather than in a managed vault, which is weaker than the Key Vault reference approach. Option E is incorrect because disabling TLS 1.2 would downgrade transport security; App Service should enforce TLS 1.2 or higher, not turn it off.

Answer

Store the connection string in App Service application settings.

Answer

Disable TLS 1.2 on the App Service.

Question 20

Refer to the exhibit. An Azure App Service deployment is configured using this ARM template snippet. The web app is built from a GitHub repository. However, when a pull request is merged to main, the app does not automatically deploy. What is the most likely cause?

Accepted Answer

The GitHub Actions workflow file is missing from the repository.. For continuous deployment from GitHub to Azure App Service, a GitHub Actions workflow file must exist in the repository to define the build and deploy steps. Without it, merging a pull request does not trigger any deployment. The ARM template alone does not create the workflow.

Answer

The isManualIntegration property is set to false.

Answer

The runtime stack is incorrect for the application.

Answer

The branch is set to main, but the deployments only trigger on a different branch.