AZ-204 Connect to and consume Azure services and third-party services — Timed 40 Questions

Question 1

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

Accepted Answer

Sessions. Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Answer

Scheduled messages

Answer

Dead-letter queue

Answer

Auto-forwarding

Question 2

You manage an API in Azure API Management. You need to cache API responses such that different responses are returned based on the product subscription key used by the caller. Which set of policies should you implement?

Accepted Answer

Set a 'cache-lookup' policy in the inbound section and a 'cache-store' policy in the outbound section, using the subscription key as a cache vary-by parameter.. Option A is correct because caching API responses based on the subscription key ensures that each caller receives a cached response unique to their subscription. The 'cache-lookup' policy in the inbound section checks the cache before forwarding the request, and the 'cache-store' policy in the outbound section stores the response after it is generated. By specifying the subscription key as a vary-by parameter, the cache key includes the subscription key, so different keys produce different cached entries.

Answer

Set a 'cache-store' policy in the inbound section and a 'cache-lookup' policy in the outbound section.

Answer

Set both 'cache-lookup' and 'cache-store' policies in the inbound section.

Answer

Set only a 'cache-store' policy in the backend section.

Question 3

A company uses Azure Logic Apps to integrate with a third-party REST API. The API has a rate limit of 100 requests per minute. You need to ensure that the Logic App respects this limit. Which connector feature should you configure?

Accepted Answer

Concurrency control.. Concurrency control in Azure Logic Apps limits the number of concurrent runs of a workflow. By setting the concurrency limit to 1, you ensure that only one instance of the Logic App executes at a time, effectively serializing requests and preventing the app from exceeding the third-party API's rate limit of 100 requests per minute. This is the correct feature to throttle throughput to match external constraints.

Answer

Retry policy.

Answer

Swagger connector.

Answer

API Management.

Question 4

You are building an API that needs to send notifications to multiple subscribers. Each subscriber has a different callback URL, and you need to ensure each notification is sent exactly once and retried on failure. Which Azure service should you use?

Accepted Answer

Azure Event Grid.. Azure Event Grid is the correct choice because it is a fully managed event routing service that uses a publish-subscribe model with built-in retry logic and exactly-once delivery semantics. It supports multiple subscribers with distinct callback URLs (webhooks) and automatically retries delivery on failure, making it ideal for sending notifications to multiple endpoints with guaranteed delivery.

Answer

Azure Service Bus.

Answer

Azure Notification Hubs.

Answer

Azure Queue Storage.

Question 5

You manage an API in Azure API Management. The API response varies depending on the caller's subscription key. You need to cache responses per subscription key to reduce backend load. Which policy configuration should you use?

Accepted Answer

Set cache key to include the subscription key. Option A is correct because Azure API Management's caching policy allows you to customize the cache key using the `@(context.Subscription.Id)` expression. By setting the cache key to include the subscription key, each caller's responses are cached separately based on their unique subscription, ensuring that variations in the API response per subscription key are preserved while reducing backend load.

Answer

Use a global cache with no variation

Answer

Disable caching and rely on the backend

Answer

Use rate limiting policy

Question 6

You have an order processing system using Azure Service Bus. Each order generates multiple messages that must be processed in order and by the same consumer. Which Service Bus feature ensures this?

Accepted Answer

Message sessions. Message sessions in Azure Service Bus enable ordered, sequential processing of related messages by a single consumer. When messages belong to the same session, they are guaranteed to be delivered in order and are locked to a single consumer until the session is complete, ensuring that all messages for a given order are processed by the same consumer without interleaving.

Answer

Topics and subscriptions

Answer

Dead-letter queues

Answer

Auto-forwarding

Question 7

A company uses Azure Service Bus to receive order messages. Each order message must be processed exactly once, and duplicate messages are not tolerated due to financial transactions. However, the order processing system sometimes fails and retries, leading to potential duplicates. What Service Bus feature should be enabled on the message to support idempotent processing?

Accepted Answer

Duplicate detection. B is correct because Azure Service Bus's duplicate detection feature uses a user-defined MessageId to identify and discard duplicate messages within a specified time window (default 10 minutes, configurable up to 7 days). This ensures exactly-once processing by preventing the same order message from being processed multiple times, even if the sender retries due to failures.

Answer

Scheduled delivery

Answer

Message sessions

Answer

Auto-forwarding

Question 8

A company exposes an internal REST API to external partners using Azure API Management. They need to enforce a rate limit of 100 requests per minute per subscription. Which policy should they add?

Accepted Answer

Rate limit policy. The Rate limit policy (option B) is correct because it enforces a per-subscription key rate limit of 100 requests per minute, which is exactly what the scenario requires. Azure API Management's rate-limit policy counts requests against the specified duration and blocks additional calls once the limit is exceeded, returning a 429 Too Many Requests response.

Answer

CORS policy

Answer

Throttling policy

Answer

Validate JWT policy

Question 9

You manage an API in Azure API Management. You need to enforce a rate limit of 200 requests per minute for each subscription key. Which policy should you include in the inbound policy section?

Accepted Answer

policy. The policy in Azure API Management is specifically designed to enforce a per-subscription key rate limit, such as 200 requests per minute. It operates on a sliding window counter to smooth traffic and is applied in the inbound section to evaluate each request before it reaches the backend. This matches the requirement exactly.

Answer

<quota> policy

Answer

<limit-concurrency> policy

Answer

<throttle> policy

Question 10

You are building a serverless workflow using Azure Logic Apps. The workflow must start when a new blob is uploaded to a specific container in Azure Blob Storage. Which trigger should you configure?

Accepted Answer

When a blob is created or modified (blob trigger). Option A is correct because the 'When a blob is created or modified (blob trigger)' is the native Azure Logic Apps trigger designed to start a workflow automatically when a new blob is uploaded or an existing blob is modified in a specified Azure Blob Storage container. This trigger uses the Azure Blob Storage event subscription to detect changes and is the appropriate choice for event-driven serverless workflows that respond to blob storage events.

Answer

HTTP request trigger

Answer

Recurrence trigger

Answer

Service Bus trigger

Question 11

You are building an Azure Logic App that must send a confirmation email to users after a purchase. Your company uses Office 365 for email and you want to use the corporate email address. Which connector should you use?

Accepted Answer

Office 365 Outlook. The Office 365 Outlook connector is the correct choice because it provides direct, managed integration with Office 365 email services, allowing the Logic App to send emails using the corporate email address without needing to configure SMTP server details or handle authentication manually. This connector supports OAuth 2.0 authentication, which is the recommended and secure method for accessing Office 365 resources, and it is specifically designed for enterprise Office 365 accounts.

Answer

SMTP

Answer

SendGrid

Answer

Outlook.com

Question 12

A company uses Azure Logic Apps to automate business processes. They need to call an external REST API that requires OAuth 2.0 client credentials grant. Which connector should they use with minimal configuration?

Accepted Answer

HTTP connector. The HTTP connector in Azure Logic Apps supports OAuth 2.0 client credentials grant natively with minimal configuration. You can directly set the authentication type to 'Active Directory OAuth' and provide the tenant ID, client ID, client secret, and audience/resource URI. This avoids the need for custom code or additional connectors.

Answer

HTTP + Swagger connector

Answer

Azure Functions connector

Answer

Custom connector

Question 13

A company uses Azure Service Bus to decouple microservices. They need to ensure that messages are processed in the order they are received, and that each message is handled by exactly one consumer instance even when the system scales out. Which feature should they enable?

Accepted Answer

Sessions. Sessions in Azure Service Bus enforce first-in-first-out (FIFO) ordering and guarantee that all messages with the same session ID are processed by a single consumer instance. This ensures strict message ordering and exactly-once processing per session, even when multiple consumers are scaled out. Without sessions, competing consumers would break ordering because messages could be processed by different instances concurrently.

Answer

Topics

Answer

Dead-letter queue

Answer

Duplicate detection

Question 14

You are building an Azure Logic App that must send an email notification when a new file is added to a SharePoint Online document library. Which connector and trigger should you use?

Accepted Answer

Use the SharePoint connector with the 'When a file is created' trigger. The SharePoint connector's 'When a file is created' trigger is the correct choice because it directly monitors a SharePoint Online document library for new file additions and initiates the Logic App workflow automatically. This trigger uses SharePoint's webhook capabilities to receive real-time notifications, eliminating the need for polling or manual intervention.

Answer

Use the Office 365 Outlook connector with the 'When a new email arrives' trigger

Answer

Use the Azure Blob Storage connector with the 'When a blob is added or modified' trigger

Answer

Use the HTTP connector with a manual trigger and poll SharePoint's REST API

Question 15

You are building a mobile app backend using Azure Functions. The function must send push notifications to devices using the Notification Hubs service. You need to authenticate the function to Notification Hubs using the principle of least privilege. What should you use?

Accepted Answer

Use a managed identity assigned to the Function App to access Notification Hubs.. Option B is correct because using a managed identity assigned to the Function App allows it to authenticate to Azure Notification Hubs without storing any credentials in code or configuration. This follows the principle of least privilege by granting only the necessary permissions (e.g., via Azure RBAC role assignments like 'Notification Hubs Data Sender') and eliminates the risk of connection string leakage. Managed identities are the recommended approach for Azure services to securely access other Azure resources.

Answer

Store the Notification Hubs connection string in Application Settings.

Answer

Create a shared access signature (SAS) token for the Notification Hub.

Answer

Use Microsoft Entra ID OAuth 2.0 client credentials flow.

Question 16

You are building an Azure Logic App that must connect to a third-party CRM system using a custom API. The API requires an API key in the header of every request. You need to securely store the API key and reference it in the Logic App. Which approach should you use?

Accepted Answer

Store the API key in Azure Key Vault and reference it with a dynamic expression.. Option C is correct because Azure Key Vault provides a secure, centralized store for secrets like API keys, and Logic Apps can reference these secrets at runtime using a dynamic expression (e.g., `@Microsoft.KeyVault(SecretUri=...)`). This avoids exposing the key in plaintext within the Logic App definition or configuration, aligning with Azure security best practices for managed identities and secret management.

Answer

Store the API key in the Azure Logic App's definition file.

Answer

Use a parameter and a connection reference in the Logic App.

Answer

Hardcode the API key in the HTTP action.

Question 17

You are building an integration solution that connects an on-premises SQL Server database to Azure Data Factory. The on-premises network does not allow direct inbound connections from Azure. You need to securely transfer data from the database to Azure Blob Storage. Which data factory component should you use?

Accepted Answer

Self-hosted Integration Runtime. The Self-hosted Integration Runtime (SHIR) is required because the on-premises SQL Server database resides in a network that blocks direct inbound connections from Azure. SHIR acts as a bridge, running on a local machine or VM within the on-premises network, enabling Azure Data Factory to securely connect to the database via outbound HTTPS (port 443) or the Microsoft Service Bus. It handles data movement and transformation without exposing the on-premises network to inbound traffic.

Answer

Azure Integration Runtime

Answer

Azure-SSIS Integration Runtime

Answer

Azure Data Lake Storage connector

Question 18

Your company uses Azure Logic Apps to automate a business process. The process needs to call an external REST API that requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault secret and a managed identity. Option B is correct because Azure Key Vault securely stores secrets like API keys, and using a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials in code or configuration. This follows the principle of least privilege and eliminates the need to manage secrets in connection strings or parameter files.

Answer

Store the API key in the Logic App's definition as a constant

Answer

Hardcode the API key in a parameter file

Answer

Use an Azure Storage account table to store the key

Question 19

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

Accepted Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to true. Option C is correct because Service Bus sessions provide first-in-first-out (FIFO) ordering and exactly-once processing. By enabling sessions (IsSessionsEnabled = true) and using PeekLock mode, the Logic App can lock a message while processing, ensuring it is not delivered to other consumers, and sessions guarantee that messages with the same session ID are processed in order. This meets the requirement of processing each message exactly once and in the order received.

Answer

Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to false

Answer

Use a Service Bus trigger with the 'ReceiveAndDelete' mode

Answer

Use an Event Grid trigger for Service Bus

Question 20

You are building an Azure Logic App that must send email notifications via Office 365 when a new order is placed. You need to securely store the Office 365 credentials and reference them in the Logic App. Which approach should you use?

Accepted Answer

Use an Azure Key Vault connector with a managed identity assigned to the Logic App. Option C is correct because using an Azure Key Vault connector with a managed identity assigned to the Logic App allows you to securely store Office 365 credentials in Key Vault and authenticate to it without hardcoding secrets or managing credentials. The managed identity provides an Azure AD-backed identity for the Logic App, eliminating the need for username/password in connection strings and enabling secure, auditable access to secrets.

Answer

Store the credentials in a variable within the Logic App designer

Answer

Use an Azure Key Vault action with a connection that uses a username and password

Answer

Store the credentials in an Azure Storage table and fetch them in the Logic App