AZ-204 Hard Questions — 25 Difficult Questions

Question 1

You are monitoring an Azure App Service using Application Insights. You notice that HTTP 500 errors are increasing, but the standard server response time metric remains normal. You suspect that the errors are occurring in an external API call made by the application. How can you identify the dependency that is failing?

Accepted Answer

Configure Application Insights dependency tracking and view the Dependency Metrics blade.. Option C is correct because Application Insights dependency tracking automatically monitors HTTP calls, SQL queries, and other external dependencies made by your application. By viewing the Dependency Metrics blade, you can see failure rates, durations, and dependency names, allowing you to identify which external API call is failing without modifying code.

Answer

Enable snapshot debugging for the application.

Answer

Use Application Insights Profiler to capture code-level traces.

Answer

Set up a custom event telemetry for each external call.

Question 2

You have an Azure App Service web app that experiences intermittent slowness. You enable Application Insights and notice that the "Failed Requests" metric is low, but "Server Response Time" is high for a subset of requests. You want to identify the specific code path causing the delay. Which feature should you use?

Accepted Answer

Profiler.. C is correct because the Application Insights Profiler captures detailed call stacks and execution timing for slow requests, allowing you to pinpoint the exact code path causing high server response time. Unlike other features, Profiler is specifically designed for performance troubleshooting by tracing request execution at the code level.

Answer

Live Metrics.

Answer

Snapshot Debugger.

Answer

Availability tests.

Question 3

You need to analyze all exceptions that occurred in the last 24 hours from an application monitored by Application Insights. You want to group them by exception type, and for each type show the URL where it occurred and the count. Which Log Analytics Kusto query should you use?

Accepted Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, url. Option B is correct because the query filters exceptions from the last 24 hours using `timestamp > ago(24h)`, groups them by `type` (exception type) and `url` (the URL where the exception occurred), and then counts occurrences per group with `summarize count()`. This directly matches the requirement to show, for each exception type, the URL and the count.

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, cloud_RoleInstance

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type, operation_Name

Answer

exceptions | where timestamp > ago(24h) | summarize count() by type

Question 4

You are building a web application that uses Microsoft Entra ID for authentication. The application needs to call Microsoft Graph API to read user profiles and send emails on behalf of the signed-in user. You want to ensure that the user's consent is obtained only once and that the application can refresh tokens silently. Which OAuth 2.0 flow should you implement?

Accepted Answer

OAuth 2.0 Authorization Code flow with PKCE (Proof Key for Code Exchange).. The Authorization Code flow with PKCE is the recommended OAuth 2.0 flow for public client applications (like single-page apps or mobile apps) that need delegated access to Microsoft Graph. It allows the application to obtain an authorization code, exchange it for an access token and a refresh token, and use the refresh token to silently acquire new tokens without requiring the user to re-consent. This flow ensures that user consent is obtained only once and supports silent token refresh, meeting the requirements.

Answer

OAuth 2.0 Client Credentials flow.

Answer

OAuth 2.0 Implicit Grant flow.

Answer

OAuth 2.0 Resource Owner Password Credentials (ROPC) flow.

Question 5

A single-page app signs in users with Microsoft Entra ID and calls a protected API. The app cannot safely keep a client secret. Which OAuth flow should be used? The design must avoid adding custom operational scripts.

Accepted Answer

Authorization code flow with PKCE. The authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended OAuth 2.0 flow for single-page applications (SPAs) that cannot securely store a client secret. PKCE uses a dynamically generated cryptographic code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This flow is designed for public clients (like SPAs) and avoids the need for custom operational scripts.

Answer

Implicit flow

Answer

Client credentials flow

Answer

Resource owner password credentials flow

Question 6

A production API needs proactive alerting for failed dependency calls. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. Option B is correct because Azure Monitor alerts require a signal—either a metric, log query, or activity log event—to define the condition that triggers the alert. For failed dependency calls, you would use a log query (e.g., from Application Insights) or a custom metric to detect when the dependency failure rate exceeds a threshold. Without a signal, the alert has no basis to evaluate or fire.

Answer

A manually exported CSV report

Answer

A public IP address on the app

Question 7

A production API needs proactive alerting for high telemetry cost. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. Option A is correct because an Azure Monitor alert requires a signal—either a metric (e.g., number of API calls) or a log query (e.g., Application Insights traces)—that defines the condition to detect high telemetry cost. Without this signal, the alert has no data source to evaluate against a threshold or pattern, making proactive detection impossible.

Answer

A public IP address on the app

Answer

A manually exported CSV report

Question 8

A document rendering job in Azure App Service must safely access Key Vault secrets without connection strings in configuration. Which two steps are required?

Accepted Answer

Enable a managed identity for the web app. A managed identity provides an automatically managed Azure AD identity for the web app, eliminating the need to store credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity, the App Service can authenticate to Azure Key Vault without any connection strings or secrets in app settings. This is the foundational step for secure, identity-based access to Key Vault.

Answer

Enable anonymous access on the vault

Answer

Store the Key Vault access key in app settings

Question 9

Application Insights ingestion cost is rising because a high-traffic app emits large telemetry volume. The team needs statistically useful telemetry while reducing ingestion. What should be configured?

Accepted Answer

Adaptive sampling. Adaptive sampling is the correct solution because it automatically adjusts the volume of telemetry data sent to Application Insights, retaining only a representative subset that preserves statistical accuracy for analysis. This reduces ingestion costs while ensuring the sampled data remains statistically useful for detecting trends and anomalies in high-traffic applications.

Answer

Move the app to a larger App Service plan

Answer

Disable all exception telemetry

Answer

Increase log verbosity to debug

Question 10

You develop a C# application that stores sensitive documents in Azure Blob Storage. You need to generate a time-limited shared access signature (SAS) that allows a client to only read and list blobs in a specific container. The SAS must be valid for exactly 1 hour from the current time. Which code snippet correctly creates the SAS? (Assume BlobServiceClient and BlobContainerClient are properly initialized.)

Accepted Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);. Option A is correct because it sets the `Resource` property to "c" for container-level SAS, uses `StartsOn` as the current UTC time, `ExpiresOn` exactly 1 hour later, and specifies only `Read` and `List` permissions via the `BlobContainerSasPermissions` enum. This combination generates a time-limited SAS URI that allows a client to read and list blobs within the specified container for exactly one hour.

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "b", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.All }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Answer

var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow.AddDays(-1), ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

Question 11

Application Insights ingestion cost is rising because a high-traffic app emits large telemetry volume. The team needs statistically useful telemetry while reducing ingestion. What should be configured? The design must avoid adding custom operational scripts.

Accepted Answer

Adaptive sampling. Adaptive sampling is the correct solution because it automatically adjusts the volume of telemetry data collected from your application, ensuring that only a representative fraction of events is sent to Application Insights while preserving statistical accuracy for analysis. This reduces ingestion costs without requiring custom scripts or manual intervention, as it is a built-in feature of the Application Insights SDK that dynamically adapts based on traffic patterns.

Answer

Move the app to a larger App Service plan

Answer

Disable all exception telemetry

Answer

Increase log verbosity to debug

Question 12

Application Insights ingestion cost is rising because a high-traffic app emits large telemetry volume. The team needs statistically useful telemetry while reducing ingestion. What should be configured? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Adaptive sampling. Adaptive sampling in Application Insights automatically reduces the volume of telemetry data sent from high-traffic apps by intelligently selecting a representative subset of events. This preserves statistical utility for analysis while significantly lowering ingestion costs, making it the ideal solution for the described scenario.

Answer

Move the app to a larger App Service plan

Answer

Disable all exception telemetry

Answer

Increase log verbosity to debug

Question 13

A production API needs proactive alerting for unexpected exceptions. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. A is correct because an Azure Monitor alert requires a signal (such as a metric, log query, or activity log event) to define the condition that triggers the alert. Without a signal, the alert has no basis for evaluation, making it impossible to detect unexpected exceptions proactively.

Answer

A public IP address on the app

Answer

A manually exported CSV report

Question 14

You are developing a web API that must authenticate requests using Microsoft Entra ID (Microsoft Entra ID) and OAuth 2.0 bearer tokens. You want to validate the token in your API code. Which library should you use?

Accepted Answer

Microsoft.Identity.Web. Microsoft.Identity.Web is the recommended library for integrating ASP.NET Core web APIs with Microsoft Entra ID. It provides built-in token validation, policy enforcement, and handles the OAuth 2.0 bearer token flow, including JWT validation, issuer signing keys, and audience checks, without requiring manual configuration of middleware.

Answer

Microsoft Authentication Library (MSAL)

Answer

ADAL.NET

Answer

Azure.Identity

Question 15

You need to emit a custom metric in Application Insights that tracks the number of page views per browser. You expect high volume (millions of events per day). Which API should you use to ensure efficient pre-aggregation and avoid performance issues?

Accepted Answer

GetMetric. C is correct because the GetMetric API (previously known as Pre-Aggregated Metric API) is designed for high-volume telemetry scenarios. It pre-aggregates metrics on the client side before sending them to Application Insights, significantly reducing network traffic and storage costs while avoiding performance bottlenecks from millions of individual events.

Answer

TrackEvent

Answer

TrackMetric

Answer

TrackDependency

Question 16

An e-commerce platform writes orders to a Cosmos DB container. A downstream inventory service must process every new or updated order exactly once, even if the inventory service restarts mid-batch. The solution must scale horizontally when order volume increases. What is the recommended design?

Accepted Answer

Use the change feed processor library with a dedicated lease container; each worker instance claims partition leases and commits checkpoints after processing each batch. The change feed processor library with a dedicated lease container is the recommended design because it provides exactly-once processing semantics through checkpointing, automatic partition lease management for horizontal scaling, and resilience to worker restarts by resuming from the last committed checkpoint. This pattern is purpose-built for Cosmos DB change feed consumption in distributed systems.

Answer

Poll the Cosmos DB container every 30 seconds using a _ts timestamp filter to find recently modified documents

Answer

Subscribe to Azure Event Grid Cosmos DB events and process them in an Azure Function

Answer

Enable Cosmos DB analytical store and run batch queries from an Azure Synapse Spark pool every hour

Question 17

Three microservices collaborate on a single user transaction: an App Service API, an Azure Function that processes a Service Bus message, and a downstream storage service. Traces appear separately in Application Insights with no parent-child relationship. What is needed to correlate all three into a single end-to-end trace?

Accepted Answer

Install the Application Insights SDK on all three services and ensure W3C Trace Context header propagation is enabled for both HTTP calls and Service Bus messages. Option A is correct because distributed tracing across HTTP and asynchronous messaging requires the Application Insights SDK on each service and propagation of the W3C Trace-Context standard (traceparent and tracestate headers). This ensures that the App Service API, Azure Function, and downstream storage service share a single trace ID, enabling Application Insights to correlate all telemetry into one end-to-end transaction view.

Answer

Use the same Application Insights instrumentation key for all three services — no additional configuration is needed

Answer

Add a custom x-correlation-id header in each service and log it with TelemetryClient.TrackEvent

Answer

Enable Azure Monitor cross-resource queries and write a KQL join across all three services' logs

Question 18

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The team wants the control to be enforceable during normal operations.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because validating the issuer and signature ensures the JWT was issued by the trusted Microsoft Entra ID tenant and has not been tampered with. The issuer claim (iss) must match the tenant-specific issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0), and the signature must be verified using the public keys from the OpenID Connect metadata endpoint. This is a fundamental security requirement for any API that accepts tokens from Entra ID.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 19

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The design must avoid adding custom operational scripts.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because the API must validate that the JWT's issuer (iss claim) matches the trusted tenant's issuer URL (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and that the token's cryptographic signature is valid using the public keys from the OpenID Connect discovery endpoint. This ensures the token was genuinely issued by Microsoft Entra ID for the expected tenant and has not been tampered with.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 20

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request? The architecture review board prefers a managed AWS-native control.

Accepted Answer

Issuer and signature are valid for the trusted tenant. Option A is correct because the API must validate the issuer (iss) claim to ensure the token was issued by a trusted tenant (e.g., https://login.microsoftonline.com/{tenant-id}/v2.0) and verify the token's digital signature using the public keys from the OpenID Connect metadata endpoint. This prevents tokens from untrusted tenants or forged tokens from being accepted.

Answer

The user's display name is present

Answer

The token was sent in a query string