AZ-204 Multiple Select — 40 Questions

Question 1

A Blob Storage workflow for product images must prevent accidental overwrite and support recovery of prior versions. Which two features should be enabled?

Accepted Answer

Blob soft delete. Blob soft delete (B) protects against accidental deletion or overwrite by retaining deleted blobs for a configurable retention period, allowing recovery. Blob versioning (D) automatically maintains prior versions of a blob, enabling restoration of any previous state. Together, they provide comprehensive protection against overwrites and support version recovery.

Answer

SFTP support

Answer

Static website hosting

Question 2

Which THREE components are required to implement Azure AD B2C custom policies for sign-up and sign-in? (Choose three.)

Accepted Answer

A user journey definition. A user journey definition is a core component of an Azure AD B2C custom policy. It orchestrates the sequence of technical profiles and orchestration steps that define the sign-up and sign-in experience, including self-asserted pages, multifactor authentication, and validation. Without a user journey, the policy cannot specify the flow of claims exchanges and user interactions.

Answer

An Azure AD (Microsoft Entra ID) tenant for employee identities

Answer

An Azure subscription

Question 3

You are developing an Azure Functions app that processes events from an Event Hubs instance. The function must scale out automatically based on the number of partitions in the Event Hub. You need to ensure that each function instance processes events from at least one partition. Which TWO configurations should you use?

Accepted Answer

Set the function app to use the 'Event Scale' mode with a target of one instance per partition.. The 'Event Scale' mode with a target of one instance per partition ensures that the function app scales out to match the number of Event Hub partitions, with each instance processing events from at least one partition. Option C is correct because an event processor host with blob storage for checkpointing enables load balancing across multiple instances, ensuring each instance handles one or more partitions. Option E is incorrect because 'PartitionKey' is used when sending events to Event Hubs to assign a partition, not in the trigger binding; the trigger automatically distributes partitions across instances.

Answer

Set the 'MaxBatchSize' property to 1 to ensure even distribution.

Answer

Select the Premium App Service plan for the function app.

Answer

Use the EventHubs trigger with the 'PartitionKey' parameter set to the partition ID.

Question 4

Which THREE factors should you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for a containerized workload? (Choose three.)

Accepted Answer

The need for orchestration of multiple containers. AKS provides full orchestration capabilities for managing multiple containers across a cluster, including service discovery, load balancing, and scaling. ACI is designed for single-container or simple multi-container groups without native orchestration, making AKS the appropriate choice when complex orchestration is required (A).
Azure Container Instances (ACI) has specific maximum resource limits for a single container group (e.g., 16 vCPU, 112 GiB memory), making it suitable for smaller, burstable workloads. Azure Kubernetes Service (AKS) allows for much larger, distributed applications by scaling out across multiple nodes and pods, making the overall resource capacity a key differentiator (E).
The Azure Application Gateway Ingress Controller (AGIC) is an AKS-specific feature that allows Application Gateway to act as an Ingress controller for an AKS cluster. If a workload requires this specific ingress solution, AKS is the appropriate choice, whereas ACI does not offer this native integration (D).

Answer

The restart policy for containers

Answer

The need for GPU-accelerated compute

Question 5

A company stores sensitive customer data in Azure Blob Storage. They require that all access to the storage account be logged and that any access from outside the corporate network be denied. They also need to allow read access from a specific Azure web app without exposing the storage account publicly. Which three actions should be taken? (Choose three.)

Accepted Answer

Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace. Enabling diagnostic settings for the storage account and sending logs to a Log Analytics workspace captures all access logs (including read, write, and delete operations) as required by the scenario. This satisfies the logging requirement. Assigning the 'Storage Blob Data Reader' role to the web app's managed identity provides secure, credential-less read access for the web app to the storage account, aligning with the principle of least privilege and avoiding public exposure. Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app ensures that access from outside the corporate network is denied and that the storage account is not exposed publicly, as the web app would access it via a private link or service endpoint within the allowed VNet.

Answer

Enable Azure Defender for Storage

Answer

Generate a SAS token and store it in the web app's configuration

Question 6

You need to design a solution to securely store and access secrets (e.g., API keys, connection strings) for a set of Azure Functions. The solution must minimize administrative overhead and avoid storing secrets in code or configuration files. Which THREE should you include? (Choose three.)

Accepted Answer

Store secrets in Azure Key Vault. Azure Key Vault is the correct service for securely storing secrets like API keys and connection strings because it provides centralized, hardware-backed secret management with access policies and auditing. By referencing Key Vault secrets from Azure Functions via a managed identity, you avoid storing secrets in code or configuration files, which aligns with the requirement to minimize administrative overhead and eliminate plaintext secrets. Enabling Key Vault soft-delete and purge protection is a critical security best practice to prevent accidental or malicious permanent deletion of secrets, ensuring data resilience and compliance, which is essential for a robust 'secure solution'.

Answer

Store secrets in application settings as plain text

Answer

Use Azure App Configuration for feature flags

Question 7

An API receives JWT access tokens from Microsoft Entra ID. Which two token properties should the API validate before accepting a request?

Accepted Answer

Issuer and signature are valid for the trusted tenant. The API must validate the token's issuer (iss) claim to ensure it matches the trusted Microsoft Entra ID tenant's issuer URL, confirming the token's origin. It must also verify the token's cryptographic signature to ensure it hasn't been tampered with. Additionally, the API must validate the token's audience (aud) claim, ensuring it matches the API's own Application ID URI or client ID, which confirms the token was intended for this specific API.

Answer

The user's display name is present

Answer

The token was sent in a query string

Question 8

You are creating an Azure Functions app that uses a Blob Storage trigger to process new files. The function must process files only when they are completely written (i.e., no ongoing writes). You need to avoid processing partially written files. Which TWO configurations should you consider?

Accepted Answer

Check the blob's 'LastModified' timestamp in the function code to verify no recent changes.. Checking the blob's 'LastModified' timestamp in the function code allows you to verify that no recent writes have occurred. By comparing the timestamp to the current time and adding a delay, you can ensure the file is complete before processing. Option C is correct because a timer-triggered function can periodically list blobs and check for a stable size (unchanged over a period) to determine if the blob is fully written. This avoids the trigger firing on partially written files. Options D and E are incorrect because 'LeaseBlob' and 'ScanBlob' are not valid properties of the Azure Functions Blob trigger binding. The recommended approach is to manually acquire a lease inside the function code, which is not explicitly listed as an option here.

Answer

Increase the 'BatchSize' to reduce the frequency of trigger evaluations.

Answer

Use the 'BlobTrigger' with the 'LeaseBlob' property set to 'True'.

Answer

Set the 'ScanBlob' property to 'True' in the trigger binding.

Question 9

Which FOUR are valid ways to authenticate to Azure Blob Storage from an application? (Choose four.)

Accepted Answer

Use the storage account access key.. The storage account access key provides full administrative access to the storage account, including Blob Storage. It is a simple, shared-key authentication method using HMAC-SHA256 to sign requests. Option B is correct because OAuth2 tokens obtained from Microsoft Entra ID for a user are a supported authentication method for Azure Blob Storage, enabling fine-grained access control. Option C is correct because a shared access signature (SAS) token provides delegated access to storage resources with specified permissions and expiry. Option E is correct because a managed identity assigned to an Azure resource (e.g., a VM or App Service) can be used to authenticate to Blob Storage without storing credentials. Option D is incorrect because client certificates are not a supported authentication method for direct access to Azure Blob Storage; they are used for device authentication or authenticating to Azure AD as a service principal.

Answer

Use a client certificate.

Question 10

Which TWO Azure services can be used to implement serverless event-driven architectures?

Accepted Answer

Azure Logic Apps. Azure Logic Apps is correct because it provides a fully managed integration platform for orchestrating workflows that respond to events from various sources, such as HTTP requests, Azure services, or third-party apps, using a visual designer and connectors. Azure Functions is correct because it offers event-driven compute capabilities where code executes in response to triggers like HTTP requests, queue messages, or timer events, enabling serverless architectures without managing infrastructure.

Answer

Azure Batch

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Question 11

You are designing a solution to store application secrets. You need to ensure that secrets are encrypted at rest and access is audited. Which TWO Azure services should you use?

Accepted Answer

Azure Monitor. Azure Monitor is correct because it provides the auditing and logging capabilities required to track access to secrets. By enabling diagnostic settings on Key Vault, you can send audit events (e.g., secret get, set, delete) to a Log Analytics workspace, storage account, or Event Hub, which are then queryable via Azure Monitor Logs. This satisfies the requirement for access auditing.

Answer

Azure SQL Database

Answer

Azure Storage Account with encryption

Answer

Azure App Configuration

Question 12

You are developing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job runs for approximately 30 minutes and requires access to a configuration file stored in Azure Files. You need to ensure the container instance can access the file share securely without using a public endpoint. Which TWO actions should you take?

Accepted Answer

Mount the Azure Files share using the storage account name and key.. Mounting an Azure Files share using the storage account name and key is a supported method in Azure Container Instances. This approach uses the SMB protocol to directly attach the file share to the container, providing access to the configuration file without requiring a public endpoint. The storage account key is passed securely as part of the container group configuration, and the mount is handled internally within the Azure infrastructure.

Answer

Use a managed identity assigned to the container group to authenticate to the storage account.

Answer

Use a shared access signature (SAS) token to mount the file share.

Answer

Enable the storage account's firewall to allow access from the container group's public IP.

Question 13

Which TWO authentication methods can be used to authorize access to Azure Blob Storage without requiring shared keys?

Accepted Answer

Microsoft Entra ID (formerly Azure AD) authentication. Microsoft Entra ID (formerly Azure AD) authentication and managed identities for Azure resources are both identity-based authentication methods that do not require shared keys. Entra ID authentication uses OAuth 2.0 tokens to authorize access to Blob Storage, while managed identities provide an automatically managed identity in Entra ID for Azure resources, eliminating the need for developers to manage credentials. Both methods support role-based access control (RBAC) for fine-grained permissions.

Answer

Shared access signature (SAS) token

Answer

Storage account access keys

Answer

Client certificate-based authentication

Question 14

Your company wants to implement a zero-trust security model for its Azure resources. Which THREE practices should you adopt? (Choose three.)

Accepted Answer

Implement just-in-time (JIT) access for administrative roles. Just-in-time (JIT) access for administrative roles reduces the attack surface by granting elevated permissions only when needed and for a limited time. In Azure, JIT is implemented via Azure AD Privileged Identity Management (PIM), which enforces activation requests, approval workflows, and automatic deactivation. This aligns with the zero-trust principle of 'never trust, always verify' by minimizing standing privileges.

Answer

Place all resources behind a firewall

Answer

Use a VPN to connect to the corporate network

Question 15

Which THREE are best practices for implementing an API using Azure API Management? (Choose three.)

Accepted Answer

Use policies to enforce throttling and quotas.. A is correct because Azure API Management policies allow you to enforce throttling and quotas at the API level, protecting your backend from excessive traffic. By defining rate limits and quota policies, you can control the number of requests a client can make within a specified time window, ensuring fair usage and preventing abuse.

Answer

Use the Consumption tier for production APIs with custom domains.

Answer

Expose the backend service URLs directly to clients.

Question 16

Which TWO are best practices when using Azure Service Bus for high-throughput messaging?

Accepted Answer

Enable batching of messages when sending. Enabling batching allows the client to accumulate multiple messages into a single AMQP or SBMP frame, reducing the number of network round trips and improving throughput. This is particularly effective in high-throughput scenarios where the overhead of individual sends becomes a bottleneck.

Answer

Enable duplicate detection for all queues

Answer

Use sessions to guarantee ordering

Answer

Send messages larger than 256 KB to reduce the number of messages

Question 17

Which TWO of the following are valid ways to authenticate an Azure function to an Azure SQL database using managed identity?

Accepted Answer

Create a user-assigned managed identity, assign it to the function app, and use its client ID in the connection string.. A user-assigned managed identity can be created, assigned to the function app, and then used in the SQL connection string by specifying the client ID (e.g., 'User ID=<client_id>;Authentication=Active Directory Managed Identity;'). This allows the function to authenticate to Azure SQL without storing credentials. Option E is also correct because enabling a system-assigned managed identity and setting the connection string with 'Authentication=Active Directory Managed Identity' lets the function app authenticate using its own identity, which is automatically managed by Azure.

Answer

Create a service principal and assign it to the function app.

Answer

Use the function app's default connection string with a username and password.

Answer

Upload a client certificate to the function app and use it to authenticate.

Question 18

A production API needs proactive alerting for high telemetry cost. Which two elements are required for a useful Azure Monitor alert?

Accepted Answer

A signal or metric/log query that detects the condition. An Azure Monitor alert requires a signal—either a metric (e.g., number of API calls, or a custom metric for telemetry cost) or a log query (e.g., Application Insights traces analyzed for cost patterns)—that defines the condition to detect high telemetry cost. Without this signal, the alert has no data source to evaluate against a threshold or pattern, making proactive detection impossible. Additionally, a useful alert requires an action group to define what happens when the alert condition is met, such as sending notifications (email, SMS) or triggering automated actions (webhooks, runbooks). Without an action group, the alert would trigger but provide no practical benefit.

Answer

A public IP address on the app

Answer

A manually exported CSV report

Question 19

Which THREE services can be used to implement a pub/sub messaging pattern in Azure?

Accepted Answer

Azure Service Bus Topics. Azure Service Bus Topics supports a pub/sub pattern by allowing multiple subscriptions to receive copies of messages sent to a topic. Each subscription acts as a logical queue, and messages are automatically routed to all subscriptions that match the filtering rules, enabling decoupled communication between publishers and subscribers.

Answer

Azure Notification Hubs

Answer

Azure Queue Storage

Question 20

Which Azure Blob Storage access tier is optimized for infrequently accessed data with a minimum storage duration of 30 days?

Accepted Answer

Cool. The Cool tier is optimized for infrequently accessed data and has a minimum storage duration of 30 days, matching both requirements. The Archive tier is for infrequently accessed data but requires a minimum storage duration of 180 days, so it does not meet the 30-day requirement. The Hot tier is for frequently accessed data. The Premium tier is for high-performance, frequently accessed data. 'Transactional' is not a standard Azure Blob Storage access tier. Therefore, among the given options, only Cool satisfies all criteria.

Answer

Transactional

Answer