AZ-204 Quick Quiz — 10 Questions

Question 1

Three analytics pipelines each need to read every event from the same Azure Event Hub: one pipeline archives events to cold storage, one computes real-time aggregations, and one feeds a machine learning model. How should the developer configure Event Hubs to allow all three to consume independently without interfering with each other?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate consumer group for each pipeline; each group tracks its own offset independently. A is correct because each consumer group in Event Hubs maintains its own independent offset and checkpoint, allowing multiple consumers to read the same event stream without interfering. By creating a separate consumer group for each pipeline (archival, real-time aggregation, ML), each pipeline can process events at its own pace and from its own position in the stream, ensuring no consumer's progress affects another.

Answer

Create three separate Event Hubs in the same namespace and replicate events between them with Event Hubs Capture

Answer

Use a single consumer group and route events to different pipelines by partition key prefix

Answer

Enable Event Hubs Capture for all three pipelines so they read from the captured Avro files in storage instead of the Event Hub directly

Question 2

After deploying a new version to the staging slot and swapping to production, users report a 60-second spike in 503 errors. The application takes 45 seconds to initialize its connection pools and caches before it can serve traffic. What is the root cause, and what should the developer configure to prevent this?

Accepted Answer

Configure Application Initialization in the App Service settings so the swap waits for the warm-up path to return 200 before redirecting production traffic. The root cause is that the swap operation immediately redirects production traffic to the new slot before the application has finished its 45-second initialization (connection pools, caches). Application Initialization (warm-up) in Azure App Service can be configured to send a request to a specified path and wait for a 200 response before completing the swap, ensuring the app is ready to serve traffic. This eliminates the 503 errors by preventing the swap from routing users to an uninitialized instance.

Answer

Roll back the slot swap and investigate the new version for bugs that only appear in production

Answer

Increase the App Service health check grace period so the load balancer waits longer after the swap

Answer

Disable Always On for the staging slot so the slot starts fresh on every swap

Question 3

Multiple teams need different levels of access to the same Azure Key Vault: the DevOps team needs to create and rotate secrets, the application team needs read-only secret access, and the auditing team needs list-only access. The security team wants audit logs of all access decisions and the ability to manage permissions through a single system. What access model should the developer recommend?

Accepted Answer

Use Azure RBAC for Key Vault with role assignments scoped per team: Key Vault Secrets Officer for DevOps, Key Vault Secrets User for the app team, and Key Vault Reader for auditing. Azure RBAC for Key Vault provides a unified, centralized access management system that meets all requirements. The Key Vault Secrets Officer role allows DevOps to create and rotate secrets, the Key Vault Secrets User role grants read-only access to the application team, and the Key Vault Reader role provides list-only access for auditing. Additionally, RBAC integrates with Azure Monitor to deliver audit logs of all access decisions, satisfying the security team's need for a single management plane.

Answer

Create separate access policies for each team with the minimum required permissions

Answer

Create a separate Key Vault per team to enforce isolation between access levels

Answer

Issue shared access signatures for each team scoped to the operations they need

Question 4

A business process requires sending an approval email, waiting up to 48 hours for a manager's response, and then updating a SharePoint list based on the decision. The process owner has no programming experience and wants to build this without writing code. Which Azure service is the most appropriate?

Accepted Answer

Azure Logic Apps with the Office 365 Outlook approval action and the SharePoint connector. Azure Logic Apps is the correct choice because it provides a no-code/low-code designer that allows the process owner to visually build the approval workflow using the Office 365 Outlook 'Send approval email' action and the SharePoint connector to update the list. This fully meets the requirement of no programming experience while handling the 48-hour wait and conditional update.

Answer

Azure Durable Functions with the Human Interaction pattern using a timer and event listener

Answer

Azure Data Factory with a Copy Activity pipeline triggered by an Azure Function

Answer

Azure Event Grid with a custom webhook handler that calls the SharePoint REST API

Question 5

Backend APIs exposed through Azure API Management are consumed by multiple subscribers. The product owner wants to prevent any single subscriber from sending more than 100 requests per minute, while allowing subscribers with heavier plans to have higher limits configured separately. Which APIM policy implements per-subscriber rate limiting?

Accepted Answer

Apply the rate-limit-by-key policy using the subscription key as the counter key, with calls set to 100 and renewal-period to 60. The `rate-limit-by-key` policy in Azure API Management enforces a per-key rate limit, and using the subscription key as the counter key ensures each subscriber is limited individually. The `calls` parameter set to 100 and `renewal-period` to 60 seconds matches the requirement of 100 requests per minute per subscriber, while allowing different limits for different plans by applying separate policies with different call counts.

Answer

Apply the quota policy to the product with a total of 100 calls per minute shared across all subscribers

Answer

Apply an ip-filter policy that blocks IP addresses making more than 100 requests per minute

Answer

Configure a backend circuit breaker policy to return cached responses after 100 calls

Question 6

Three microservices collaborate on a single user transaction: an App Service API, an Azure Function that processes a Service Bus message, and a downstream storage service. Traces appear separately in Application Insights with no parent-child relationship. What is needed to correlate all three into a single end-to-end trace?

Accepted Answer

Install the Application Insights SDK on all three services and ensure W3C Trace Context header propagation is enabled for both HTTP calls and Service Bus messages. Distributed tracing across HTTP and asynchronous messaging requires the Application Insights SDK on each service and propagation of the W3C Trace-Context standard (traceparent and tracestate headers). This ensures that the App Service API, Azure Function, and downstream storage service share a single trace ID, enabling Application Insights to correlate all telemetry into one end-to-end transaction view.

Answer

Use the same Application Insights instrumentation key for all three services — no additional configuration is needed

Answer

Add a custom x-correlation-id header in each service and log it with TelemetryClient.TrackEvent

Answer

Enable Azure Monitor cross-resource queries and write a KQL join across all three services' logs

Question 7

The team is writing an Azure Function that needs to retrieve secrets from Azure Key Vault at runtime. The security policy prohibits storing client secrets, connection strings, or certificates in application settings or source code. What is the recommended approach?

Accepted Answer

Enable a system-assigned managed identity on the Function App and grant it Key Vault Secrets User (or Get/List access policy) permission on the vault. A system-assigned managed identity provides a secure, credential-free way for an Azure Function to authenticate to Key Vault. Azure automatically manages the identity's lifecycle and tokens, eliminating the need to store any secrets in application settings or code. The Function App uses the managed identity to obtain an Azure AD token, which it presents to Key Vault to retrieve secrets, fully complying with the security policy.

Answer

Create an App Registration, generate a client secret, store the secret in an Application Setting, and authenticate using ClientSecretCredential

Answer

Generate a Key Vault SAS token and embed it in the function's connection string setting

Answer

Use the Key Vault REST API with the vault's access key embedded in the code

Question 8

You are building an Azure Logic App that needs to call a third-party REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

Accepted Answer

Use the 'Get secret' action from the Azure Key Vault connector, configured to authenticate with a managed identity. Then pass the output to the 'HTTP' action's header as 'X-API-Key'.. It uses the Azure Key Vault connector's 'Get secret' action with managed identity authentication to securely retrieve the API key at runtime. The output is then passed directly into the HTTP action's 'X-API-Key' header, ensuring the secret is never exposed in the Logic App definition or logs. This approach follows the principle of least privilege and avoids hardcoding secrets.

Answer

Create an API connection for the external API, providing the API key in the connection parameters. Then use that connection in the Logic App.

Answer

Store the API key directly in the Logic App definition's 'constants' section and reference it in the HTTP action.

Answer

Use the 'HTTP' action with 'Managed Identity' authentication type, and configure the external API to accept Microsoft Entra ID tokens.

Question 9

An application stores sensor readings in Azure Table Storage. Each sensor produces thousands of readings per hour. Queries always filter by sensor ID and time range. A developer needs to choose the partition key and row key. Which design best balances query performance and write throughput?

Accepted Answer

Partition key: sensor ID; row key: ISO timestamp of the reading. It uses sensor ID as the partition key, which ensures all readings for a given sensor are stored in the same partition, enabling efficient range queries by row key (timestamp). This design avoids hot partitions by distributing writes across different sensors, while the row key allows fast point lookups and range scans within a time window, balancing query performance and write throughput.

Answer

Partition key: a single constant ('all-sensors'); row key: sensor ID + timestamp

Answer

Partition key: timestamp (rounded to the hour); row key: sensor ID

Answer

Partition key: random GUID per reading; row key: timestamp

Question 10

You are monitoring a web application with Application Insights. The application occasionally returns HTTP 500 errors. You want to be notified immediately when the error rate exceeds 5% of all requests in a rolling 5-minute window. Which feature of Application Insights should you configure?

Accepted Answer

Create a log alert using a Kusto query that calculates the percentage of failed requests over the last 5 minutes, with an alert condition when the result exceeds 0.05.. A log alert using a Kusto query allows you to calculate the exact percentage of failed requests over a rolling 5-minute window and trigger when that percentage exceeds 0.05 (5%). This is the only option that supports a dynamic, percentage-based threshold on a rolling time window, which is required for the stated condition. Metric alerts on 'Failed requests' measure absolute counts, not percentages, and Smart Detection does not allow custom percentage thresholds.

Answer

Create a Smart Detection rule for anomalous failures.

Answer

Create a metric alert on the 'Failed requests' metric with a threshold of 5%.

Answer

Create an availability test that checks for HTTP 200 responses and alert on failures.