AZ-204 Connect to and consume Azure services and third-party services Practice Questions

Explanation: Configuring max delivery count with a dead-letter queue ensures that after a message has been unsuccessfully processed a specified number of times (e.g., 10), it is automatically moved to the dead-letter queue rather than being retried indefinitely. This prevents infinite retry loops during transient failures and allows for manual inspection or reprocessing of poison messages. The dead-letter queue is a native Service Bus feature that isolates problematic messages without losing them. Additionally, making message processing idempotent is crucial for safely handling transient failures. When a transient failure occurs, a message might be redelivered or retried. Idempotency ensures that processing the same message multiple times has the same effect as processing it once, preventing unintended side effects from duplicate operations during retries or redeliveries.

Explanation: The correct matches are: Azure Cache for Redis is an in-memory cache; Azure CDN is a global content delivery network for static content; Azure Front Door is a load balancer with caching.

Explanation: Azure Service Bus Topics (C) natively implements a publish-subscribe pattern through topics and subscriptions, where each message published to a topic is delivered to all subscriptions that match the filtering rules. This allows multiple independent subscribers to receive the same message. Azure Event Grid (D) is also a publish-subscribe service, designed for event routing. Publishers send events to Event Grid, which then delivers them to multiple subscribers (event handlers) that have subscribed to specific event types or sources, enabling event-driven architectures.

Explanation: To authenticate an Azure Function app to call Microsoft Graph API securely, three components are typically involved: 1. **Azure Managed Identity (E)**: This is the recommended way for Azure resources like Function Apps to authenticate to services that support Microsoft Entra ID authentication, including Microsoft Graph. It provides an automatically managed identity for the Function App, eliminating the need to manage credentials directly. 2. **Microsoft Entra ID app registration (B)**: While a Managed Identity creates a Service Principal in Microsoft Entra ID (visible under Enterprise Applications), the concept of an 'app registration' broadly refers to defining an application's identity and configuring its API permissions within Microsoft Entra ID. The Managed Identity's Service Principal must be granted the necessary Microsoft Graph API permissions within Microsoft Entra ID to access the API. 3. **Azure Key Vault (D)**: Although Managed Identities eliminate the need to manage secrets for their own authentication to services like Microsoft Graph, Azure Functions often require other sensitive configuration data (e.g., connection strings, other API keys for different services). Azure Key Vault is the secure service for storing such secrets, and the Azure Function (using its Managed Identity) can securely access these secrets from Key Vault. Therefore, Key Vault is a critical component for a robust and secure Azure Function application, even if not directly for the Managed Identity's token acquisition for Graph.

Explanation: Azure VPN Gateway establishes an encrypted IPSec/IKE tunnel over the public internet between the Azure virtual network and the on-premises network, enabling secure site-to-site connectivity. Azure ExpressRoute provides a private, dedicated connection between an on-premises network and Azure, bypassing the public internet entirely. Both approaches allow an Azure web app to securely connect to an on-premises database through the virtual network without exposing the database to the internet, maintaining security and compliance.