Microsoft Azure Developer Associate AZ-204 (AZ-204) — Questions 1–75

Why this answer

How to eliminate wrong answers

Option B is wrong because Azure AD integration on the AKS cluster is used for user authentication to the cluster (e.g., kubectl access), not for pod-level identity to access Azure resources. Option C is wrong because creating a service principal and distributing its secret as a Kubernetes secret violates the requirement of 'without storing credentials' and introduces security risks of secret leakage. Option D is wrong because enabling managed identity on the AKS cluster provides a cluster-level identity for the cluster itself (e.g., for load balancer or disk operations), not for individual pods to access Azure resources like Storage.

Why this answer

How to eliminate wrong answers

Option A is wrong because disabling batch processing only processes messages one at a time but does not prevent duplicates; the trigger can still receive the same message multiple times if the lock expires or if there is a transient failure. Option C is wrong because increasing the lock duration only gives more time to process a message before the lock expires, but it does not prevent duplicate deliveries caused by other factors like receiver crashes or competing consumers. Option D is wrong because setting maxDeliveryCount to 1 will cause the message to be dead-lettered after the first failed delivery attempt, but it does not prevent duplicates from being delivered in the first place; duplicate detection requires a different mechanism like sessions or duplicate detection history.

Why this answer

How to eliminate wrong answers

Option A is wrong because the storage account firewall blocking the user's IP would prevent all access (including authenticated access) to the storage account, but the user has the role assigned and the issue is specifically about portal access; firewall rules affect network-level access, not RBAC role assignment. Option C is wrong because using a system-assigned managed identity for authentication does not prevent a user with the 'Storage Blob Data Reader' role from reading blobs via the portal; managed identities are an authentication method for services, not a barrier to user access. Option D is wrong because the role being assigned at the storage account scope but the user trying to access a different storage account would result in a 'not found' or 'access denied' error, but the question states the user has the role assigned and is unable to read blobs, implying the correct storage account is targeted; the issue is about portal visibility, not cross-account access.

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'When a file is added' trigger does not inherently track which files have already been processed; it can reprocess files if the trigger runs again without state persistence. Option B is wrong because storing processed file names in a SQL database introduces unnecessary complexity and external dependencies; the built-in trigger state already handles deduplication. Option D is wrong because the Sliding Window trigger is designed for event-based triggers (e.g., Azure Service Bus, Event Hubs) and is not applicable to FTP triggers; it does not provide file-level deduplication.

Why this answer

How to eliminate wrong answers

Option A is wrong because `limit-concurrency` throttles the number of simultaneous requests, not the rate over time, and does not support burst behavior or key-based scoping. Option B is wrong because `rate-limit (per product)` applies limits at the product level, not per individual subscription key, and cannot enforce per-key bursts. Option D is wrong because `rate-limit-by-ip` limits based on the caller's IP address, not the subscription key, and cannot differentiate between different subscribers behind the same IP.

Why this answer

How to eliminate wrong answers

Option B is wrong because an emptyDir volume is ephemeral and tied to the lifecycle of a pod; data is lost when the container restarts and cannot be shared across multiple instances. Option C is wrong because Azure Disk supports ReadWriteOnce access mode, meaning it can only be mounted by a single container instance at a time, not multiple instances concurrently. Option D is wrong because a ConfigMap is designed for injecting configuration data (e.g., environment variables, files) into containers, not for persistent storage of application data.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing the ACR admin password in every deployment manifest violates security best practices by exposing static credentials in plaintext, and it requires manual rotation of passwords across all manifests. Option C is wrong because making the container registry public exposes all images to the internet without authentication, creating a severe security vulnerability and violating least-privilege principles. Option D is wrong because App Service deployment slots are a feature for staging and swapping deployments in Azure App Service, not for authenticating to ACR from AKS; they have no relevance to Kubernetes image pull authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because scaling down the App Service plan reduces compute capacity but does not impose a 30-minute idle timeout on SignalR connections; idle connection drops due to scaling are not time-bound to exactly 30 minutes. Option B is wrong because the App Service plan's idle timeout (default 20 minutes for Always On disabled) applies to the web app process, not to SignalR Service connections, and the default is 20 minutes, not 30. Option C is wrong because SignalR Service in serverless mode does not have a built-in 30-minute idle disconnect; serverless mode uses Azure Functions and still respects the same `ClientTimeout` setting, but the default timeout is not exclusive to serverless mode.

Why this order

Why this answer

How to eliminate wrong answers

Option B is wrong because blob soft delete only protects against accidental deletion by retaining deleted blobs for a configurable retention period, but it does not prevent overwrites or provide a hard guarantee against deletion—data can still be permanently deleted before the soft-delete retention expires if the policy is changed. Option C is wrong because blob versioning preserves previous versions of a blob when it is overwritten or deleted, but it does not prevent overwrites or deletions from occurring; a user can still overwrite the current version, and the regulatory requirement mandates that no data can be overwritten or deleted at all. Option D is wrong because the change feed provides a transaction log of all changes to blobs in a container, but it does not enforce any retention or immutability—it only records events and does not prevent modifications or deletions.

Why this answer

How to eliminate wrong answers

Option A is wrong because Retry policy handles transient failures (e.g., HTTP 429 or 5xx) by retrying failed requests, but it does not prevent the Logic App from sending too many requests in the first place; it only reacts after a limit is exceeded. Option C is wrong because a Swagger connector is used to import an OpenAPI definition for custom API integration, not to control request rate or concurrency. Option D is wrong because API Management is an external service that can enforce rate limits via policies, but it is not a feature of the Logic App connector itself; the question asks for a connector feature to configure within the Logic App.

Why this answer

How to eliminate wrong answers

Option A is wrong because it requires the function to be invoked for every blob creation event, including non-JPEG files, which increases cost and latency due to unnecessary function executions; this approach does not minimize cost or latency as required. Option C is wrong because creating separate event subscriptions for each file extension increases management complexity and does not provide a cost or latency benefit over a single subscription with advanced filters; it also requires multiple functions or routing logic. Option D is wrong because Event Hubs capture is designed for data ingestion and storage, not for real-time event filtering; it adds unnecessary complexity and latency compared to Event Grid's built-in filtering capabilities.

Why this answer

How to eliminate wrong answers

Option B is wrong because Azure Data Lake Storage Gen2 is built on Blob Storage and supports Append Blobs, but it does not natively offer immutable blob policies; immutability is a Blob Storage feature, not a Data Lake Storage Gen2 feature, and using Data Lake Storage Gen2 would add unnecessary complexity and cost for a simple append-only compliance scenario. Option C is wrong because Azure Files with immutable shares is designed for SMB file shares and does not support append-only operations or high write throughput at the terabyte scale; it is optimized for shared file access, not streaming append workloads. Option D is wrong because Azure NetApp Files is a high-performance file service for NFS/SMB workloads, not designed for append-only blob storage; it lacks native append-blob semantics and immutable blob policies, and its cost is significantly higher for large-scale compliance data.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a service principal with client secret requires storing the secret in code or configuration, which violates the requirement of not storing credentials. Option C is wrong because a storage account access key is used for accessing Azure Storage, not for managing identities or accessing Key Vault secrets. Option D is wrong because a client certificate, while more secure than a secret, still requires the certificate to be stored and managed in the app's code or configuration, failing the 'without storing credentials' requirement.

Why this answer

How to eliminate wrong answers

Option B is wrong because a retry policy in the function code only retries the current invocation; if the failure occurs after the database write, the retry would re-execute the entire function, potentially causing duplicate writes or inconsistent state. Option C is wrong because enabling function-level exception handling merely catches errors but does not provide a mechanism to replay or retry the operation from a known safe point, so the order could be lost if the function fails after the database write. Option D is wrong because using an Azure Storage Queue for input only decouples the trigger but does not inherently provide checkpointing or replay capabilities; the function would still need to manage its own retry and idempotency logic to avoid losing the order.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'Key Vault Reader' only allows listing and reading the metadata of the vault itself (e.g., vault properties, tags), not the actual secret values. Option C is wrong because 'Key Vault Crypto User' grants permissions for cryptographic operations on keys (e.g., encrypt, decrypt, sign, verify), not for reading secrets. Option D is wrong because 'Contributor' is a general Azure RBAC role that grants full management access to the Key Vault resource (including creating/deleting vaults and changing access policies), which is far more permissive than needed and violates the principle of least privilege.

Why this answer

How to eliminate wrong answers

Option B is wrong because a multi-step web test is used for validating a sequence of user actions (e.g., login, navigate, submit) across multiple URLs, not for a single homepage check. Option C is wrong because a standard test is a newer, more advanced availability test that supports SSL certificate validation and request headers, but it is not the simplest option for a basic HTTP 200 check and is not required here. Option D is wrong because a custom metric test is not a type of availability test; it is used to send custom metrics to Application Insights via the TrackMetric API, not for monitoring URL availability from multiple locations.

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure Queue Storage is a messaging service for asynchronous communication between application components, not designed for storing or serving binary files like images. Option B is wrong because Azure Files provides fully managed SMB file shares for legacy or lift-and-shift scenarios, but it is more expensive per GB than Blob Storage and incurs additional costs for transactions and data access, making it less cost-effective for high-frequency image serving. Option D is wrong because Azure Cosmos DB is a NoSQL database optimized for low-latency, globally distributed transactional data with high throughput and indexing costs, which is overkill and significantly more expensive than Blob Storage for storing and serving static binary files.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Allowed Token Audiences' validates that the token is intended for your application (audience claim), not the tenant; it does not restrict which tenant issued the token. Option B is wrong because enabling 'Require Authentication' with 'Login with Microsoft Entra ID' simply enforces authentication but does not restrict to a specific tenant; it allows any Microsoft Entra ID tenant by default. Option C is wrong because setting the 'Client ID' identifies your application to the identity provider, but does not enforce tenant restriction; it is used for audience validation, not issuer validation.

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling sampling at 100% would capture every telemetry event, significantly increasing data volume and cost, and could impact app performance due to the overhead of transmitting all telemetry, which defeats the goal of not affecting production traffic. Option C is wrong because running a load test in a staging slot tests synthetic traffic, not the actual production workload causing user-reported slowness, so it cannot identify the real root cause. Option D is wrong because reviewing server logs provides high-level error and request counts but lacks the granular, code-level timing details needed to pinpoint specific slow code paths, making it insufficient for root cause analysis of performance issues.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'set-backend-service' is used to change the backend service URL for the request, not to manipulate headers. Option C is wrong because 'authentication-basic' is used to add a Basic Authentication header (username:password encoded in Base64) to the backend request, which is not the same as adding a custom API key header. Option D is wrong because 'validate-jwt' is used to enforce the existence and validity of a JSON Web Token (JWT) in the request, not to add a header.

Why this answer

How to eliminate wrong answers

Option A is wrong because storing the Notification Hubs connection string in Application Settings still exposes a shared secret that grants broad permissions (e.g., manage, send, listen) and violates the principle of least privilege; it also requires manual rotation and management. Option C is wrong because creating a SAS token for the Notification Hub still relies on a shared key and does not leverage Azure RBAC; SAS tokens are typically used for fine-grained access but still embed a secret and require secure distribution. Option D is wrong because Microsoft Entra ID OAuth 2.0 client credentials flow is used for service-to-service authentication with an app registration and client secret, which still requires managing a secret and does not provide the zero-secret, identity-based access that managed identities offer.

Why this answer

How to eliminate wrong answers

Option A is wrong because the function's timeout (default 5 minutes for the Consumption plan) controls how long the function can run before being terminated, but it does not directly cause duplicate processing; the message would still be locked during that time. Option C is wrong because maxDeliveryCount controls how many times a message can be delivered before being moved to the dead-letter queue, not the frequency of duplicate processing due to lock expiration. Option D is wrong because enabling sessions does not cause duplicate processing; sessions are used for message ordering and grouping, and they actually extend the lock duration automatically until the session is completed.

Why this answer

How to eliminate wrong answers

Option A is wrong because using a separate queue client SDK bypasses the built-in transactional guarantees of Azure Functions bindings, requiring manual error handling and risking message loss if the function fails after the SDK write. Option B is wrong because writing directly to the queue in function code and relying on the function's retry policy does not guarantee atomicity; if the function fails after the write, the message is already in the queue and cannot be rolled back. Option C is wrong because durable functions are designed for complex orchestration and state management, not for ensuring atomic message writes to a queue; they add unnecessary complexity and do not solve the specific transactional requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because placing certificate files in the wwwroot folder and configuring web.config does not bind the certificate to the custom domain at the App Service platform level; this approach is used for client certificate authentication, not for TLS/SSL termination. Option B is wrong because while Azure Key Vault can store certificates, referencing it from App Service requires the certificate to be imported as an App Service Certificate or configured via a Key Vault reference in the app settings, not a direct upload and bind to the custom domain as described. Option C is wrong because a .cer file contains only the public key, not the private key, so Azure cannot generate the private key; the private key must be included in the upload for TLS/SSL binding.

Why this answer

How to eliminate wrong answers

Option A is wrong because session state is a feature of Service Bus, not Event Hubs; it enables ordered processing of messages in a session, but Event Hubs partitions inherently provide ordering without session state. Option B is wrong because a Service Bus queue trigger with a singleton lock would not process events from Event Hubs; it is designed for Service Bus queues and does not support Event Hubs partitions or checkpointing. Option C is wrong because disabling checkpointing would cause the function to reprocess events from the beginning each time, leading to duplicates and loss of ordering, which contradicts the 'exactly once' requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because duplicate detection prevents duplicate messages from being processed, but it does not enforce any ordering guarantees. Option B is wrong because partitioning improves throughput and scalability by distributing messages across multiple message brokers, but it does not guarantee order across partitions unless combined with sessions. Option D is wrong because a dead-letter queue is used to hold messages that cannot be processed successfully, not to enforce message ordering.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure Policy is used for enforcing compliance rules and auditing resource configurations at scale, not for generating real-time alerts on specific operations like access policy changes. Option B is wrong because Microsoft Sentinel is a SIEM solution that ingests and analyzes security data from multiple sources; while it can monitor Key Vault logs, it is overkill and not the simplest or most direct method for alerting on access policy modifications. Option C is wrong because enabling Key Vault logging and querying logs (e.g., via Log Analytics) provides historical data for analysis but does not inherently generate proactive alerts; you would need to set up an alert rule on the log query, which is more complex than an activity log alert.

Why this answer

How to eliminate wrong answers

Option A is wrong because generating SAS tokens and storing them in Key Vault introduces unnecessary complexity and secret management overhead, and SAS tokens can be leaked or expire; managed identity with RBAC is simpler and more secure. Option B is wrong because assigning the 'Storage Blob Data Owner' role on the entire storage account grants far more permissions than needed (including full control over all containers and data), violating the least privilege requirement. Option D is wrong because using a storage account connection string embeds a shared key in the function app settings, which is a security risk (key exposure) and does not leverage managed identity; it also bypasses the private endpoint's network isolation benefits.

Why this answer

How to eliminate wrong answers

Option A is wrong because immediate infinite retries would flood the Event Grid endpoint with requests during an outage, likely causing a thundering herd problem and potentially triggering rate limiting or denial-of-service conditions. Option B is wrong because retrying only after restarting the application introduces unnecessary downtime and fails to handle transient failures gracefully, as Event Grid expects clients to retry with backoff for HTTP 429 or 5xx responses. Option C is wrong because disabling all timeout settings removes critical safeguards, risking indefinite hangs and resource exhaustion, and does not address retry logic or backoff behavior.

Why this answer

How to eliminate wrong answers

Option A is wrong because configuring an OAuth 2.0 authorization server in API Management defines how tokens are issued, but does not enforce validation of incoming tokens on each request; validation requires a policy like validate-jwt. Option B is wrong because requiring a subscription key validates API access via a key, not a JWT token, and does not verify identity or token validity. Option C is wrong because an IP access restriction policy filters requests based on source IP addresses, not on token presence or validity.

Why this answer

How to eliminate wrong answers

Option B is wrong because using Azure CLI to update the connection string in App Service settings would require a restart of the app service to pick up the new setting, causing downtime. Option C is wrong because while Managed Identity eliminates the need for a password, it does not address the requirement to rotate a password every 30 days; it replaces password-based authentication entirely. Option D is wrong because updating the connection string in the application code and redeploying would require a new deployment, causing downtime and violating the no-downtime requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because the user can delete blobs, indicating delete permissions on blobs are granted; the issue is with listing containers, not deleting them. Option B is wrong because the user can read blobs, so dataActions for reading blobs are present; the problem is the lack of control plane action for listing containers. Option D is wrong because the role likely does not include the action to list containers (Microsoft.Storage/storageAccounts/blobServices/containers/read), but this is not the most likely reason given the user can perform blob operations; the core issue is that the portal requires the Reader role to navigate and list containers, which is a separate permission.

Why this answer

How to eliminate wrong answers

Option A is wrong because a service tag for App Service in `ipRules` would still require the App Service to have a public IP; service tags are used in network security groups, not in the `ipRules` property of an Azure OpenAI account's network ACLs, and the App Service has no public IP. Option C is wrong because changing `defaultAction` to `Allow` would open the OpenAI account to all public internet traffic, which is a security risk and does not solve the specific requirement of allowing access from a private App Service without a public IP. Option D is wrong because the App Service has no public IP, so adding its outbound IP address to `ipRules` is impossible; even if it had a public IP, the outbound IPs of an App Service can change (e.g., in multi-tenant scenarios), making this approach unreliable.

Why this answer

How to eliminate wrong answers

Option A is wrong because the rate-limit policy applies a single global rate limit to all requests, not per user or per key, and cannot differentiate based on JWT claims. Option C is wrong because the quota-by-key policy enforces a total number of calls over a longer period (e.g., daily, weekly, monthly), not a short-term rate limit per second/minute as required for throttling. Option D is wrong because IP-based throttling limits based on the caller's IP address, which does not reliably identify individual users behind shared IPs or NAT, and cannot leverage JWT-based user identity.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Storage Blob Data Contributor' does not grant management access to the storage account (e.g., configuring firewall rules or changing replication); that requires roles like 'Contributor' or 'Owner' at the storage account scope. Option B is wrong because the scope is limited to container 'c1', not all containers in the storage account, and the role allows write/delete operations, not just read. Option D is wrong because the role includes write and delete permissions, not read-only access.

Why this answer

How to eliminate wrong answers

Option A is wrong because IP address filtering using the Azure Event Grid service tag is not supported for custom webhook endpoints; Event Grid's outbound IP addresses can vary and are not published as a stable service tag for inbound validation. Option C is wrong because Event Grid does not support uploading client certificates for authentication to custom webhook endpoints; client certificate authentication is not a feature of Event Grid's webhook delivery. Option D is wrong because OAuth 2.0 tokens from Microsoft Entra ID are not natively supported by Event Grid for authenticating to custom webhook endpoints; Event Grid uses its own shared access signature (SAS) mechanism via the Aeg-SasKey header.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the maximum pool size only raises the cap on concurrent connections, but the intermittent timeouts are due to connections being created too slowly under load, not because the pool is full. Option C is wrong because setting Connection Lifetime to 300 seconds causes connections to be recycled after 5 minutes, which can actually increase churn and timeout risk during high latency, not improve reliability. Option D is wrong because 'Multipool' is not a valid connection string keyword in SQL Server or Entity Framework Core; it is a fabricated term.

Why this answer

How to eliminate wrong answers

Option A is wrong because missing the User.Read API permission would cause the app to fail when calling Microsoft Graph after acquiring a token, but it would not prevent the token acquisition itself. Option B is wrong because the question explicitly states the app uses the authorization code flow, and using the client credentials flow would be a design choice, not a deployment failure cause. Option D is wrong because an expired client secret would cause token acquisition to fail with an 'invalid_client' error, but the question describes a scenario where the app fails after deployment, and a secret expiration is typically a runtime issue that would be caught during testing, not a misconfiguration that persists from deployment.

Why this answer

How to eliminate wrong answers

Option A is wrong because Logic Apps plan is not a valid Azure Functions hosting plan; Logic Apps is a separate integration service, not a consumption plan for Functions. Option B is wrong because the Premium plan, while offering automatic scaling and enhanced performance, is not the Consumption plan; it provides pre-warmed instances and VNet connectivity but incurs higher cost and is not the default serverless scaling option. Option D is wrong because the App Service plan (Dedicated) requires manual scaling or autoscale rules and does not provide the automatic, event-driven scaling of the Consumption plan; it also incurs cost for reserved instances even when idle.

Why this answer

How to eliminate wrong answers

Option A is wrong because server-level firewall rules control network access by IP address, not authentication or authorization; if the application is compromised, an attacker could still use the same IP range to access any tenant's database. Option C is wrong because connection pooling with a single identity means all tenants share the same SQL login, so if the application is compromised, the attacker could access all tenant databases using that single identity. Option D is wrong because using a single database-level login with row-level security (RLS) still allows the application to connect to all tenant data in the same database; RLS filters rows at query time but does not prevent an attacker from executing arbitrary queries that might bypass the filter or access other tenants' data if the application logic is compromised.

Why this answer

How to eliminate wrong answers

Option A is wrong because built-in request telemetry (server-side requests) tracks incoming HTTP requests to your web app, not outbound calls to external APIs. Option C is wrong because custom events (TrackEvent) are used for logging custom business events or user actions, not for automatically capturing the duration and status code of HTTP calls. Option D is wrong because page view tracking monitors client-side page loads and user navigation, not server-side outbound API call metrics.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Client Credentials flow is used for server-to-server (daemon) scenarios where no user is involved, so it cannot obtain consent from a signed-in user or send emails on behalf of the user. Option B is wrong because the Implicit Grant flow is deprecated and does not support refresh tokens, making silent token refresh impossible; it also exposes tokens in the URL, posing security risks. Option D is wrong because the Resource Owner Password Credentials flow requires the user to provide their credentials directly to the application, which is not recommended for modern applications due to security concerns and does not support refresh tokens for silent renewal in all scenarios.

Why this answer

How to eliminate wrong answers

Option B is wrong because Entity triggers are designed for managing stateful entities (like counters or actors) and are not suited for orchestrating parallel task execution with a completion barrier. Option C is wrong because an Activity trigger with retry policy handles individual task retries but cannot coordinate multiple parallel activities or wait for all to finish before proceeding. Option D is wrong because Timer triggers are for scheduled or periodic execution, not for orchestrating parallel workflows with a fan-in step.

Why these pairings

Why this answer

How to eliminate wrong answers

Option A is wrong because the function timeout (default 5 minutes for consumption plan) controls the maximum execution duration, not message visibility; a low timeout would cause the function to fail or be terminated, not duplicate processing. Option C is wrong because incorrect blob output binding would cause errors or missing data, not duplicate message processing. Option D is wrong because a premium plan provides dedicated instances and faster execution, which would reduce the likelihood of timeouts and duplicates, not cause them.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Hot storage tier has higher storage costs than Cool tier, making it suboptimal for rarely accessed data. Option C is wrong because the Archive storage tier has the lowest storage cost but retrieval times can take hours (up to 15 hours for standard priority), not minutes, and RA-GRS is unnecessary since read access is not required. Option D is wrong because Premium storage tier is optimized for low-latency, high-performance workloads (e.g., VMs, databases) and uses local redundant storage (LRS), which does not provide geo-redundancy for disaster recovery.

Why this answer

How to eliminate wrong answers

Option B is wrong because deploying each tenant to a separate AKS cluster increases operational complexity and cost, and does not optimize resource utilization—idle resources in one cluster cannot be shared with another. Option C is wrong because Azure Policy can enforce pod resource limits (e.g., via built-in policies like 'Kubernetes cluster containers should have CPU and memory resource limits defined'), but it does not provide tenant-level resource quotas or prevent a tenant from consuming all cluster resources across namespaces; it only ensures individual pods have limits, not aggregate tenant consumption. Option D is wrong because a service mesh (e.g., Istio, Linkerd) controls east-west traffic between services, not resource consumption or isolation; it addresses network segmentation and observability, not compute resource guarantees.

Why this answer

How to eliminate wrong answers

Option B (Microsoft Entra ID B2C) is wrong because it is designed for customer-facing applications with external identity providers and social logins, not for authenticating users via an existing Microsoft Entra ID tenant with minimal code; it adds unnecessary complexity and custom policy configuration. Option C (Application Gateway with WAF) is wrong because it is a layer 7 load balancer and web application firewall that does not provide any authentication or token validation for Microsoft Entra ID; it focuses on traffic routing and security filtering, not identity. Option D (App Service Managed Identity) is wrong because it is used to grant the app itself an identity to securely access other Azure resources (e.g., Key Vault, Storage), not to authenticate external users; it does not handle user login or token issuance.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy limits call count, not bandwidth (data transfer); bandwidth limits are enforced using `quota-by-key` with a `bandwidth` attribute, not `calls`. Option B is wrong because the counter-key is based on the subscription key, not the backend; backend-level limits would require a different policy or configuration. Option D is wrong because the counter-key is explicitly set to `@(context.Subscription.Key)`, not the client IP address; IP-based rate limiting would use `@(context.Request.IpAddress)` as the counter-key.

Why this answer

How to eliminate wrong answers

Option A is wrong because fixed-rate sampling applies a constant sampling percentage regardless of traffic volume, which can either over-sample during low activity (wasting cost) or under-sample during high activity (losing trend data). Option C is wrong because ingestion sampling occurs at the ingestion endpoint after telemetry is sent, meaning it does not reduce network bandwidth or storage costs at the source, and it cannot preserve trends as effectively as client-side sampling. Option D is wrong because head-based sampling is a general category that includes fixed-rate and adaptive sampling; it is not a specific sampling type, and the question asks for a specific configuration that reduces costs while preserving trends.

Why this answer

How to eliminate wrong answers

Option B is wrong because Azure Table Storage is a NoSQL key-value store that does not natively support session state expiration or locking, and implementing a custom provider would require significant code changes, contradicting the requirement to minimize code changes. Option C is wrong because using Azure SQL Database for session state introduces higher latency and cost compared to an in-memory cache, and it requires updating web.config rather than using App Settings, which is less flexible for auto-scaling scenarios. Option D is wrong because ARR affinity (sticky sessions) prevents true auto-scaling by pinning a user to a specific instance, and while Managed Identity is good for database connectivity, it does not solve the session state sharing problem across instances.

Why this answer

How to eliminate wrong answers

Option A is wrong because soft delete does not prevent access to secrets; it only adds a retention period after deletion, and secrets are fully accessible until explicitly deleted. Option B is wrong because the accessPolicies array being empty is irrelevant when using RBAC; RBAC is independent of access policies and is enabled at the vault level via the 'enableRbacAuthorization' property (not shown here, but RBAC is planned). Option C is wrong because vault name uniqueness is enforced globally by Azure; a conflict would cause a deployment failure, not a runtime access issue.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'source' parameter for EventGrid is not a standard property on a Blob trigger; EventGrid-based triggers use a separate EventGrid trigger type, and filtering by 'content-type' would require custom event filtering logic, not a simple parameter. Option B is wrong because the 'filter' property does not exist on a Blob trigger binding; the binding only supports path patterns with curly braces for name and extension, not a comma-separated list of extensions. Option C is wrong because while it would work functionally, it is not the recommended approach; the question asks what you 'should do' to ensure the function only processes image files, and using built-in path pattern filtering is more efficient and avoids unnecessary invocations.

Why this answer

How to eliminate wrong answers

Option B is wrong because SAS tokens are used for delegated access to Azure Storage (blobs, files, queues, tables), not for authenticating to Azure Container Registry; ACR does not support SAS tokens for image pull operations. Option C is wrong because while a service principal with AcrPull role can authenticate to ACR, it requires passing the service principal's credentials (client ID and secret) in the container group definition, which violates the requirement of not storing credentials. Option D is wrong because using the ACR admin account requires providing the admin username and password directly in the container group definition, which stores credentials in the deployment artifact and is a security anti-pattern.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Metrics Explorer provides aggregated, time-series metrics (e.g., average response time, request count) and cannot show individual request-level details or dependency call trees. Option C is wrong because Application Map offers a topological view of application components and their dependencies, but it does not provide per-request transaction details or exception traces. Option D is wrong because Live Metrics Stream shows real-time, near-instantaneous metrics (e.g., request rate, CPU usage) for monitoring live traffic, but it does not support querying historical or specific slow requests with full dependency and exception details.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'quota-per-key' enforces a total number of calls over a longer period (e.g., per day), not a per-second or burst-aware rate limit, and does not allow burst traffic within short intervals. Option B is wrong because there is no generic 'limit' policy in Azure API Management; the correct policy names are 'rate-limit' and 'rate-limit-by-key', and a condition on subscription key is not a standalone policy. Option C is wrong because 'rate-limit-by-key' with a counter key of 'subscription-key' is the correct policy for per-key rate limiting, but the option omits the burst count configuration, which is essential for allowing burst traffic; without specifying a burst, the policy enforces a strict rate limit without burst allowance.

Why this answer

How to eliminate wrong answers

Option B is wrong because an access key is a static credential that must be stored in the app code or configuration, defeating the purpose of avoiding stored credentials. Option C is wrong because a client certificate requires the certificate to be stored in the app's code or file system, which introduces management overhead and potential exposure. Option D is wrong because a shared access signature (SAS) token is used for delegating access to Azure Storage resources, not for authenticating to Azure Key Vault, and it would still need to be stored in the app.

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure portal does not have a fixed set of public IP addresses; they can change, making this approach unreliable and not a supported pattern for management access. Option C is wrong because a private endpoint with public network access disabled would block all internet-based access, including the Azure portal, preventing management from the portal entirely. Option D is wrong because 'Allow all Azure services' is a legacy setting that broadly permits traffic from any Azure service, not just the specific subnet, violating the requirement to restrict access to only that subnet.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because health checks are configured separately via the 'healthCheckPath' property in the site config, not by the 'alwaysOn' property. Option B is wrong because automatic scaling is controlled by autoscale rules or scaling settings, not by the 'alwaysOn' property which only affects the app's in-memory state. Option D is wrong because redeployment on code changes is handled by deployment slots, continuous deployment pipelines, or triggers like webhooks, not by the 'alwaysOn' property.

Why this answer

How to eliminate wrong answers

Option A is wrong because the correct flag is `--secure-environment-variables` (with a hyphen), and the exhibit shows it spelled correctly; a misspelling would cause a CLI parsing error, not silent exposure in logs. Option B is wrong because `--secure-environment-variables` is indeed supported for ACI (since API version 2018-10-01) and correctly masks values in Azure CLI output and portal. Option C is wrong because special characters in environment variable values require proper escaping in the shell command, but this would cause a syntax error or incorrect value assignment, not exposure in logs after successful deployment.

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure Front Door with WAF is a global load balancer and security layer that distributes traffic across endpoints but does not scale the underlying App Service instances; it would not resolve CPU saturation causing 503 errors. Option C is wrong because a queue-based load leveling pattern decouples request processing but introduces latency and complexity for a synchronous e-commerce application where users expect immediate responses, and it does not directly address CPU spikes on the web tier. Option D is wrong because changing to Premium v3 and enabling zone redundancy improves availability and performance but significantly increases cost and does not provide dynamic scaling based on CPU usage; it is overprovisioning for unpredictable spikes.

Why this answer

How to eliminate wrong answers

Option B is wrong because topics and subscriptions implement a publish/subscribe pattern, which broadcasts messages to multiple subscribers and does not guarantee ordered delivery or single-consumer processing. Option C is wrong because dead-letter queues are used to hold messages that cannot be processed normally (e.g., due to exceeding max delivery count), not to enforce ordering or consumer affinity. Option D is wrong because auto-forwarding moves messages from one queue or subscription to another automatically, but it does not provide session-based ordering or ensure the same consumer processes all related messages.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because EnvironmentCredential only reads credentials from environment variables (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET) and does not attempt managed identity authentication, so it would fail on a VM without those variables set. Option C is wrong because while ManagedIdentityCredential would work in this specific scenario, it is less flexible than DefaultAzureCredential and would not fall back to other credential sources if the managed identity is unavailable or misconfigured; the question asks for the best practice snippet. Option D is wrong because ClientSecretCredential requires explicit tenant ID, client ID, and client secret, which are not available or appropriate when using a system-assigned managed identity.