Courseiva

Microsoft Azure Developer Associate AZ-204 (AZ-204) — Questions 826881

881 questions total · 12pages · All types, answers revealed

Page 11

Page 12 of 12

826
MCQmedium

A serverless app must react whenever audit documents are inserted or updated in Cosmos DB. Which trigger should the Azure Function use? The design must avoid adding custom operational scripts.

A.Queue trigger
B.Timer trigger
C.HTTP trigger
D.Cosmos DB trigger
AnswerD

The Cosmos DB trigger reads the change feed and invokes the function for inserts and updates.

Why this answer

The Azure Cosmos DB trigger is the correct choice because it natively listens to the Cosmos DB change feed, which captures inserts and updates to documents. This allows the Azure Function to react automatically without any custom scripts or polling logic, aligning with the serverless and operational simplicity requirements.

Exam trap

The trap here is that candidates may confuse the Cosmos DB trigger with other triggers that require custom polling or external invocation, overlooking that the change feed provides a built-in, event-driven mechanism for reacting to data changes.

How to eliminate wrong answers

Option A is wrong because a Queue trigger processes messages from Azure Queue Storage, not changes in Cosmos DB, and would require custom code to write audit events to the queue. Option B is wrong because a Timer trigger runs on a fixed schedule, not in response to data changes, and would need custom polling logic to detect inserts/updates. Option C is wrong because an HTTP trigger requires an explicit HTTP request to invoke the function, which is not triggered automatically by Cosmos DB document changes.

827
MCQeasy

You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?

A.DefaultAzureCredential
B.ClientSecretCredential
C.ManagedIdentityCredential
D.InteractiveBrowserCredential
AnswerA

DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism, automatically attempting various credential types in a specific order. For an ASP.NET Core application deployed to Azure, it will seamlessly leverage the assigned Managed Identity without requiring any code changes or explicit configuration. During local development, it can fall back to credentials from Visual Studio, Azure CLI, or environment variables, offering unparalleled flexibility across different environments.

Why this answer

DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.

Exam trap

The trap here is that candidates see 'managed identity' and immediately choose ManagedIdentityCredential, forgetting that DefaultAzureCredential is the recommended and more robust choice that automatically includes managed identity support.

How to eliminate wrong answers

Option B (ClientSecretCredential) is wrong because it requires explicitly providing a client secret (password) for a service principal, which defeats the purpose of using a managed identity and introduces secret management overhead. Option C (ManagedIdentityCredential) is wrong because while it would work in this specific scenario, it is not the best practice; DefaultAzureCredential is preferred as it falls back to other credential types (e.g., environment variables, Visual Studio credentials) if the managed identity is unavailable, providing better portability and resilience. Option D (InteractiveBrowserCredential) is wrong because it requires user interaction via a browser to authenticate, which is unsuitable for a server-side App Service that runs unattended.

828
MCQmedium

A long-running webhook processor must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

A.Blob lifecycle management
B.Timer trigger only
C.Durable Functions orchestrator
D.Azure Policy remediation
AnswerC

Durable Functions provides stateful orchestration, checkpointing, and durable execution history.

Why this answer

Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpointing, and replay-safe orchestration via the Event Sourcing pattern. The orchestrator function automatically saves execution history to a storage table, enabling reliable resumption after crashes or restarts, which is essential for processing thousands of independent files with long-running workflows.

Exam trap

The trap here is that candidates may confuse a simple trigger (like Timer or Blob trigger) with the orchestration capabilities needed for stateful, long-running workflows, overlooking that Durable Functions provides the necessary checkpointing and replay safety.

How to eliminate wrong answers

Option A is wrong because Blob lifecycle management is a storage policy for automatically tiering or deleting blobs based on age or last modification time; it does not provide orchestration, status tracking, or checkpointing for processing logic. Option B is wrong because a Timer trigger only invokes a function on a schedule and lacks any built-in mechanism for tracking individual file processing status, checkpoints, or replay safety across multiple independent executions. Option D is wrong because Azure Policy remediation is used to enforce compliance rules and automatically remediate non-compliant resources; it has no capability for orchestrating custom business logic or tracking file processing state.

829
Multi-Selecteasy

Which Azure Blob Storage access tier is optimized for infrequently accessed data with a minimum storage duration of 30 days?

Select 1 answer
A.Transactional
B.Archive
C.Premium
D.Cool
E.Hot
AnswersD

Cool is designed for infrequently accessed data and has a minimum storage duration of 30 days, making it the correct answer.

Why this answer

The Cool tier is optimized for infrequently accessed data and has a minimum storage duration of 30 days, matching both requirements. The Archive tier is for infrequently accessed data but requires a minimum storage duration of 180 days, so it does not meet the 30-day requirement. The Hot tier is for frequently accessed data.

The Premium tier is for high-performance, frequently accessed data. 'Transactional' is not a standard Azure Blob Storage access tier. Therefore, among the given options, only Cool satisfies all criteria.

Exam trap

Candidates often assume that Archive qualifies because it is for rarely accessed data, but they overlook the 180-day minimum storage duration required by Archive.

830
MCQmedium

A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?

A.ACR Tasks
B.ACR admin keys
C.Managed Identity
D.Service principal with password
AnswerC

Managed Identities provide an Azure Active Directory identity for Azure services, eliminating the need for developers to manage credentials. By assigning a system-assigned or user-assigned managed identity to the AKS cluster and granting it the `AcrPull` role on the Azure Container Registry, AKS can securely authenticate to ACR using Azure AD tokens. This method adheres to the principle of least privilege and significantly enhances security by removing the need to store, rotate, or expose any secrets.

Why this answer

Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Azure AD automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.

Exam trap

The trap here is that candidates often confuse ACR admin keys (which are simple to enable) with a secure solution, but the question explicitly requires 'without storing credentials,' making managed identity the only option that avoids any secret storage.

How to eliminate wrong answers

Option A is wrong because ACR Tasks is a build and image management feature for automating container image creation and patching, not an authentication method for pulling images during AKS deployments. Option B is wrong because ACR admin keys are static, shared credentials that must be stored in Kubernetes secrets or DevOps variables, violating the requirement to avoid storing credentials. Option D is wrong because a service principal with password requires storing the password in Azure DevOps or a Kubernetes secret, which contradicts the 'without storing credentials' requirement.

831
MCQmedium

You have an Azure App Service web app that uses a system-assigned managed identity. The app needs to read a secret stored in Azure Key Vault. You need to grant the app the minimum required permissions to access the secret. Which RBAC role should you assign to the managed identity at the Key Vault scope?

A.Key Vault Reader
B.Key Vault Secrets User
C.Key Vault Secrets Officer
D.Contributor
AnswerB

The Key Vault Secrets User role provides specific data plane permissions, including Microsoft.KeyVault/vaults/secrets/read (which encompasses get and list operations), allowing an identity to retrieve the actual secret values stored within an Azure Key Vault. This role adheres to the principle of least privilege by granting only the necessary access to read secrets, without permitting their creation, deletion, or modification, making it ideal for an App Service needing to consume secrets.

Why this answer

The Key Vault Secrets User role grants the minimum required permission to read secrets from Azure Key Vault. This role provides the 'Microsoft.KeyVault/vaults/secrets/getSecret/action' permission, which is exactly what the app needs to retrieve the secret value. It does not grant any write or management capabilities, adhering to the principle of least privilege.

Exam trap

The trap here is that candidates often confuse the Key Vault Reader role (which only allows listing vaults and reading metadata, not secret values) with the ability to read secrets, leading them to select it as the minimum permission.

How to eliminate wrong answers

Option A is wrong because Key Vault Reader only allows listing vaults and reading metadata, not reading secret values. Option C is wrong because Key Vault Secrets Officer grants full control over secrets, including create, update, delete, and restore, which exceeds the minimum required read permission. Option D is wrong because Contributor is a broad Azure RBAC role that grants full management access to all resources in the scope, far beyond the needed secret read permission.

832
MCQhard

You are developing an ASP.NET Core web API that authenticates users via Microsoft Entra ID. The API needs to call a downstream API (also secured by Microsoft Entra ID) on behalf of the signed-in user (On-Behalf-Of flow). You have already configured the web API to authenticate users with Microsoft.Identity.Web. How should you implement the token acquisition for the downstream API?

A.Use ADAL.NET's `AcquireTokenOnBehalfOf` method
B.Inject `ITokenAcquisition` and call `GetAccessTokenForUserAsync` with the scopes for the downstream API
C.Use the `Azure.Identity` library with `DefaultAzureCredential` to acquire a token
D.Manually construct an HTTP POST to the Microsoft Entra ID token endpoint with the user access token and client credentials
AnswerB

This is the recommended and most robust approach for an ASP.NET Core Web API to acquire a token for a downstream API using the On-Behalf-Of flow. `ITokenAcquisition` is an interface provided by `Microsoft.Identity.Web`, which simplifies token acquisition by abstracting away the complexities of MSAL.NET. Calling `GetAccessTokenForUserAsync` with the required scopes automatically handles exchanging the incoming user's access token for a new token valid for the specified downstream API, including token caching and refresh.

Why this answer

Microsoft.Identity.Web provides the `ITokenAcquisition` service specifically for ASP.NET Core applications to acquire tokens for downstream APIs using the OAuth 2.0 On-Behalf-Of flow. Calling `GetAccessTokenForUserAsync` with the required scopes handles the token exchange automatically, leveraging the incoming user token and client credentials configured in the app. This is the recommended approach when using Microsoft.Identity.Web, as it abstracts the complexity of the OBO flow and integrates seamlessly with the ASP.NET Core authentication pipeline.

Exam trap

The trap here is that candidates may confuse the On-Behalf-Of flow with client credentials flow or app-only authentication, leading them to choose `DefaultAzureCredential` (Option C) or manual token endpoint calls (Option D), while forgetting that ADAL.NET (Option A) is deprecated and not part of the modern Microsoft.Identity.Web stack.

How to eliminate wrong answers

Option A is wrong because ADAL.NET is deprecated and should not be used for new development; it lacks support for modern Microsoft Entra ID features and is replaced by MSAL.NET, which is already integrated into Microsoft.Identity.Web. Option C is wrong because `DefaultAzureCredential` from Azure.Identity is designed for non-interactive scenarios (e.g., managed identities, service principals) and does not support the On-Behalf-Of flow, which requires exchanging a user token for a downstream token. Option D is wrong because manually constructing HTTP POST requests to the token endpoint is error-prone, requires handling token caching, retries, and security details that Microsoft.Identity.Web already manages; this approach is unnecessary and violates the principle of using the provided library abstractions.

833
MCQmedium

An Azure App Service application has slow API requests. The developer needs distributed tracing across requests and dependencies. What should be enabled?

A.Azure Policy compliance scan
B.Application Insights with dependency tracking
C.Storage account static website logs
D.Cost Management budgets only
AnswerB

Application Insights is an Application Performance Management (APM) service specifically designed to monitor live web applications and collect detailed telemetry. Its dependency tracking feature automatically captures data on all outgoing calls made by the application to external services, including databases, other APIs, and HTTP endpoints, providing crucial insights into their duration and success. This comprehensive telemetry is vital for identifying which specific external calls are contributing to slow API requests in an Azure App Service application.

Why this answer

Application Insights with dependency tracking is the correct choice because it provides distributed tracing across requests and dependencies, enabling developers to correlate end-to-end transactions in a microservices or multi-component application. It automatically collects telemetry for HTTP calls, database queries, and other external service calls, which is essential for diagnosing slow API requests in an Azure App Service environment.

Exam trap

The trap here is that candidates may confuse Azure Policy or storage logs with monitoring tools, but only Application Insights provides the distributed tracing and dependency correlation needed for diagnosing slow API requests across multiple components.

How to eliminate wrong answers

Option A is wrong because Azure Policy compliance scan enforces organizational rules and governance on Azure resources, but it does not collect runtime telemetry or trace requests across dependencies. Option C is wrong because Storage account static website logs capture HTTP access logs for static content hosted in blob storage, not distributed tracing for dynamic API requests in App Service. Option D is wrong because Cost Management budgets only track and alert on spending, providing no insight into application performance or dependency call chains.

834
MCQmedium

A developer needs to run a Kusto query against application request data to identify 95th percentile latency by operation. Where should the query be run?

A.Logs in Application Insights or the associated Log Analytics workspace
B.Microsoft Entra audit logs
C.Azure Key Vault diagnostic settings
D.Azure Resource Graph only
AnswerA

Application Insights stores telemetry that can be queried with KQL in Logs.

Why this answer

Application Insights stores application request data, including latency metrics, and supports Kusto queries via its Logs blade. The associated Log Analytics workspace also provides the same query capabilities, making it the correct location to run a Kusto query for 95th percentile latency by operation.

Exam trap

The trap here is that candidates may confuse Azure Resource Graph with Log Analytics, but Resource Graph only queries Azure resource properties and configurations, not application telemetry data.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra audit logs contain sign-in and directory activity, not application request latency data. Option C is wrong because Azure Key Vault diagnostic settings capture vault access and performance logs, not application request metrics. Option D is wrong because Azure Resource Graph is designed for resource inventory and configuration queries across subscriptions, not for querying application telemetry like request latency.

835
MCQhard

A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?

A.Enable firewall rules
B.Disable shared key access
C.Enable advanced threat protection
D.Enable soft delete
AnswerB

Disabling shared key access for an Azure storage account is the direct mechanism to prevent clients from authenticating using the storage account's primary or secondary access keys. When this setting is enabled, all requests must authenticate via Microsoft Entra ID (OAuth 2.0 tokens) or through Shared Access Signatures (SAS) that are themselves signed by Microsoft Entra ID or a user delegation key. This effectively enforces a more secure, identity-based authentication model, aligning with the requirement to manage sensitive data by restricting key-based access.

Why this answer

Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.

Exam trap

The trap here is that candidates often confuse network-level security (firewall rules) with authentication enforcement, mistakenly believing that restricting network access alone prevents key-based access, when in fact shared keys can still be used from allowed networks.

How to eliminate wrong answers

Option A is wrong because enabling firewall rules restricts network-level access (IP addresses or virtual networks) but does not prevent authentication using storage account keys; a request from an allowed network could still use a shared key. Option C is wrong because enabling advanced threat protection (Azure Defender for Storage) provides security monitoring and alerts for anomalies (e.g., suspicious access patterns) but does not enforce authentication method or disable key-based access. Option D is wrong because enabling soft delete protects data from accidental deletion by retaining deleted blobs for a retention period, but it has no effect on authentication or authorization mechanisms.

836
MCQeasy

Refer to the exhibit. You run the Azure CLI command shown. What is the result?

A.Creates a key named MySecret in the vault
B.Deletes the secret named MySecret from the vault
C.Stores a secret named MySecret with the value in the vault
D.Creates a certificate named MySecret in the vault
AnswerC

The command sets a secret with the specified name and value.

Why this answer

The Azure CLI command `az keyvault secret set --vault-name MyVault --name MySecret --value 'MySecretValue'` is used to create or update a secret in an Azure Key Vault. The `--name` parameter specifies the secret's name, and `--value` provides the secret's value. Since the secret does not exist, it creates a new secret named MySecret with the specified value, making option C correct.

Exam trap

Candidates often confuse the verbs for different Key Vault operations (e.g., 'secret set' vs. 'key create' or 'certificate create'), leading them to misinterpret the command's purpose.

How to eliminate wrong answers

Option A is wrong because the command does not create a 'key'; it creates a 'secret' — Azure Key Vault distinguishes between keys (for cryptographic operations), secrets (for sensitive data like passwords), and certificates. Option B is wrong because the command uses `set`, not `delete`; deleting a secret requires the `az keyvault secret delete` command. Option D is wrong because the command targets secrets, not certificates; creating a certificate requires `az keyvault certificate create` with different parameters.

837
MCQhard

You are a developer for a fintech company. Your application consists of multiple Azure Functions that process sensitive financial transactions. The functions need to access an Azure SQL Database and an Azure Storage account. Security requirements are: (1) No secrets or connection strings should be stored in application settings or code. (2) Access must be restricted to the specific resources each function needs. (3) All access must be audited. (4) The solution must support local development debugging. You have already enabled system-assigned managed identity for each function app. Which course of action should you take to meet the requirements?

A.Assign a user-assigned managed identity to each function app. Grant the identity access to Azure SQL via Microsoft Entra authentication and to Storage via RBAC. Use service principal for local development.
B.Use the system-assigned managed identity to access Key Vault, where you store the SQL connection string and storage account key. Use the Key Vault SDK in the function code to retrieve them. Enable Key Vault audit logging.
C.Store the SQL connection string and storage account key in Azure Key Vault. Use Key Vault references in function app settings to retrieve them at runtime. Enable Key Vault audit logging.
D.Grant each function app's system-assigned managed identity access to Azure SQL Database using Microsoft Entra authentication (create contained user) and to Azure Storage using RBAC (Storage Blob Data Contributor role). Enable auditing on SQL and Storage. For local development, use Azure CLI to sign in with your developer account and assign it the same RBAC roles.
AnswerD

This correct option implements a truly secretless authentication model by directly granting the function app's system-assigned managed identity permissions to the target resources. For Azure SQL Database, this involves creating a contained user for the managed identity within the database, enabling Microsoft Entra authentication without connection strings. For Azure Storage, it uses Azure RBAC to assign the 'Storage Blob Data Contributor' role. This eliminates the need for any secrets to be stored or retrieved by the application or in Key Vault, and the local development strategy using Azure CLI with developer accounts maintains this secretless approach.

Why this answer

It uses the system-assigned managed identity to directly authenticate to Azure SQL Database via Microsoft Entra authentication (creating a contained database user mapped to the identity) and to Azure Storage via RBAC (assigning the Storage Blob Data Contributor role). This meets the requirement of no secrets or connection strings in code or settings, restricts access to only the needed resources, enables auditing on both SQL and Storage, and supports local development by using Azure CLI to sign in with a developer account assigned the same RBAC roles.

Exam trap

The trap here is that candidates often think Key Vault references or SDK retrieval are acceptable for 'no secrets in code,' but the requirement explicitly forbids storing secrets in application settings or code, and Key Vault references still inject secrets into settings, while SDK retrieval still handles secret values in code.

How to eliminate wrong answers

Option A is wrong because it introduces a user-assigned managed identity unnecessarily when a system-assigned identity is already enabled, and using a service principal for local development adds complexity and does not leverage the same identity model; the requirement is to avoid secrets, but a service principal requires managing a client secret or certificate. Option B is wrong because it stores connection strings and keys in Key Vault and retrieves them via SDK in code, which violates the requirement of not storing secrets in application settings or code (the SDK call still retrieves a secret at runtime). Option C is wrong because Key Vault references in function app settings still resolve to connection strings and keys that are injected as environment variables, which are effectively secrets in settings; this does not meet the 'no secrets or connection strings stored in application settings' requirement.

838
MCQmedium

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

A.Sessions
B.Scheduled messages
C.Dead-letter queue
D.Auto-forwarding
AnswerA

Azure Service Bus sessions are specifically designed to ensure strict FIFO (First-In, First-Out) ordering for messages belonging to the same logical group, identified by a unique session ID. When a consumer accepts a session, it exclusively locks that session, guaranteeing that all subsequent messages for that session ID are delivered to and processed by only that specific consumer. This mechanism is crucial for stateful processing where the order of operations within a transaction or user interaction must be preserved, making it the correct choice for maintaining order per group.

Why this answer

Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Exam trap

The trap here is that candidates may confuse Sessions with Scheduled messages or Auto-forwarding, mistakenly thinking that delaying delivery or forwarding messages can achieve ordered processing, but only Sessions provide the required consumer affinity and FIFO guarantee for grouped messages.

How to eliminate wrong answers

Option B (Scheduled messages) is wrong because it only delays message delivery to a future time and does not provide any ordering or grouping guarantees for related messages. Option C (Dead-letter queue) is wrong because it is a sub-queue for storing messages that cannot be processed normally (e.g., due to exceeding MaxDeliveryCount), not for ensuring ordered processing of grouped messages. Option D (Auto-forwarding) is wrong because it automatically forwards messages from one queue or subscription to another based on a rule, but it does not enforce FIFO ordering or consumer affinity for related messages.

839
MCQhard

You are designing a solution that writes millions of small log records (each 200 bytes) to Azure Blob Storage. The logs are written every second, always appended to a single file. The file must be read periodically by a batch process that reads the entire file. You need to maximize write throughput and minimize storage costs. Which blob type and access strategy should you choose?

A.Use Block blobs and append the data to a single blob
B.Use Append blobs and write each log entry as an append block
C.Use Page blobs and write each log entry to a page
D.Use Block blobs and create a new blob for each log entry
AnswerB

Append blobs are the optimal choice for writing millions of small log records because they are specifically engineered for sequential append operations. Each log entry can be written as an individual append block, efficiently adding data to the end of the blob without modifying existing content. This design ensures high throughput, low latency, and cost-effectiveness for continuous data streams like application logs, making them ideal for this workload.

Why this answer

Append blobs are optimized for append operations, making them ideal for writing millions of small log records sequentially to a single file. Data is written in append blocks. For millions of small log entries, these entries would typically be buffered and written together as larger append blocks (up to 4 MB each) to optimize performance and and stay within the append blob's 50,000 block limit.

This provides high throughput for append-heavy workloads and minimizes storage costs by storing data in a single blob.

Exam trap

The trap here is that candidates often choose Block blobs (Option A) thinking they can append data by adding new blocks, but they overlook the inefficiency of the block list management and the lack of native append support, which makes Append blobs the correct choice for sequential append workloads.

How to eliminate wrong answers

Option A is wrong because Block blobs are not designed for frequent append operations; appending to a block blob requires reading the existing blocks, adding a new block, and committing the block list, which is inefficient and does not maximize write throughput. Option C is wrong because Page blobs are optimized for random read/write operations on fixed-size pages (512 bytes) and are not suitable for small, sequential appends; they also incur higher costs due to minimum page size and premium storage tiers. Option D is wrong because creating a new blob for each log entry introduces significant overhead in blob creation, metadata management, and listing operations, which reduces write throughput and increases storage costs due to per-blob transaction charges.

840
MCQhard

A Cosmos DB workload for telemetry events has predictable traffic during business hours and almost no traffic overnight. The team wants to reduce cost while keeping performance during peak hours. What should be configured?

A.Analytical store only
B.Autoscale throughput with an appropriate maximum RU/s
C.Manual throughput set permanently to peak RU/s
D.Disable indexing entirely
AnswerB

Autoscale throughput dynamically adjusts the provisioned Request Units per second (RU/s) for a Cosmos DB container or database within a user-defined minimum and maximum range. This feature is ideal for telemetry workloads with predictable peaks and troughs, as it automatically scales up during high demand to ensure performance and scales down during idle periods to optimize costs. It effectively eliminates the need for manual throughput adjustments, ensuring efficient resource utilization.

Why this answer

Autoscale throughput (option B) is correct because it dynamically scales the provisioned RU/s between 10% of the configured maximum and the maximum itself based on actual demand. For a workload with predictable peak traffic during business hours and near-zero traffic overnight, autoscale eliminates the cost of provisioning for peak capacity 24/7 while ensuring performance is not throttled during high-demand periods. This directly addresses the cost-reduction goal without sacrificing peak-hour performance.

Exam trap

The trap here is that candidates often confuse 'autoscale' with 'manual throughput' and assume manual throughput set to peak is the safest choice, but they overlook the cost of idle capacity; Microsoft often tests the understanding that autoscale is the only option that dynamically matches cost to actual usage while preserving peak performance.

How to eliminate wrong answers

Option A is wrong because Analytical Store is a separate columnar store for analytical queries (e.g., Synapse Link) and does not affect the transactional throughput cost or scaling behavior; it adds cost for storage and processing, not reduces it. Option C is wrong because setting manual throughput permanently to peak RU/s would incur charges for that capacity 24/7, even during overnight low-traffic periods, defeating the cost-reduction goal. Option D is wrong because disabling indexing entirely would severely impact query performance and is not a valid cost-saving mechanism for throughput; it affects storage costs and write latency but does not reduce provisioned RU/s charges, and it breaks many query patterns.

841
MCQhard

You have an Azure App Service web app that experiences intermittent slowness. You enable Application Insights and notice that the "Failed Requests" metric is low, but "Server Response Time" is high for a subset of requests. You want to identify the specific code path causing the delay. Which feature should you use?

A.Live Metrics.
B.Snapshot Debugger.
C.Profiler.
D.Availability tests.
AnswerC

Application Insights Profiler continuously collects performance traces from your live Azure App Service application, even when it's under load. It automatically identifies the "hot paths" in your code that consume the most time during web requests, database calls, or other operations. By visualizing the call stack and execution times for individual requests, the Profiler helps pinpoint the exact methods responsible for application slowness, enabling targeted optimization.

Why this answer

C is correct because the Application Insights Profiler captures detailed call stacks and execution timing for slow requests, allowing you to pinpoint the exact code path causing high server response time. Unlike other features, Profiler is specifically designed for performance troubleshooting by tracing request execution at the code level.

Exam trap

The trap here is confusing the Profiler (for performance diagnostics) with the Snapshot Debugger (for exception debugging), leading candidates to choose Snapshot Debugger when the question explicitly asks about identifying the cause of high response times, not failures.

How to eliminate wrong answers

Option A is wrong because Live Metrics provides real-time monitoring of metrics like request rate and response times but does not capture detailed code-level call stacks to identify the specific slow code path. Option B is wrong because Snapshot Debugger is designed to capture debug snapshots on exceptions, not for analyzing slow response times; it helps diagnose crashes, not performance bottlenecks. Option D is wrong because Availability tests monitor the endpoint's availability and responsiveness from external locations, but they do not provide code-level profiling to identify the internal code path causing delays.

842
MCQmedium

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

A.Use Event Grid's 'Advanced Filters' to add custom headers to events.
B.Use Event Grid domains to route events to the third-party service.
C.Set custom headers in the event subscription's 'Delivery Properties' configuration.
D.Configure a dead-letter destination to handle delivery failures.
AnswerC

The 'Delivery Properties' configuration within an Azure Event Grid event subscription is the precise mechanism for specifying custom HTTP headers. This feature allows users to define key-value pairs that Event Grid will include in the HTTP POST request when delivering an event to the subscriber's endpoint. These custom headers are crucial for scenarios like authentication (e.g., API keys), routing information, or providing context that the receiving service can utilize upon event ingestion.

Why this answer

Azure Event Grid allows you to specify custom HTTP headers in the 'Delivery Properties' section of an event subscription. This feature lets you add static or dynamic headers (e.g., authentication tokens or correlation IDs) that are included in the HTTPS POST request to the subscriber's endpoint. It directly addresses the requirement for custom headers without needing any additional infrastructure.

Exam trap

The trap here is that candidates often confuse 'Advanced Filters' (which filter events) with 'Delivery Properties' (which modify the delivery request), leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because 'Advanced Filters' are used to filter which events are delivered based on event data fields (e.g., event type, subject), not to add custom headers to the delivery request. Option B is wrong because Event Grid domains are a logical grouping mechanism for managing multiple topics and subscriptions, but they do not provide a way to add custom headers to individual event deliveries. Option D is wrong because a dead-letter destination handles undelivered events (e.g., after retries are exhausted) by storing them in Blob Storage or Event Hubs; it does not modify the delivery request with custom headers.

843
MCQeasy

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

A.Store in application settings as environment variable
B.Store in Azure App Configuration
C.Store in Azure Key Vault
D.Use Managed Identity
AnswerC

Azure Key Vault is the correct service for securely storing and managing client secrets. It provides access policies, auditing, and integration with Azure Functions via managed identity or direct access.

Why this answer

Azure Key Vault is the secure store for secrets like client secrets. Option A is wrong because environment variables are not secure. Option B is wrong because App Configuration is for configuration.

Option D is wrong because Managed Identity does not store secrets; it provides identity.

844
MCQhard

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

A.Use auto-forwarding to a dead-letter queue on failure
B.Partition the queue and use multiple functions to process each partition in order
C.Enable sessions on the queue and use peek-lock mode with automatic complete on success
D.Use receive and delete mode to ensure each message is processed only once
AnswerC

Enabling sessions on the queue and using peek-lock mode with automatic complete on success is the correct approach. Service Bus sessions ensure that all messages belonging to a specific session ID are processed sequentially by a single receiver, guaranteeing order for related messages. Peek-lock mode ensures reliable delivery by holding the message in the queue until it's explicitly completed or abandoned, preventing message loss if the processing function fails. Automatic completion, often handled by the Azure Functions runtime, ensures the message is removed only after successful processing, contributing to exactly-once semantics.

Why this answer

Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Exam trap

The trap here is that candidates often confuse partitioning (which provides ordering within a partition but not globally) with sessions (which provide strict FIFO ordering across all messages with the same session ID), leading them to incorrectly choose option B.

How to eliminate wrong answers

Option A is wrong because auto-forwarding to a dead-letter queue on failure handles poison messages but does not enforce ordering or prevent duplicate processing; it is a redirection mechanism, not a sequencing or deduplication solution. Option B is wrong because partitioning a queue distributes messages across multiple partitions, and while each partition maintains order, using multiple functions to process partitions in parallel breaks global message ordering, as messages across partitions are not sequenced. Option D is wrong because receive and delete mode removes the message from the queue immediately upon retrieval, which can lead to message loss if processing fails, and it does not guarantee exactly-once processing; it is at-most-once delivery, not suitable for ensuring no duplicates.

845
MCQhard

You are monitoring an Azure App Service using Application Insights. You notice that HTTP 500 errors are increasing, but the standard server response time metric remains normal. You suspect that the errors are occurring in an external API call made by the application. How can you identify the dependency that is failing?

A.Enable snapshot debugging for the application.
B.Use Application Insights Profiler to capture code-level traces.
C.Configure Application Insights dependency tracking and view the Dependency Metrics blade.
D.Set up a custom event telemetry for each external call.
AnswerC

Configuring Application Insights dependency tracking automatically instruments and records calls made by your application to external services, such as databases, HTTP endpoints, and message queues. The Dependency Metrics blade then aggregates this telemetry, providing a comprehensive view of success rates, average durations, and counts of failed requests for each unique dependency. This built-in functionality offers the most efficient and accurate way to identify and monitor external service failures.

Why this answer

Application Insights dependency tracking automatically monitors HTTP calls, SQL queries, and other external dependencies made by your application. By viewing the Dependency Metrics blade, you can see failure rates, durations, and dependency names, allowing you to identify which external API call is failing without modifying code.

Exam trap

The trap here is that candidates may confuse dependency tracking with custom event telemetry or think that snapshot debugging or profiling can identify external API failures, but only dependency tracking provides automatic, aggregated metrics for outbound calls.

How to eliminate wrong answers

Option A is wrong because snapshot debugging captures the state of the application when exceptions occur, but it does not provide aggregated metrics or dependency-specific failure data; it is for debugging individual exceptions, not for identifying failing dependencies. Option B is wrong because Application Insights Profiler captures code-level traces and performance bottlenecks within your application's own code, not external API calls; it focuses on CPU time and request processing, not dependency failures. Option D is wrong because setting up custom event telemetry for each external call would require manual instrumentation and code changes, whereas dependency tracking is automatic and provides built-in metrics; custom events add overhead and are not necessary when dependency tracking is available.

846
Multi-Selecthard

You are designing a background job processing solution using Azure Batch. The job runs a large number of tasks that are CPU-intensive and require access to large input files stored in Azure Blob Storage. You need to minimize the time to process all tasks while controlling costs. Which THREE actions should you take?

Select 3 answers
A.Set the task slots per VM to 1 to avoid contention.
B.Use a pool of small-sized VMs (e.g., Standard_A1_v2) to minimize cost per node.
C.Mount Azure Blob Storage as a file system using blobfuse to allow tasks to access files directly.
D.Use a pool of low-priority VMs to reduce compute costs.
E.Configure each task to use multiple threads to utilize multi-core VMs.
AnswersC, D, E

Eliminates download time and reduces disk I/O.

Why this answer

Mounting Azure Blob Storage as a file system using blobfuse allows tasks to directly access large input files without downloading them first, reducing data transfer time and eliminating local disk bottlenecks. This is critical for CPU-intensive tasks that need fast, concurrent access to shared data, minimizing overall processing time.

Exam trap

The trap here is that candidates often confuse 'low-priority VMs' with unreliable compute, but Azure Batch can automatically handle preemptions with task retries, making them a cost-effective choice for fault-tolerant workloads, while the real performance bottleneck is data access, not CPU contention.

847
MCQhard

You have an Azure Function app that processes messages from a Service Bus queue. The function uses the Service Bus trigger. You notice that under high load, some messages are processed multiple times. What is the most likely cause?

A.The queue is partitioned
B.The lock duration is too short for message processing time
C.The batch size is too large
D.The maxDeliveryCount is set too high
AnswerB

When an Azure Function processes a message from a Service Bus or Storage Queue, it acquires a lock on that message for a specified duration. If the function's execution time, including any retries or external service calls, exceeds this configured lock duration, the lock expires before the message is successfully completed. Consequently, the message is automatically released back into the queue, becoming available for another function instance (or even the same one) to pick up and process again, leading to duplicate processing.

Why this answer

The Service Bus trigger uses a lock mechanism to ensure that a message is processed exclusively by one function instance. If the lock duration is shorter than the time required to process the message, the lock expires before processing completes. This allows another consumer instance to acquire the lock and process the same message, leading to duplicate processing.

Exam trap

The trap here is that candidates often confuse message duplication with retry logic or delivery count, not realizing that the lock duration directly controls exclusive access and is the primary cause of duplicate processing under high load.

How to eliminate wrong answers

Option A is wrong because partitioning a queue improves throughput and ordering but does not cause duplicate processing; it actually helps maintain order within partitions. Option C is wrong because batch size controls how many messages are fetched at once, not the likelihood of duplicate processing; a larger batch may increase concurrency but does not cause individual messages to be processed multiple times. Option D is wrong because maxDeliveryCount determines how many times a message can be delivered before being dead-lettered; setting it too high would allow more retries but not cause duplicate processing within a single delivery attempt.

848
MCQmedium

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

A.Use an Azure AD service principal with client secret.
B.Use an endpoint and an access key from Azure Communication Services.
C.Use a connection string from the Azure portal.
D.Use a managed identity for Azure resources.
AnswerB

This option correctly identifies the standard authentication method for a .NET Core web application to interact with Azure Communication Services for data-plane operations, such as sending emails. The endpoint specifies the unique service URL for the Communication Services resource, while the access key provides cryptographic proof of identity. Together, these credentials grant the application full administrative access to perform operations on the resource, making it the primary and most direct way to authenticate when a managed identity is not applicable or available.

Why this answer

Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Exam trap

The trap here is that candidates often confuse Azure Communication Services with other Azure services (like Storage or Event Hubs) that support connection strings or managed identities, and incorrectly assume those authentication methods apply to ACS Email.

How to eliminate wrong answers

Option A is wrong because Azure AD service principal with client secret is not supported for authenticating to Azure Communication Services Email; ACS uses its own key-based authentication, not Azure AD tokens. Option C is wrong because while a connection string (which includes endpoint and access key) is used for some Azure services (e.g., Azure Storage), Azure Communication Services does not expose a connection string for the Email SDK; the SDK expects separate endpoint and key parameters. Option D is wrong because managed identity is not currently supported for authenticating to Azure Communication Services Email; ACS does not integrate with Azure AD for this specific service, so managed identity cannot be used.

849
MCQeasy

Your team develops a containerized web app using Azure Kubernetes Service (AKS). You need to ensure that the application can automatically scale based on HTTP request load. Which Kubernetes resource should you configure?

A.VerticalPodAutoscaler
B.PodDisruptionBudget
C.HorizontalPodAutoscaler
D.NetworkPolicy
AnswerC

The HorizontalPodAutoscaler (HPA) automatically scales the number of pods in a deployment, replicaset, or statefulset based on observed resource utilization, such as CPU or memory, or custom metrics. It dynamically increases or decreases the replica count to match the current application load, ensuring optimal performance and efficient resource consumption. This mechanism is fundamental for handling fluctuating traffic and maintaining responsiveness in a containerized web app.

Why this answer

The HorizontalPodAutoscaler (HPA) is the correct Kubernetes resource for automatically scaling the number of pod replicas based on observed CPU, memory, or custom metrics like HTTP request rate. In an AKS cluster, HPA adjusts the replica count of a Deployment or ReplicaSet to match the target metric, enabling the application to handle varying HTTP load without manual intervention.

Exam trap

The trap here is that candidates often confuse HorizontalPodAutoscaler with VerticalPodAutoscaler, mistakenly thinking that adjusting pod resources (CPU/memory) is the correct way to handle HTTP load, when in fact HPA scales the number of pod replicas horizontally to distribute the load.

How to eliminate wrong answers

Option A is wrong because VerticalPodAutoscaler (VPA) adjusts CPU and memory requests/limits of existing pods, not the number of replicas; it is designed for resource optimization, not scaling based on HTTP request load. Option B is wrong because PodDisruptionBudget (PDB) ensures a minimum number of pods remain available during voluntary disruptions (e.g., node maintenance), and does not perform any scaling based on load. Option D is wrong because NetworkPolicy controls ingress/egress traffic between pods using label selectors and IP blocks, and has no role in autoscaling based on HTTP request load.

850
Multi-Selecthard

Which TWO are best practices when using Azure Service Bus for high-throughput messaging?

Select 2 answers
A.Enable duplicate detection for all queues
B.Use sessions to guarantee ordering
C.Enable batching of messages when sending
D.Use partitioned queues or topics
E.Send messages larger than 256 KB to reduce the number of messages
AnswersC, D

Enabling batching of messages when sending is a crucial best practice for optimizing Azure Service Bus performance. By grouping multiple messages into a single network operation, batching significantly reduces the number of round trips between the client application and the Service Bus namespace. This reduction in network overhead minimizes latency, improves overall message throughput, and can also lead to cost savings by consolidating billing operations, making it highly efficient for high-volume message ingestion.

Why this answer

Enabling batching allows the client to accumulate multiple messages into a single AMQP or SBMP frame, reducing the number of network round trips and improving throughput. This is particularly effective in high-throughput scenarios where the overhead of individual sends becomes a bottleneck.

Exam trap

The trap here is that candidates often confuse 'sessions' (which guarantee ordering but reduce throughput) with 'batching' (which improves throughput without ordering guarantees), or they mistakenly think duplicate detection is a harmless default rather than a performance-impacting feature.

851
MCQmedium

Refer to the exhibit. A developer deploys this ARM template to create a web app with a connection string to Azure Cosmos DB. The deployment succeeds but the web app cannot connect to Cosmos DB. What is the most likely cause?

A.The connection string should use a secret reference to Azure Key Vault
B.The listKeys function is used incorrectly
C.The web app name parameter is missing
D.The listKeys function requires a different API version
AnswerA

Best practice is to use Key Vault references, but the immediate issue is that the connection string is incomplete; it needs the full connection string format.

Why this answer

The ARM template exposes the Cosmos DB connection string with the master key in plaintext, which is insecure. The connection string should be stored as a secret in Azure Key Vault and referenced using a secret reference in the ARM template. Option B is incorrect because the listKeys function is used correctly to retrieve the keys.

Option C is incorrect because the web app name parameter is present and used. Option D is incorrect because the API version is appropriate for the deployment.

852
MCQmedium

Multiple teams need different levels of access to the same Azure Key Vault: the DevOps team needs to create and rotate secrets, the application team needs read-only secret access, and the auditing team needs list-only access. The security team wants audit logs of all access decisions and the ability to manage permissions through a single system. What access model should the developer recommend?

A.Use Azure RBAC for Key Vault with role assignments scoped per team: Key Vault Secrets Officer for DevOps, Key Vault Secrets User for the app team, and Key Vault Reader for auditing
B.Create separate access policies for each team with the minimum required permissions
C.Create a separate Key Vault per team to enforce isolation between access levels
D.Issue shared access signatures for each team scoped to the operations they need
AnswerA

RBAC assignments are integrated with Azure's identity and access management plane. All access decisions are logged in Azure Activity Log, fulfilling the audit requirement. Roles can be assigned at vault scope or narrower scopes. RBAC policies are managed centrally in Azure IAM, consistent with how all other Azure resources are governed.

Why this answer

Azure RBAC for Key Vault provides a unified, centralized access management system that meets all requirements. The Key Vault Secrets Officer role allows DevOps to create and rotate secrets, the Key Vault Secrets User role grants read-only access to the application team, and the Key Vault Reader role provides list-only access for auditing. Additionally, RBAC integrates with Azure Monitor to deliver audit logs of all access decisions, satisfying the security team's need for a single management plane.

Exam trap

The trap here is that candidates may confuse the older Key Vault access policies (which are vault-specific and lack centralized audit integration) with Azure RBAC, or incorrectly assume that SAS tokens can be applied to Key Vault, when in fact SAS is exclusive to Azure Storage services.

How to eliminate wrong answers

Option B is wrong because separate access policies per team would require managing permissions individually for each vault and do not provide a single system for managing permissions across teams, nor do they natively integrate audit logs of access decisions as seamlessly as RBAC. Option C is wrong because creating a separate Key Vault per team violates the requirement for a single system to manage permissions and introduces unnecessary complexity and cost, while still not providing a unified audit trail. Option D is wrong because shared access signatures (SAS) are not supported for Azure Key Vault; SAS tokens are used for Azure Storage, not for controlling access to secrets, keys, or certificates in Key Vault.

853
MCQmedium

You are monitoring an Azure web application with Application Insights. You need to identify the top 5 slowest API endpoints over the last 7 days. The results should show the endpoint URL, average response time, and request count. Which feature or query should you use?

A.Use Log Analytics and run a query on the 'requests' table to aggregate by URL and sort by avg(duration).
B.Use the 'Performance' blade under 'Investigate' in the Application Insights resource.
C.Use the 'Application Map' feature to visualize dependencies and endpoints.
D.Configure Smart Detection to automatically identify slow API endpoints.
AnswerB

The Performance blade within Application Insights is purpose-built to identify and analyze slow operations and dependencies. It automatically aggregates request telemetry, displaying a ranked list of operations (e.g., web requests, API calls) by their average duration, total duration, and request count. This provides an immediate, visual overview of performance bottlenecks, allowing users to quickly drill down into specific slow requests for detailed transaction diagnostics without writing any queries.

Why this answer

The 'Performance' blade in Application Insights provides a pre-built, optimized view that automatically aggregates request data by endpoint URL, displaying average response time and request count. It allows you to sort by average duration to quickly identify the top 5 slowest API endpoints over the last 7 days without writing any custom query.

Exam trap

The trap here is that candidates often assume Log Analytics is always the best tool for any custom aggregation, overlooking that Application Insights provides purpose-built blades (like Performance) that offer the same functionality with zero query effort and faster results.

How to eliminate wrong answers

Option A is wrong because while Log Analytics can query the 'requests' table, it requires writing a Kusto query manually (e.g., 'requests | summarize avg(duration) by url | top 5 by avg_duration desc'), which is more complex and time-consuming than using the built-in Performance blade. Option C is wrong because the Application Map visualizes dependencies and call flows between components, not aggregated performance metrics like average response time and request count for endpoints. Option D is wrong because Smart Detection is an automated alerting feature that proactively identifies anomalies (e.g., sudden degradation), not a tool for manually querying historical top-N slowest endpoints over a fixed period.

854
MCQmedium

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

A.Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.
B.Use the Azure SDK to poll for new blobs from within a continuously running background service.
C.Use an Azure VM running a scheduled task to poll for new blobs and perform validation.
D.Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.
AnswerA

This is the most efficient and scalable solution. Azure Event Grid provides near real-time, push-based event notifications for blob creation, eliminating the need for continuous polling. An Azure Function, triggered by Event Grid, executes only when a new blob is detected, leveraging a serverless, consumption-based model that is highly cost-effective and automatically scales to handle fluctuating loads without managing infrastructure.

Why this answer

Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Exam trap

The trap here is that candidates often assume polling-based solutions (like Logic Apps or background services) are simpler or more reliable, but the exam emphasizes event-driven architectures as the most cost-effective and scalable pattern for blob processing in Azure.

How to eliminate wrong answers

Option B is wrong because continuously running a background service that polls Azure Blob Storage wastes compute resources and incurs ongoing costs, even when no new blobs are uploaded, and does not scale efficiently with high volumes. Option C is wrong because using an Azure VM with a scheduled task introduces unnecessary overhead, requires manual scaling, and incurs costs for the VM even when idle, making it neither cost-effective nor scalable. Option D is wrong because Azure Logic Apps with a recurrence trigger polls for new blobs on a fixed schedule, which introduces latency and inefficiency compared to the event-driven model, and is less cost-effective for high-frequency or variable workloads.

855
MCQmedium

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

A.Blob soft delete
B.Application Insights sampling
C.Private DNS zone only
D.API Management rate-limit or quota policy
AnswerD

APIM policies can enforce rate limits and quotas per subscription or caller.

Why this answer

Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on subscription keys. These policies enforce limits per subscription scope, protecting backend services from excessive traffic by rejecting requests that exceed the defined rate (e.g., requests per second) or quota (e.g., total calls per month). This directly addresses the requirement to throttle clients by subscription.

Exam trap

The trap here is that candidates may confuse telemetry or storage features (like Application Insights sampling or Blob soft delete) with API throttling mechanisms, overlooking that API Management's rate-limit and quota policies are the correct and direct solution for subscription-based throttling.

How to eliminate wrong answers

Option A is wrong because Blob soft delete is an Azure Storage feature that protects blob data from accidental deletion by retaining deleted blobs for a specified retention period; it has no role in API throttling or subscription-based rate limiting. Option B is wrong because Application Insights sampling is a telemetry feature that reduces data ingestion volume by selecting a percentage of events to analyze; it does not enforce any request throttling or access control on API calls. Option C is wrong because a Private DNS zone only is used for custom domain name resolution within a virtual network, not for implementing API rate limits or subscription-based throttling.

856
MCQeasy

You are building a solution that needs to send millions of events per second to Azure for processing. Which Azure service should you use to ingest the events?

A.Azure Service Bus
B.Azure Event Hubs
C.Azure IoT Hub
D.Azure Notification Hubs
AnswerB

Azure Event Hubs is purpose-built as a highly scalable big data streaming platform capable of ingesting millions of events per second from diverse sources. It excels at capturing, retaining, and processing massive streams of data, acting as the front door for event pipelines and enabling real-time analytics and batch processing. Its partitioned consumer group model allows multiple applications to process the same event stream concurrently and independently.

Why this answer

Azure Event Hubs is the correct choice because it is a big data streaming platform and event ingestion service designed to handle millions of events per second with low latency. It supports high-throughput data ingestion from sources like telemetry, logs, and clickstreams, making it ideal for this scenario.

Exam trap

The trap here is that candidates often confuse Azure Event Hubs with Azure Service Bus, assuming both are message brokers, but Event Hubs is optimized for high-throughput event ingestion while Service Bus is for reliable, ordered message delivery with features like sessions and transactions.

How to eliminate wrong answers

Option A is wrong because Azure Service Bus is a message broker for enterprise messaging with features like queues and topics, optimized for reliable, ordered delivery of individual messages, not for ingesting millions of events per second. Option C is wrong because Azure IoT Hub is a managed service for bidirectional communication with IoT devices, including device management and security features, but its event ingestion throughput is lower and it is not designed for general-purpose high-volume event streaming. Option D is wrong because Azure Notification Hubs is a push notification engine for sending notifications to mobile devices, not for ingesting or processing event streams.

857
MCQhard

Your company has an on-premises Windows service that exposes a custom TCP endpoint. You are building an Azure Logic App that needs to send data to this endpoint. Due to network security policies, you cannot open inbound ports in the firewall. You need to establish a secure bidirectional connection without configuring a VPN. Which Azure service should you use?

A.Azure API Management with on-premises gateway
B.Azure Relay Hybrid Connections
C.Azure Application Gateway with private link
D.Azure ExpressRoute
AnswerB

Azure Relay Hybrid Connections is the correct solution because it enables secure, bidirectional communication over any TCP-based protocol without requiring inbound firewall ports to be opened on the on-premises network. The on-premises Windows service establishes an outbound connection to the Azure Relay endpoint, allowing Azure services to then connect to the Relay and tunnel traffic back to the on-premises service. This "outbound-only" model is ideal for scenarios with strict on-premises network security policies.

Why this answer

Azure Relay Hybrid Connections enable secure bidirectional communication between on-premises services and cloud applications without opening inbound firewall ports. The on-premises service initiates an outbound connection to the Azure Relay over port 443 (HTTPS), and the Logic App sends data through the relay, which forwards it over the already-established outbound tunnel. This satisfies the requirement for a secure, bidirectional connection without VPN or inbound port exposure.

Exam trap

The trap here is that candidates often confuse Azure Relay with Azure API Management or Application Gateway, assuming they can handle arbitrary TCP traffic, but only Hybrid Connections provide the outbound-initiated tunnel required when inbound ports are blocked.

How to eliminate wrong answers

Option A is wrong because Azure API Management with on-premises gateway is designed for exposing and managing APIs, not for establishing a bidirectional TCP tunnel; it still requires inbound connectivity or a VPN for the gateway to reach the on-premises service. Option C is wrong because Azure Application Gateway with private link provides inbound HTTPS load balancing and private connectivity to Azure services, but it does not create an outbound-initiated tunnel to an on-premises TCP endpoint without opening inbound ports. Option D is wrong because Azure ExpressRoute establishes a dedicated private network connection between on-premises and Azure, which requires BGP routing and often firewall configuration, violating the 'no VPN' and 'no inbound ports' constraints.

858
MCQhard

You are reviewing a lifecycle management rule configured on an Azure Storage account. The rule is defined as shown in the exhibit. You notice that blobs tagged with project=temp are not being moved to the Archive tier as expected. What is the most likely cause?

A.The rule does not include a filter for blob index tags.
B.The condition uses an incorrect operator for age.
C.The Archive tier is not supported for this storage account type.
D.Block blobs cannot be moved to the Archive tier.
AnswerB

Azure Blob Storage lifecycle management rules require specific operators for defining age-based conditions. For instance, to specify a condition based on the age of a blob since its last modification, the correct operator is `daysAfterModificationGreaterThan` (or `daysAfterCreationGreaterThan`, `daysAfterLastAccessTimeGreaterThan`). Using a generic operator like `greaterThan` directly on an age property is syntactically invalid within the lifecycle rule JSON definition, leading to a rule that fails to execute as intended.

Why this answer

The lifecycle management rule uses the condition 'age > 30' which is an incorrect operator. Azure lifecycle management rules require the operator 'daysElapsedSinceModificationGreaterThan' or similar, not a generic 'age >' syntax. This invalid operator causes the rule to fail to evaluate correctly, so blobs tagged with project=temp are not moved to Archive tier.

Exam trap

The trap here is that candidates may overlook the exact operator syntax required in lifecycle management rules and assume any comparison operator like '>' is valid, when Azure requires specific predefined operators like 'daysElapsedSinceModificationGreaterThan'.

How to eliminate wrong answers

Option A is wrong because the rule does include a filter for blob index tags (project=temp), so the absence of a filter is not the issue. Option C is wrong because the Archive tier is supported on general-purpose v2 and BlobStorage accounts, and the question does not indicate an unsupported account type. Option D is wrong because block blobs can be moved to the Archive tier; only append blobs and page blobs are excluded from tiering to Archive.

859
MCQmedium

You are designing a solution to process thousands of images uploaded to Azure Blob Storage. Each image must be resized and metadata extracted. The processing must be serverless and cost-effective. Which Azure service should you use?

A.Azure Container Instances with Blob Storage SDK
B.Azure Logic Apps with Blob Storage connector
C.Azure Event Grid with Webhook to a custom service
D.Azure Functions with Blob Storage trigger
AnswerD

Azure Functions with a Blob Storage trigger offers an ideal serverless solution for processing thousands of images efficiently. It automatically executes custom code in response to new blob uploads, providing a truly event-driven architecture. This approach scales elastically with demand, only charging for the compute resources consumed during processing, making it highly cost-effective and eliminating the need to manage underlying infrastructure.

Why this answer

Azure Functions with a Blob Storage trigger is the correct choice because it provides a serverless, event-driven compute model that automatically scales to process thousands of images as they are uploaded to Blob Storage. The trigger binds directly to a blob container, invoking a function for each new blob, which allows you to resize images and extract metadata without managing infrastructure, making it both cost-effective and efficient for high-throughput workloads.

Exam trap

The trap here is that candidates may choose Azure Event Grid (Option C) because it is event-driven, but they overlook that Event Grid alone does not provide compute; it requires a separate compute service (like Functions or a webhook) to process the image, and the question specifically asks for a serverless and cost-effective solution that directly processes the images, which Azure Functions with a Blob Storage trigger achieves natively.

How to eliminate wrong answers

Option A is wrong because Azure Container Instances requires you to manage container lifecycle and polling logic, and it is not inherently event-driven or serverless in the same way as Functions; you would need to implement a polling mechanism or use additional services to trigger processing, increasing complexity and cost. Option B is wrong because Azure Logic Apps is designed for orchestration and integration workflows, not for high-throughput, compute-intensive tasks like image resizing; it lacks the native code execution environment and scaling capabilities needed for processing thousands of images efficiently. Option C is wrong because Azure Event Grid with a Webhook to a custom service introduces additional latency and operational overhead, as you must host and manage a webhook endpoint (e.g., on a VM or container) that scales independently, negating the serverless and cost-effective benefits of a fully managed trigger like Blob Storage.

860
MCQmedium

You need to enable client-side encryption for data stored in Azure Blob Storage. The encryption keys must be managed by your organization using Azure Key Vault. What should you use?

A.Azure Disk Encryption
B.Azure Information Protection
C.Azure Storage service-side encryption with customer-managed keys
D.Azure Storage client-side encryption library with Key Vault
AnswerD

The Azure Storage client-side encryption library, when integrated with Azure Key Vault, provides the exact functionality required: encrypting data on the client application *before* it is uploaded to Azure Storage. This ensures that the data is encrypted in transit and remains encrypted at rest, with Azure Storage only ever receiving the ciphertext. Azure Key Vault securely stores and manages the encryption keys, allowing the client application to retrieve and use them for encryption and decryption, thereby giving customers full control over their data's encryption lifecycle and ensuring maximum confidentiality.

Why this answer

Client-side encryption requires the application to encrypt data before uploading it to Azure Blob Storage, and the Azure Storage client-side encryption library integrates with Azure Key Vault to allow your organization to manage the encryption keys. This approach ensures that the storage service never has access to the plaintext data or the keys, meeting the requirement for client-side encryption with customer-managed keys.

Exam trap

The trap here is confusing client-side encryption (where the client encrypts before sending) with service-side encryption (where the service encrypts after receiving), leading candidates to incorrectly choose service-side encryption with customer-managed keys (Option C) even though it does not meet the 'client-side' requirement.

How to eliminate wrong answers

Option A is wrong because Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt virtual machine disks at the OS and data disk level, not client-side encryption of blob data. Option B is wrong because Azure Information Protection is a classification and labeling solution for documents and emails, not a mechanism for encrypting blob storage data at the client side. Option C is wrong because Azure Storage service-side encryption with customer-managed keys encrypts data at the storage service layer after it is received, not at the client side before transmission, so the service still handles the plaintext data.

861
MCQmedium

You are monitoring an Azure Web App with Application Insights. You notice that certain requests have high server response times. You need to identify which specific database queries are causing the delays. Which Application Insights feature should you use?

A.Application Insights Profiler
B.Live Metrics Stream
C.Performance blade
D.Application Map
AnswerA

Application Insights Profiler is the correct tool because it captures detailed execution traces of requests, providing a granular view of method calls and dependency durations. It specifically instruments code paths to show the exact time spent in each operation, including the duration of individual database queries and even the specific SQL commands executed, making it ideal for pinpointing performance bottlenecks at the query level.

Why this answer

Application Insights Profiler is the correct feature because it provides detailed, code-level diagnostics for requests with high server response times, including per-operation breakdowns of database query durations. It captures execution traces that show exactly which SQL queries or external calls are contributing to latency, enabling you to pinpoint the specific database queries causing delays.

Exam trap

The trap here is that candidates often confuse the Performance blade (which shows aggregated dependency durations) with the Profiler (which provides per-request, code-level traces), leading them to choose the Performance blade when they need to identify specific slow queries rather than overall trends.

How to eliminate wrong answers

Option B (Live Metrics Stream) is wrong because it shows real-time metrics like request rate and failure counts but does not provide per-query profiling or detailed database query timings. Option C (Performance blade) is wrong because it aggregates performance data (e.g., average response times, dependency durations) but lacks the granular, per-request trace-level detail needed to identify specific slow queries. Option D (Application Map) is wrong because it visualizes the topology and dependencies of your application components but does not drill into individual query execution times or provide profiling data.

862
Multi-Selectmedium

Which TWO actions should you take to reduce the cost of an Azure App Service plan that is underutilized?

Select 2 answers
A.Deploy the application to a different region
B.Enable auto-scaling
C.Purchase Reserved Instances
D.Scale out to fewer instances
E.Scale down the App Service plan to a lower tier
AnswersD, E

"Scaling out" refers to adjusting the number of instances running within an App Service plan. If an application is underutilized, it means it has more instances than required to handle its current workload efficiently. Reducing the instance count directly decreases the total computational resources consumed by the application, as each instance incurs a cost. This action directly lowers the operational expenditure for the App Service plan by aligning the provisioned capacity more closely with the actual demand.

Why this answer

Scaling out to fewer instances directly reduces the number of VMs running the App Service plan, which lowers the compute cost. Since the plan is underutilized, fewer instances can handle the existing load without performance degradation, making this a cost-optimization action.

Exam trap

The trap here is that candidates confuse scaling out (adding instances) with scaling down (reducing tier), or think auto-scaling always saves money, when in fact it can increase costs if the base load is already low.

863
MCQhard

You are configuring a managed identity for an Azure App Service to access Azure Key Vault. The identity has been assigned, but the app receives a 403 Forbidden when trying to retrieve a secret. What is the most likely cause?

A.The app is using the wrong endpoint
B.The managed identity is not enabled in the App Service
C.The managed identity lacks an access policy or RBAC role in Key Vault
D.The Key Vault firewall is blocking the request
AnswerC

Access policies or RBAC roles are required to authorize the identity to read secrets.

Why this answer

Azure Key Vault uses either access policies or Azure RBAC to authorize requests. When a managed identity is assigned to an App Service but no corresponding access policy or RBAC role (e.g., 'Key Vault Secrets User') is granted in Key Vault, the identity has no permissions to read secrets, resulting in a 403 Forbidden response. The 403 indicates the request reached Key Vault but was denied due to missing authorization.

Exam trap

The trap here is that candidates often confuse a 403 Forbidden with a network-level firewall block, but in Azure Key Vault, a 403 typically indicates an authorization failure (missing access policy or RBAC role), not a firewall issue, especially when using a managed identity.

How to eliminate wrong answers

Option A is wrong because using the wrong endpoint (e.g., incorrect vault URL or secret path) would typically result in a 404 Not Found or 400 Bad Request, not a 403 Forbidden. Option B is wrong because if the managed identity were not enabled in the App Service, the app would receive a 400 Bad Request or an authentication failure (e.g., 'ManagedIdentityCredential authentication failed'), not a 403 from Key Vault. Option D is wrong because if the Key Vault firewall were blocking the request, the app would receive a 403 Forbidden with a message like 'Access denied due to IP firewall rules', but the scenario describes a managed identity, which is a trusted Azure service and can bypass the firewall if the 'Allow trusted Microsoft services' setting is enabled; the 403 here is specifically about missing permissions, not network-level blocking.

864
MCQhard

A company runs a critical web app on Azure App Service that must handle traffic spikes without downtime. They set up autoscaling rules based on CPU percentage. However, during a spike, the app becomes unresponsive before new instances are added. What should they do?

A.Switch to memory-based autoscaling
B.Decrease the scale-in cooldown period
C.Use pre-warming instances with a scheduled scaling rule
D.Increase the CPU percentage threshold for scale-out
AnswerC

Using pre-warming instances with a scheduled scaling rule is the most effective solution for mitigating performance degradation during anticipated load spikes. This approach allows new instances to be added and fully initialized, including application startup and caching, *before* the expected surge in traffic. By having instances ready and "warm" ahead of time, the application can immediately handle the increased load without experiencing cold start delays or performance bottlenecks, ensuring a smooth user experience.

Why this answer

Pre-warming instances with a scheduled scaling rule ensures that additional instances are already running and ready to handle traffic before the CPU spike occurs. This avoids the cold-start delay inherent in reactive autoscaling, where new instances take time to provision and initialize, causing unresponsiveness during rapid spikes.

Exam trap

The trap here is that candidates assume reactive autoscaling (e.g., lowering thresholds or changing metrics) can solve latency issues, but they overlook the fundamental cold-start delay that requires proactive instance pre-warming.

How to eliminate wrong answers

Option A is wrong because switching to memory-based autoscaling does not address the fundamental issue of reactive scaling latency; the app would still become unresponsive while waiting for new instances to start. Option B is wrong because decreasing the scale-in cooldown period affects how quickly instances are removed after a scale-out, not how fast new instances are added during a spike, so it does not prevent the initial unresponsiveness. Option D is wrong because increasing the CPU percentage threshold for scale-out would delay scaling even further, making the app more likely to become unresponsive during a spike.

865
MCQhard

You are using Azure API Management (APIM) to expose a REST API. The backend API requires mutual TLS (client certificate) for authentication. The client certificate is stored in Azure Key Vault. You need to configure APIM to use this certificate when calling the backend, without exposing the certificate contents in the policy files. Which APIM feature and policy should you use?

A.Use the authentication-certificate policy with a named value that references the Key Vault certificate.
B.Use the authentication-managed-identity policy to authenticate to the backend.
C.Upload the client certificate directly to APIM's Certificate store and reference it in the policy.
D.Use a JavaScript policy to fetch the certificate from Key Vault and attach it.
AnswerA

This is the correct approach. The authentication-certificate policy is specifically designed to present a client certificate to a backend service for mutual TLS authentication. By using a named value configured to reference a Key Vault secret of type 'certificate', APIM securely retrieves the certificate's private key at runtime without exposing it in configuration. This method ensures secure storage, automatic rotation capabilities, and simplified management of client certificates.

Why this answer

The `authentication-certificate` policy in Azure API Management can reference a client certificate stored in Azure Key Vault via a named value. Named values securely store secrets and can point to Key Vault certificates without exposing the certificate contents in policy files. This allows APIM to present the certificate during mutual TLS authentication to the backend API.

Exam trap

The trap here is that candidates may confuse the `authentication-managed-identity` policy with certificate-based authentication, or assume that uploading the certificate directly to APIM is equivalent to using Key Vault, but the question explicitly requires avoiding exposure of certificate contents in policy files, which only the named value approach with Key Vault reference achieves.

How to eliminate wrong answers

Option B is wrong because `authentication-managed-identity` policy authenticates APIM to a backend using Azure AD tokens, not client certificates; it cannot satisfy mutual TLS requirements. Option C is wrong because uploading the certificate directly to APIM's Certificate store exposes the certificate contents in the APIM instance and requires manual management, whereas the requirement is to avoid exposing certificate contents in policy files and leverage Key Vault. Option D is wrong because using a JavaScript policy to fetch the certificate from Key Vault would expose the certificate contents in the policy code and is not the recommended or secure approach; APIM provides built-in integration with Key Vault via named values.

866
MCQmedium

You are developing a web app that authenticates users via Microsoft Entra ID. The app needs to call a downstream API on behalf of the signed-in user. Which OAuth 2.0 flow should you implement?

A.Client credentials flow
B.Implicit flow
C.Authorization code flow with PKCE
D.Device code flow
AnswerC

The Authorization Code flow with PKCE (Proof Key for Code Exchange) is the recommended and most secure OAuth 2.0 flow for web applications, including single-page applications and traditional web apps. It involves exchanging an authorization code for an access token at the backend, preventing the token from being exposed in the browser. PKCE further enhances security by mitigating authorization code interception attacks, ensuring that only the legitimate client application can exchange the code for tokens, making it ideal for user-authenticated API calls.

Why this answer

The authorization code flow with PKCE is the correct choice because the app needs to authenticate a signed-in user and then call a downstream API on their behalf. This flow securely exchanges an authorization code for an access token, and PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, which is essential for public clients like web apps. It is the recommended OAuth 2.0 flow for single-page apps and native apps, but also applicable to web apps that require high security.

Exam trap

The trap here is that candidates often confuse the client credentials flow (Option A) with the need to call a downstream API, but they forget that the client credentials flow does not act on behalf of a user, only the application itself, which fails the 'on behalf of the signed-in user' requirement.

How to eliminate wrong answers

Option A is wrong because the client credentials flow is designed for server-to-server authentication without a user context, using the application's own identity, not the signed-in user's identity. Option B is wrong because the implicit flow is deprecated due to security risks (e.g., access tokens exposed in the URL fragment) and is not recommended for calling downstream APIs; it lacks PKCE support. Option D is wrong because the device code flow is intended for devices with limited input capabilities (e.g., smart TVs, IoT devices) and requires a separate browser to authenticate, which is not suitable for a standard web app scenario.

867
MCQmedium

You need to implement a shared access signature (SAS) for an Azure blob container that allows a client to list blobs and read blob contents. The SAS must be valid for one hour and should not allow write or delete operations. Which permissions should you include in the SAS token?

A.r, l, and c
B.r and l
C.r, l, and d
D.r, l, and w
AnswerB

The 'r' (Read) and 'l' (List) permissions are precisely what is required for scenarios where users need to view the contents of storage resources and enumerate items within a container or directory. 'r' enables downloading blob content and accessing metadata, while 'l' allows for browsing and discovering available resources. Together, these permissions provide comprehensive read-only access without granting any modification or deletion capabilities, adhering to the principle of least privilege.

Why this answer

The SAS token needs 'r' (read) to allow reading blob contents and 'l' (list) to allow listing blobs in the container. These two permissions together satisfy the requirement for read-only access without write or delete capabilities.

Exam trap

The trap here is that candidates may confuse 'l' (list) with 'r' (read) or include 'c' (create) thinking it's needed for listing, but 'l' alone enables listing blobs in a container without requiring create permissions.

How to eliminate wrong answers

Option A is wrong because it includes 'c' (create), which allows creating new blobs, violating the requirement to not allow write operations. Option C is wrong because it includes 'd' (delete), which allows deleting blobs, violating the requirement to not allow delete operations. Option D is wrong because it includes 'w' (write), which allows writing blob content, violating the requirement to not allow write operations.

868
MCQmedium

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

A.Increase the cache size
B.Increase the time-to-live (TTL) for cached items
C.Implement cache-aside pattern with manual invalidation
D.Change the eviction policy to allkeys-lfu
AnswerB

Increasing the Time-To-Live (TTL) for cached items directly improves the cache hit ratio by ensuring data remains in the cache for a longer duration. When an item's TTL is extended, it reduces the likelihood of that item expiring and being removed from the cache, thereby preventing subsequent requests for the same data from resulting in a cache miss and a slower fetch from the origin data store. This directly addresses the problem of items being removed prematurely.

Why this answer

High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Exam trap

The trap here is that candidates confuse cache misses caused by expiration (TTL too short) with cache misses caused by memory pressure (evictions), leading them to incorrectly choose increasing cache size or changing eviction policy instead of adjusting TTL.

How to eliminate wrong answers

Option A is wrong because increasing cache size addresses capacity constraints (e.g., evictions due to memory pressure), but the problem is high cache misses, not evictions; a larger cache won't help if items expire too soon. Option C is wrong because cache-aside with manual invalidation is already a common pattern; implementing it doesn't inherently improve hit ratio—it only ensures data consistency, and manual invalidation could actually increase misses if not done carefully. Option D is wrong because changing the eviction policy to allkeys-lfu (Least Frequently Used) only affects which keys are removed when memory is full; it does not extend how long items stay in cache, so it won't reduce misses caused by short TTLs.

869
MCQeasy

You develop an Azure Function that writes to Azure Blob Storage. During testing, you notice that the function fails intermittently with a 503 (Service Unavailable) error. What is the most likely cause?

A.The storage account is throttling requests due to high volume
B.The storage account firewall is blocking the function
C.The function does not have proper authentication
D.The blob container does not exist
AnswerA

A 503 Service Unavailable error from Azure Storage indicates that the service is temporarily unable to handle the request, often due to throttling. This occurs when the storage account exceeds its defined scalability targets for IOPS or bandwidth, a protective measure to ensure overall service stability and prevent a single client from monopolizing resources. Implementing retry logic with exponential backoff is crucial for applications encountering such transient errors.

Why this answer

A 503 (Service Unavailable) error from Azure Blob Storage indicates that the storage service is temporarily unable to handle the request, typically due to server-side load. The most common cause is throttling when the storage account exceeds its scalability targets (e.g., 20,000 requests per second per account for blob storage). This aligns with intermittent failures under high request volume, not with configuration or existence issues.

Exam trap

The trap here is that candidates confuse HTTP status codes: 503 (Service Unavailable) is often mistaken for authentication or configuration errors, but it specifically indicates a server-side capacity issue, not a client-side misconfiguration.

How to eliminate wrong answers

Option B is wrong because a storage account firewall blocking the function would result in a 403 (Forbidden) or network-level error, not a 503. Option C is wrong because improper authentication (e.g., missing or invalid SAS token or managed identity) would produce a 401 (Unauthorized) or 403 error, not a 503. Option D is wrong because a missing blob container would cause a 404 (Not Found) error when attempting to write, not a 503.

870
MCQeasy

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

A.Store the API key in Azure SQL Database and query it at startup.
B.Store the API key in Azure Key Vault and use a managed identity to retrieve it.
C.Store the API key in a configuration file in the application code.
D.Store the API key in an App Service application setting.
AnswerB

While using Azure Key Vault for secure storage and managed identities for retrieval is an excellent security practise, this option fails because a managed identity authenticates the web app to *Azure resources*, such as Key Vault itself, using Microsoft Entra ID. It does not provide a mechanism to directly authenticate or pass an API key to an *external* SaaS API. This approach is tempting and would be correct if the external SaaS API supported Microsoft Entra ID authentication, allowing the managed identity to obtain a token for direct access, or if the requirement was solely for the app to securely *access* the key for its own internal use.

Why this answer

Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements.

This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Exam trap

The trap is choosing App Service application settings (Option D) because they are simpler and can technically store secrets. However, Azure Key Vault with Managed Identity (Option B) is the recommended best practice for secure secret management in Azure, offering a dedicated, more robust, and auditable solution that aligns with enterprise security standards and the development principles tested in the AZ-204 exam. While App Service settings provide basic security, Key Vault is the superior choice for 'best approach' when dealing with sensitive API keys.

How to eliminate wrong answers

Option A is wrong because querying an Azure SQL Database at startup introduces unnecessary latency, complexity, and potential security exposure from connection strings, and it does not leverage Azure's built-in secure storage for secrets. Option B is wrong because while Azure Key Vault with managed identity is a highly secure approach, it is overkill for a single API key and requires additional code and configuration (e.g., using Key Vault references or SDK calls), whereas App Service application settings provide a simpler solution that still meets the requirements. Option C is wrong because storing the API key in a configuration file in the application code exposes the key in source control and prevents rotation without redeploying the app, violating both security and rotation requirements.

871
MCQmedium

You are building an Azure Logic App that needs to call an external API secured with OAuth 2.0 client credentials flow. You have registered an application in Microsoft Entra ID with client ID 'myClientId' and client secret stored in Key Vault. Which action should you use to authenticate?

A.HTTP action with Active Directory OAuth authentication
B.HTTP action with Managed Identity authentication
C.Invoke the API through Azure API Management
D.Use the Microsoft Entra ID OAuth 2.0 connector
AnswerA

The HTTP action in Azure Logic Apps provides robust, built-in support for various authentication types, including Active Directory OAuth. When configured, it handles the entire client credentials flow by using an Azure AD application registration's client ID and secret to acquire an access token from Microsoft Entra ID. This token is then automatically included in the Authorization header of the outgoing request to the external API, ensuring secure and compliant authentication without manual token management.

Why this answer

The HTTP action in Azure Logic Apps supports an 'Active Directory OAuth' authentication type that directly implements the OAuth 2.0 client credentials flow. By providing the tenant ID, client ID, and referencing the client secret from Key Vault (via a secure parameter or connection reference), the Logic App can obtain an access token from Microsoft Entra ID and authenticate to the external API without custom code.

Exam trap

The trap here is that candidates often confuse the 'Managed Identity' option (which works only for Azure resources that accept Microsoft Entra ID tokens directly) with the need to authenticate to an external third-party API, or they mistakenly look for a dedicated 'OAuth 2.0 connector' instead of using the HTTP action's built-in authentication type.

How to eliminate wrong answers

Option B is wrong because Managed Identity authentication is designed for Azure-to-Azure scenarios where the resource (e.g., Azure Storage, Key Vault) supports Microsoft Entra ID token-based auth; it cannot be used to authenticate to an arbitrary external API secured with OAuth 2.0 client credentials flow unless that API explicitly trusts the managed identity's token. Option C is wrong because invoking the API through Azure API Management does not solve authentication; API Management would still need to authenticate to the external API, and the Logic App would need to pass credentials or tokens to API Management, adding unnecessary complexity. Option D is wrong because the 'Microsoft Entra ID OAuth 2.0 connector' is a deprecated or non-existent connector; the correct approach is to use the HTTP action with the built-in Active Directory OAuth authentication type, not a separate connector.

872
MCQhard

Your company uses Azure Service Bus topics and subscriptions to send order notifications. You notice that some messages are not being delivered to a subscription. The subscription has a SQL filter that matches messages with a 'region' property equal to 'EU'. You verify that the messages have 'region' set to 'eu' (lowercase). What is the most likely cause?

A.The SQL filter is case-sensitive and 'EU' does not match 'eu'.
B.The subscription is disabled.
C.The subscription has no filter defined.
D.The subscription has a correlation filter instead.
AnswerA

Azure Service Bus SQL filters evaluate conditions against message properties using a SQL-like syntax. By default, string comparisons within these filters are case-sensitive. Therefore, if a message property, such as 'Region', has a value of 'EU', a SQL filter condition like `Region = 'eu'` will evaluate to false because 'EU' and 'eu' are treated as distinct strings. This strict matching behavior prevents the message from being delivered to the subscription.

Why this answer

The SQL filter in Azure Service Bus is case-sensitive by default. The filter condition 'region = ''EU''' requires an exact match, including case. Since the messages have 'region' set to 'eu' (lowercase), they do not satisfy the filter condition and are therefore not delivered to the subscription.

This is the most likely cause of the missing messages.

Exam trap

The trap here is that candidates assume SQL filters in Azure Service Bus are case-insensitive like many SQL databases, but they are actually case-sensitive by default, leading to the incorrect conclusion that the filter is working correctly when it is not.

How to eliminate wrong answers

Option B is wrong because if the subscription were disabled, no messages would be delivered at all, not just some messages missing, and the question states that some messages are not being delivered, implying others are. Option C is wrong because if the subscription had no filter defined, all messages (including those with 'region' set to 'eu') would be delivered, which contradicts the observed behavior. Option D is wrong because a correlation filter would compare the 'region' property as a whole string, but it would still be case-sensitive; however, the question explicitly states a SQL filter is used, so a correlation filter is not relevant here.

873
MCQhard

You are developing a web API hosted on Azure App Service. The API must authenticate requests using Microsoft Entra ID OAuth 2.0 bearer tokens. You want to validate the token in your ASP.NET Core API code with minimal custom validation logic. Which library should you use?

A.Microsoft Authentication Library (MSAL)
B.Azure Identity client library
C.Microsoft.Identity.Web
D.Azure Management Libraries for .NET
AnswerC

Microsoft.Identity.Web is an ASP.NET Core library specifically engineered to simplify the integration of web APIs and web applications with Microsoft Entra ID. It provides out-of-the-box middleware and services for validating incoming bearer tokens, handling claims transformation, and enforcing authorization policies based on scopes and roles. This library significantly reduces the boilerplate code required for secure API development by abstracting away the complexities of OpenID Connect token validation.

Why this answer

Microsoft.Identity.Web is the correct choice because it provides a high-level, opinionated library that integrates directly with ASP.NET Core's authentication pipeline, handling token validation, scopes, and app roles with minimal custom code. It abstracts away the complexity of JWT bearer token validation against Microsoft Entra ID, including automatic OpenID Connect discovery and token signature verification.

Exam trap

The trap here is that candidates often confuse MSAL (for token acquisition) with Microsoft.Identity.Web (for token validation), or assume the Azure Identity library handles all authentication scenarios, when it is actually focused on service-to-service authentication and Azure SDK credentials.

How to eliminate wrong answers

Option A is wrong because MSAL is designed for acquiring tokens from Microsoft Entra ID, not for validating incoming bearer tokens in a web API. Option B is wrong because the Azure Identity client library provides credential types for authenticating to Azure services, not for validating OAuth 2.0 bearer tokens in an ASP.NET Core API. Option D is wrong because Azure Management Libraries for .NET are used for managing Azure resources (e.g., creating VMs, configuring App Service), not for token validation.

874
MCQmedium

Your app uses Azure Key Vault to store secrets. You need to grant the app access to read secrets using managed identity. Which RBAC role should you assign to the app's managed identity?

A.Key Vault Crypto Officer
B.Key Vault Reader
C.Key Vault Contributor
D.Key Vault Secrets User
AnswerD

The Key Vault Secrets User role is the appropriate choice as it is specifically designed to grant data plane access for reading secret values stored in Azure Key Vault. This role includes the `Microsoft.KeyVault/vaults/secrets/read` permission, enabling an application to retrieve and utilize the confidential information. It adheres to the principle of least privilege by providing only the necessary permissions for secret consumption without granting broader management capabilities.

Why this answer

The Key Vault Secrets User role (D) is the correct RBAC role because it grants the managed identity permission to perform read operations on secrets, specifically 'Microsoft.KeyVault/vaults/secrets/read' and 'Microsoft.KeyVault/vaults/secrets/getSecret/action'. This aligns with the requirement to read secrets using managed identity without granting broader management or cryptographic key permissions.

Exam trap

The trap here is that candidates often confuse the Key Vault Reader role (which only allows reading vault metadata, not secret values) with the Key Vault Secrets User role, or they mistakenly choose a broader role like Contributor, thinking it includes read access, but it grants excessive permissions.

How to eliminate wrong answers

Option A is wrong because Key Vault Crypto Officer grants permissions to manage cryptographic keys (e.g., encrypt, decrypt, sign) but not to read secrets. Option B is wrong because Key Vault Reader provides read-only access to vault metadata and properties, but not to the actual secret values (it lacks the 'getSecret' action). Option C is wrong because Key Vault Contributor allows full management of the vault and its objects, including creating and deleting secrets, which exceeds the required read-only access and violates the principle of least privilege.

875
MCQmedium

After deploying a new version to the staging slot and swapping to production, users report a 60-second spike in 503 errors. The application takes 45 seconds to initialize its connection pools and caches before it can serve traffic. What is the root cause, and what should the developer configure to prevent this?

A.Configure Application Initialization in the App Service settings so the swap waits for the warm-up path to return 200 before redirecting production traffic
B.Roll back the slot swap and investigate the new version for bugs that only appear in production
C.Increase the App Service health check grace period so the load balancer waits longer after the swap
D.Disable Always On for the staging slot so the slot starts fresh on every swap
AnswerA

Application Initialization instructs the App Service platform to send a warm-up request to a configured URL path after the slot starts and before the swap completes. The platform holds traffic on the old slot until the warm-up succeeds. This makes swaps zero-downtime even for applications with long initialization times.

Why this answer

The root cause is that the swap operation immediately redirects production traffic to the new slot before the application has finished its 45-second initialization (connection pools, caches). Application Initialization (warm-up) in Azure App Service can be configured to send a request to a specified path and wait for a 200 response before completing the swap, ensuring the app is ready to serve traffic. This eliminates the 503 errors by preventing the swap from routing users to an uninitialized instance.

Exam trap

The trap here is that candidates confuse the health check feature (which monitors instance health after traffic is routed) with Application Initialization (which delays the swap until the app is ready), leading them to incorrectly choose Option C.

How to eliminate wrong answers

Option B is wrong because the issue is not a bug in the new version—the application initializes successfully after 45 seconds, and the 503 errors only occur during the swap window, indicating a warm-up timing problem, not a code defect. Option C is wrong because the health check grace period controls how long the load balancer waits before marking an instance as unhealthy after a failed health check; it does not delay the swap itself or wait for the app to initialize before routing traffic. Option D is wrong because disabling Always On would cause the staging slot to cold-start on every swap, which would actually increase initialization time and worsen the 503 spike, not prevent it.

876
MCQeasy

A developer is building a function app that processes messages from an Azure Storage queue. The function must scale automatically based on queue length. Which hosting plan supports this automatic scaling?

A.Consumption plan
B.Premium plan
C.App Service plan
D.Azure Container Instances
AnswerA

The Consumption plan is the quintessential serverless hosting option for Azure Functions, automatically scaling out instances based on the volume of incoming events, such as messages in a queue. It offers a pay-per-execution billing model, meaning you only pay for the compute resources consumed while your function is actively running. This makes it highly cost-effective and ideal for event-driven architectures where workloads can be unpredictable or bursty, perfectly suiting a function app processing messages.

Why this answer

The Consumption plan is correct because it is a primary Azure Functions hosting plan that provides true automatic scaling based on event-driven triggers, such as queue length. In this plan, the Azure Functions host dynamically adds or removes instances, scaling from zero when idle, up to a maximum of 200 (default) based on the number of messages in the Storage queue. It uses a target-based scaling strategy that monitors queue depth and backlog, making it the default and most cost-effective option for workloads that need to scale to zero and burst to handle large message volumes.

While the Premium plan also supports automatic scaling based on event triggers, it maintains at least one warm instance and does not scale to zero.

Exam trap

The trap here is that candidates often confuse the Premium plan's always-ready instances and VNet integration with being the only plan that scales automatically, but the Consumption plan is the original and primary plan for automatic, event-driven scaling based on queue length.

How to eliminate wrong answers

Option B is wrong because the Premium plan also supports automatic scaling, but it is not the only plan that does so; the question asks which plan 'supports this automatic scaling,' and while Premium does, the Consumption plan is the canonical answer for cost-effective, event-driven scaling. Option C is wrong because the App Service plan (Dedicated plan) requires you to manually configure scale-out rules or use autoscale settings, and it does not provide the same dynamic, per-event scaling based on queue length without additional configuration. Option D is wrong because Azure Container Instances does not natively integrate with Azure Functions or provide automatic scaling based on Storage queue messages; it is a container orchestration service that requires custom scaling logic or a separate orchestrator.

877
MCQeasy

Your application runs on Azure App Service and needs to access Azure Queue Storage. You want to avoid storing connection strings in configuration files. Which approach should you use?

A.Hardcode the connection string in the application code.
B.Use a system-assigned managed identity with RBAC role 'Storage Queue Data Contributor' on the queue.
C.Use an environment variable in the App Service configuration.
D.Store the connection string in Azure Key Vault and retrieve it at runtime using Key Vault references.
AnswerB

A system-assigned managed identity provides an automatically managed identity for the Azure App Service within Azure Active Directory. This identity can then be granted specific Azure Role-Based Access Control (RBAC) roles, such as 'Storage Queue Data Contributor', directly on the target Azure Storage Queue. This approach eliminates the need for developers to manage or store any connection strings or secrets in the application code or configuration, as Azure AD handles the authentication and authorization securely.

Why this answer

Using a system-assigned managed identity for an Azure App Service allows it to authenticate to Azure Queue Storage without any stored secrets. By assigning the 'Storage Queue Data Contributor' RBAC role, the app gains the necessary permissions to read, write, and delete queue messages, and the identity is automatically managed by Azure AD, eliminating the need for connection strings.

Exam trap

The trap here is that candidates often choose Key Vault references (Option D) thinking it's the most secure, but fail to recognize that managed identity eliminates the need for any secret at all, which is the true 'zero-trust' approach tested in AZ-204.

How to eliminate wrong answers

Option A is wrong because hardcoding a connection string in application code violates security best practices, exposes secrets in source control, and makes rotation difficult. Option C is wrong because while environment variables in App Service configuration avoid hardcoding, they still store the connection string as plaintext in the Azure portal and are not a zero-secret solution. Option D is wrong because although Key Vault references improve security by storing the connection string in a vault, they still require a connection string to be stored and retrieved, whereas managed identity eliminates the need for any secret entirely.

878
MCQmedium

Your company uses Azure Key Vault to store secrets. You need to ensure that only a specific Microsoft Entra ID application can read a particular secret, while other applications are denied access. You want to apply the principle of least privilege. Which access control method should you configure?

A.Assign the application to the Key Vault Contributor RBAC role
B.Assign the application to the Key Vault Secrets User RBAC role at the secret scope
C.Use Key Vault access policies
D.Use managed identity and assign the Key Vault Secrets User role at the vault scope
AnswerB

The Key Vault Secrets User role is a data plane role specifically designed to grant read access to secret contents. By assigning this role at the secret scope, meaning targeting the specific secret resource (e.g., "/secrets/{secretName}"), the application is precisely authorized to retrieve only that individual secret. This approach perfectly aligns with the principle of least privilege, providing the minimum necessary access for the application's requirement.

Why this answer

Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.

Exam trap

The trap here is that candidates often confuse vault-scoped access policies or RBAC roles with secret-scoped RBAC, mistakenly thinking they can achieve per-secret isolation with access policies, when in fact only RBAC at the secret scope provides that granularity.

How to eliminate wrong answers

Option A is wrong because the Key Vault Contributor RBAC role grants management-level permissions (e.g., creating and deleting secrets) rather than read access, violating the least privilege requirement. Option C is wrong because Key Vault access policies operate at the vault scope and cannot be scoped to an individual secret; they would grant the application access to all secrets in the vault. Option D is wrong because assigning the Key Vault Secrets User role at the vault scope grants read access to all secrets in the vault, not just the specific secret, and using a managed identity is unnecessary when a specific application identity is already specified.

879
MCQmedium

You are developing a web app that experiences intermittent slow responses. You enable Application Insights and notice that the server-side request duration is normally under 200ms, but some requests take over 5 seconds. Which diagnostic tool should you use to identify the root cause?

A.Availability Tests
B.Application Insights Profiler
C.Snapshot Debugger
D.Live Metrics Stream
AnswerB

Application Insights Profiler is the correct tool because it automatically collects detailed performance traces from your live application, even during intermittent slowdowns. It captures call stacks and execution times for requests, identifying the specific code paths, methods, and dependencies (like database calls or external HTTP requests) that consume the most time or block execution. This allows developers to pinpoint the exact source of intermittent performance bottlenecks at a code level.

Why this answer

The Application Insights Profiler is the correct tool because it provides a flame chart of per-request CPU and wall-clock time, allowing you to identify which code path is causing the 5-second latency. Unlike other tools, the Profiler captures detailed execution traces for slow requests, pinpointing the exact method or dependency that is blocking the thread.

Exam trap

The trap here is that candidates confuse the Profiler (for performance bottlenecks) with the Snapshot Debugger (for exception debugging), because both involve code-level diagnostics, but they serve different triggers—duration vs. exception.

How to eliminate wrong answers

Option A is wrong because Availability Tests measure endpoint uptime and response from external locations, not internal server-side code execution. Option C is wrong because Snapshot Debugger captures state on exceptions, not on slow requests without errors. Option D is wrong because Live Metrics Stream shows real-time aggregated metrics (e.g., request rate, failure count) but does not provide per-request call stack or method-level timing data.

880
MCQmedium

A background service must call Microsoft Graph without a signed-in user. Which Microsoft identity platform permission model is required? The design must avoid adding custom operational scripts.

A.Password hash synchronization
B.Delegated permissions only
C.Device code flow
D.Application permissions with client credentials flow
AnswerD

Application permissions allow an application to access data in Microsoft Graph as itself, without a user context, making them ideal for background services or daemon applications. When combined with the client credentials flow, the application authenticates directly to Azure AD using its own credentials (e.g., client secret or certificate) to obtain an access token. This token grants the application the specific permissions it has been configured for, enabling it to call Microsoft Graph autonomously and fulfill the requirement of operating without a signed-in user.

Why this answer

Application permissions with the client credentials flow are required because the background service must call Microsoft Graph without a signed-in user. This flow uses OAuth 2.0 client credentials grant (RFC 6749) where the service authenticates as itself using a client secret or certificate, not on behalf of a user. Delegated permissions (Option B) always require a signed-in user context, making them unsuitable for unattended background services.

Exam trap

The trap here is that candidates confuse 'delegated permissions' (which require a user) with 'application permissions' (which do not), often selecting Option B because they think 'permissions' alone suffices, ignoring the 'without a signed-in user' constraint.

How to eliminate wrong answers

Option A is wrong because password hash synchronization is an Azure AD Connect feature for syncing user password hashes to Azure AD, not a permission model for calling Microsoft Graph. Option B is wrong because delegated permissions require a signed-in user to delegate the service's access; a background service without a user cannot use delegated permissions. Option C is wrong because the device code flow is designed for devices with limited input capabilities (e.g., smart TVs, IoT) and still requires a signed-in user to authenticate interactively, not suitable for an unattended background service.

881
MCQmedium

You need to store temperature readings from IoT devices in Azure Table Storage. Each reading includes a device ID (string), timestamp (datetime), temperature value, and location. You must optimize for the query: "Retrieve all temperature readings for a specific device ID within a given one-hour time range." Which PartitionKey and RowKey combination should you use?

A.PartitionKey = DeviceId, RowKey = Timestamp
B.PartitionKey = Location, RowKey = DeviceId
C.PartitionKey = Temperature, RowKey = Timestamp
D.PartitionKey = DeviceId + Timestamp, RowKey = empty
AnswerA

This design is optimal for IoT data. The PartitionKey, `DeviceId`, groups all temperature readings from a specific device into a single partition, enabling highly efficient point queries or range queries for that device without scanning unrelated data. Within this partition, the `RowKey`, `Timestamp`, ensures that readings are stored in chronological order, which is crucial for performing fast and cost-effective time-based range queries (e.g., retrieving all readings for a device within a specific hour or day).

Why this answer

Azure Table Storage queries are most efficient when the PartitionKey and RowKey are chosen to match the query pattern. By using DeviceId as the PartitionKey, all readings for a specific device are stored in the same partition, enabling fast partition-level scans. Using Timestamp as the RowKey allows efficient range queries within a one-hour window using RowKey comparisons, which is the optimal design for time-range queries on a single device.

Exam trap

The trap here is that candidates often choose Option D, thinking that a composite PartitionKey will improve query performance, but in Azure Table Storage, a composite key in PartitionKey actually creates unique partitions per row, which prevents efficient range queries and forces point lookups, making it worse for time-range queries.

How to eliminate wrong answers

Option B is wrong because Location as PartitionKey scatters data across partitions, requiring a full table scan to filter by DeviceId and timestamp, which is inefficient. Option C is wrong because Temperature as PartitionKey is meaningless for the query; it does not group data by device, and timestamp as RowKey still requires scanning multiple partitions for a single device. Option D is wrong because concatenating DeviceId and Timestamp into PartitionKey creates a unique partition per reading, eliminating the benefit of partition-level grouping and forcing point queries instead of efficient range scans; an empty RowKey also violates the requirement that RowKey must be unique within a partition.

Page 11

Page 12 of 12