Microsoft Azure Developer Associate AZ-204 (AZ-204) — Questions 301–375

Why this answer

How to eliminate wrong answers

Option A is wrong because an Account SAS grants access to multiple services (blob, queue, table, file) and all resources under the storage account, making it too broad and not scoped to a single container. Option C is wrong because a stored access policy is not a type of SAS; it is a server-side policy that can be used to control SAS permissions and expiry, but the question asks for the type of SAS itself. Option D is wrong because a User delegation SAS is secured with Azure AD credentials and is used for operations like listing blobs or reading/writing with specific RBAC roles, but it is typically used for scenarios requiring finer-grained identity-based access, not for a simple time-limited upload-only SAS.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because CPU percentage scaling rule reacts to resource utilization after it has already increased, which is reactive and may not prevent slow response times during sudden request surges. Option C is wrong because memory percentage scaling rule is typically used for memory-bound workloads, not CPU-bound or request-driven scenarios, and memory often lags behind CPU as a scaling signal. Option D is wrong because custom scaling rules using Azure Monitor metrics require additional configuration and are not as straightforward or purpose-built as KEDA's HTTP scaler for request-based autoscaling in Container Apps.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure Key Vault secrets are designed for storing sensitive data (e.g., passwords, connection strings) and require explicit code changes to retrieve them via SDK calls or a managed identity, adding complexity for non-sensitive configuration settings. Option B is wrong because Azure DevOps variable groups are a build-time mechanism that injects values during the CI/CD pipeline, not a runtime configuration service; this would require modifying the build process and does not leverage Azure App Service's native environment-based settings. Option C is wrong because Azure App Configuration with feature flags is a centralized configuration service for managing feature toggles and hierarchical settings, but it is overkill for simple environment-specific key-value pairs and requires additional SDK integration in the application code.

Why this answer

How to eliminate wrong answers

Option A is wrong because a manual replica count only sets a fixed number of replicas and cannot scale to zero or dynamically scale based on queue length. Option B is wrong because an Availability Set is a feature for virtual machine high availability within a region, not applicable to Azure Container Apps which uses replica-based scaling. Option C is wrong because an Azure Front Door health probe is used for load balancing and routing traffic based on backend health, not for scaling container replicas based on queue metrics.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the hot access tier has higher storage costs than cool tier, which is unnecessary for data that is rarely updated and only queried daily on the last 30 days. Option B is wrong because Azure Table Storage with a timestamp partition key can lead to hot partitions (all writes go to the same partition) and does not support sub-second analytical queries on large ranges of data efficiently due to lack of indexing and parallel scan capabilities. Option C is wrong because Azure Cosmos DB with SQL API and automatic indexing is optimized for transactional workloads with low-latency point reads, not for large-range analytical scans; it incurs high RU costs for scanning billions of small entries, making it far more expensive than Blob Storage for this use case.

Why this answer

How to eliminate wrong answers

Option B (Archive storage account) is wrong because it is a storage account tier, not a blob type; it applies to the entire account and does not support object-level tiering—individual blobs cannot be moved between tiers within an Archive account. Option C (Page blob) is wrong because it is optimized for random read/write operations on virtual machine disks (VHDs) and has a maximum size of 8 TB, but it does not support object-level tiering and typically has higher latency for large binary object reads compared to block blobs. Option D (Append blob) is wrong because it is designed for append-only operations (e.g., logging) and does not support object-level tiering; it also has a maximum size of 195 GB, far below the 4.7 TB requirement.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Blob Storage triggers do not have a `leaseBlob` property for deduplication; blob leases are used for concurrency control, not for preventing duplicate processing of the same blob event, and Blob Storage triggers can miss events or fire duplicates without built-in deduplication. Option B is wrong because Event Grid triggers have a retry policy but lack built-in message deduplication; idempotency must be implemented manually in the function, and Event Grid does not guarantee exactly-once delivery, making duplicate handling error-prone. Option C is wrong because Logic Apps with a Blob Storage connector are not serverless in the same sense (they have higher latency and cost), and the connector does not provide message-level deduplication; retry policies on connectors do not ensure idempotent processing of duplicate blob events.

Why this answer

How to eliminate wrong answers

Option B is wrong because `maxMessages` is not a valid property of the `ServiceBusTrigger` attribute; the correct attribute property to control concurrency is `IsBatched` or `MaxConcurrentCalls`, but neither directly limits batch size to 1 for ordering. Option C is wrong because the Premium Plan provides higher throughput and predictable performance but does not inherently enforce single-message processing; ordering must be configured via `batchSize`. Option D is wrong because `maxDequeueCount` in `host.json` controls the number of times a message can be retried before being dead-lettered, not the concurrency or batch size.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because storing the connection string as plain text in an App Setting exposes the password in the Azure portal and configuration files, violating security best practices, and deployment slots do not automate rotation—they only swap environments, requiring manual password updates. Option C is wrong because managed identity can authenticate to Azure SQL Database without a password, but it does not eliminate the need for a connection string entirely; the connection string still contains the server and database name, and managed identity does not support automatic rotation of a password (it uses certificate-based authentication). Option D is wrong because ARM template secret references are resolved at deployment time, not at runtime, so rotating the secret in Key Vault would require a new deployment to update the connection string, failing the requirement to avoid redeployment.

Why this answer

How to eliminate wrong answers

Option B is wrong because Application Insights availability tests are designed to monitor the availability and responsiveness of HTTP endpoints, not to detect processing failures or exceptions within an Azure Function. Option C is wrong because Azure Service Health alerts notify you about service-level issues, outages, or planned maintenance affecting Azure services, not application-level exceptions in your function code. Option D is wrong because Azure Advisor provides proactive recommendations for best practices (e.g., performance, cost, reliability) but does not offer real-time alerting or automated restart capabilities based on exception metrics.

Why this answer

How to eliminate wrong answers

Option A is wrong because append blobs are optimized for append operations (e.g., logging) and do not support resumable uploads; if an append fails, you cannot easily resume without re-uploading the entire blob. Option C is wrong because the Put Blob API can only upload blobs up to 5 TB for block blobs, but it uploads the entire file in a single request, which is impractical for large files and does not support resumability; for files over 256 MB, Azure requires using block uploads. Option D is wrong because page blobs are designed for random read/write access (e.g., VHDs) and are not optimized for large file uploads; they do not provide a built-in mechanism for resuming interrupted uploads.

Why this answer

How to eliminate wrong answers

Option A is wrong because embedding the connection string in the container image as a configuration file violates the requirement to avoid storing secrets in the image; anyone with access to the image can extract the secret. Option B is wrong because storing the connection string in an environment variable in the container group still exposes the secret in plaintext within the container's runtime environment and requires manual management of the secret value. Option D is wrong because mounting a volume from Azure Key Vault using a secret volume still requires the container to have a connection string (or secret) to access Key Vault initially, and it introduces additional complexity without leveraging the simpler managed identity approach.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Azure Information Protection is a classification and labeling service for data protection policies, not an encryption mechanism for Azure Blob Storage at rest; it does not integrate with Azure Storage SSE for CMK. Option B is wrong because Azure Disk Encryption encrypts virtual machine disks (OS and data disks) using BitLocker or DM-Crypt, not Azure Blob Storage data; it is designed for IaaS VMs, not PaaS storage services. Option C is wrong because it specifies Microsoft-managed keys, which do not satisfy the customer-managed key requirement; automatic key rotation with Microsoft-managed keys is handled by Azure, but the customer cannot control the key material or rotation schedule.

Why this answer

How to eliminate wrong answers

Option B is wrong because the ASP.NET Core Diagnostics middleware is designed for developer exception pages and status code pages, not for implementing dependency-specific health checks with custom status codes like 503 or 400. Option C is wrong because Application Insights availability tests are used for monitoring the availability of a web endpoint from external locations, not for implementing an internal health endpoint that checks application dependencies and returns specific HTTP status codes. Option D is wrong because the built-in health check endpoint in Azure App Service only provides a basic ping check (returning 200 OK) and does not support custom dependency monitoring or returning 503 or 400 status codes.

Why this answer

How to eliminate wrong answers

Option A is wrong because Managed Identity authentication only works within the same tenant as the Logic App; it cannot be used to obtain tokens from a different Microsoft Entra ID tenant. Option B is wrong because the HTTP + Swagger connector is used to import an API definition for design-time validation and does not provide any OAuth 2.0 Client Credentials token acquisition capability. Option D is wrong because the Azure Key Vault - Get secret action retrieves a stored secret (like a client secret) but does not perform the OAuth 2.0 token exchange; you would still need a separate action to call the token endpoint and construct the Bearer token.

Why this answer

How to eliminate wrong answers

Option A is wrong because a shared access signature (SAS) does not use Azure RBAC; it uses a token-based delegation that requires manual token management and expiration, increasing administrative overhead. Option C is wrong because adding the user as a Storage Blob Data Reader at the storage account level grants access to all containers in the account, violating the requirement to scope access to a specific container. Option D is wrong because sharing the storage account key grants full administrative access to the entire storage account, bypassing RBAC entirely and creating a severe security risk.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting a public access level on the container would allow anonymous read access indefinitely, not for a limited two-hour period, and it does not control which application can read—it's open to anyone. Option C is wrong because a management group assignment is an Azure RBAC construct for organizing subscriptions and managing governance at scale; it does not provide time-bound, scoped access to blob containers. Option D is wrong because providing the storage account access key grants full administrative access to the entire storage account (including all containers, write/delete operations) and cannot be scoped to a single container or limited to two hours; it also violates the requirement that the application should not receive the account key.

Why this answer

How to eliminate wrong answers

Option B is wrong because subscription keys are used for APIM-level authentication and rate limiting, not for obtaining OAuth 2.0 tokens for backend APIs. Option C is wrong because `validate-jwt` only validates an incoming token from the client; it does not obtain or attach a token for the backend. Option D is wrong because named values store static secrets or configuration strings, not dynamically obtained tokens; manually storing a token would require frequent updates and defeats the purpose of managed identity.

Why this answer

How to eliminate wrong answers

Option A is wrong because using DeviceId_Timestamp as the RowKey does not support efficient range queries by timestamp; the query would need to scan all rows in the partition to filter by timestamp. Option C is wrong because PartitionKey = DeviceId scatters each device into its own partition, requiring a full table scan across all partitions to find devices in a specific city and timestamp range. Option D is wrong because RowKey = DeviceId does not allow efficient timestamp filtering; the query would still need to scan all rows in the city partition to find those within the last 24 hours.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because managed identity authentication on an HTTP action is used to authenticate the Logic App to the target API (e.g., using OAuth 2.0), not to retrieve a secret from Key Vault; setting the 'Audience' to the Key Vault URL would attempt to authenticate to Key Vault, not pass the API key in the header. Option C is wrong because Azure App Service application settings are not accessible from a Logic App via the 'appsetting' function; that function is specific to Azure Functions and App Service code, not Logic App workflow expressions. Option D is wrong because the 'Invoke an HTTP endpoint' action with Application Insights dependency tracking does not automatically retrieve or inject API keys; it only enables telemetry logging of the HTTP call, and the API key would still need to be manually provided and could be exposed in logs.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if a header not in the allowed headers list is included, the browser would send a preflight OPTIONS request and fail with a CORS error, but the question specifies a PUT request, which typically does not trigger a preflight unless custom headers are used; however, the exhibit shows allowed headers are set to '*', so header mismatch is unlikely. Option C is wrong because the CORS rule not including the DELETE method would only affect DELETE requests, not PUT requests; the error is for a PUT request, so method mismatch is irrelevant. Option D is wrong because exposedHeaders only controls which response headers the browser exposes to the client, not whether the request itself is allowed; missing exposed headers would not cause a CORS error on a PUT request.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Azure Blob Storage output binding writes data to blobs, not to Cosmos DB, so it cannot satisfy the requirement to write results to Cosmos DB. Option B is wrong because the Azure Cosmos DB input binding is used to read data from Cosmos DB before function execution, not to write output results. Option C is wrong because the Azure Storage Queue output binding writes messages to a queue, which is unrelated to writing results to Cosmos DB.

Why this answer

How to eliminate wrong answers

Option B is wrong because creating three separate Event Hubs and replicating events between them is unnecessary overhead and does not solve the independent consumption requirement; each pipeline would still need its own consumer group within each hub, and replication introduces latency and complexity. Option C is wrong because using a single consumer group forces all pipelines to share the same offset, meaning one pipeline's consumption progress (e.g., fast real-time aggregation) would advance the offset, causing other pipelines (e.g., slower archival) to miss events. Option D is wrong because Event Hubs Capture writes events to Azure Blob Storage or Data Lake Store in Avro format, but it is a one-way archival feature, not a mechanism for multiple independent consumers; pipelines would still need to read from the Event Hub directly for real-time processing, and Capture does not provide independent offset tracking.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because block blobs require managing block IDs and committing block lists, which adds overhead for frequent small writes (500 bytes each) and reduces write throughput for high-volume logging. Option C is wrong because page blobs are designed for random read/write access (like VHDs) and are priced higher per GB, making them cost-inefficient for sequential log storage. Option D is wrong because Azure Files shares are a fully managed file share service based on SMB protocol, not a blob type, and are not optimized for high-frequency append operations or cost-effective log storage.

Why this answer

How to eliminate wrong answers

Option B (Human interaction) is wrong because it involves waiting for external human approval via `WaitForExternalEvent`, not parallel execution of independent activities. Option C (Function chaining) is wrong because it executes activities sequentially, each depending on the previous output, which does not allow parallel execution. Option D (Monitor pattern) is wrong because it polls an external resource on a timer, not orchestrating parallel activity calls.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Application Insights Map visualizes dependencies between services (e.g., databases, external APIs) but does not provide line-by-line code execution timing. Option C is wrong because the Snapshot Debugger captures debug snapshots only when exceptions are thrown, not for slow performance without exceptions. Option D is wrong because creating a custom telemetry event requires modifying the application code and redeploying, which is not a built-in feature for diagnosing existing production slowness without prior instrumentation.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Always restart policy restarts the container regardless of the exit code, even on successful completions, which would incur unnecessary costs and is not aligned with the requirement to restart only on failure. Option C is wrong because the Never restart policy does not restart the container under any circumstances, so it would not automatically restart on a crash. Option D is wrong because Retry is not a valid restart policy for Azure Container Instances; the valid policies are Always, OnFailure, and Never.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because each system-assigned managed identity is unique per Function App, so you would have to grant the Cosmos DB role to each identity individually, and revoking or modifying access would require updating each role assignment separately. Option C is wrong because using a service principal with a client secret stored in Key Vault introduces secret management overhead and does not leverage managed identities; revoking access would require rotating the secret or modifying the service principal, not a single role assignment. Option D is wrong because storing the Cosmos DB connection string in App Configuration and referencing it from each Function App does not provide a central point to revoke or modify access—each app still uses the same static connection string, and revoking access would require changing the connection string and redeploying or updating each app's configuration reference.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because making deployment slot settings sticky (slot-specific) only ensures that configuration and connection strings remain with the slot after a swap; it does not provide any warm-up or automatic rollback functionality. Option C is wrong because swap with preview allows you to validate the staging slot before completing the swap, but it does not automatically roll back on errors; you must manually complete or cancel the swap, which does not meet the 'automatic rollback' requirement. Option D is wrong because manual swap with a warm-up script requires custom scripting and does not provide built-in automatic rollback on swap errors; the rollback would need to be manually orchestrated.

Why this answer

How to eliminate wrong answers

Option B is wrong because if the 'latest' tag did not exist, the error would be 'manifest not found' or 'image not found', not 'unauthorized: authentication required'. Option C is wrong because deployment slots are unrelated to registry authentication; the error is about pulling the image, not routing traffic to a slot. Option D is wrong because an incorrect `--docker-registry-server-url` would cause a 'connection refused' or 'name resolution failure' error, not an authentication error.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the Hot tier is designed for frequently accessed data and has higher storage costs than Cool, making it cost-inefficient for data accessed only a few times per month. Option C is wrong because the Archive tier requires a rehydration process (taking up to 15 hours) before data can be read, which fails the requirement that data must be available within seconds when requested. Option D is wrong because the Premium tier is optimized for low-latency access (sub-millisecond) and high transaction rates, but it incurs significantly higher costs than Cool and is over-provisioned for infrequently accessed profile pictures.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `CallActivityAsync` does not support any retry logic; if the activity throws an exception, the orchestration will fail immediately without retrying. Option C is wrong because `CallSubOrchestratorAsync` is used to call another orchestrator function, not an activity function, and it does not provide built-in retry configuration for transient failures. Option D is wrong because `CallHttpAsync` is used for making HTTP calls from orchestrator functions, not for calling activity functions, and it does not support the retry policy described in the question.

Why this answer

How to eliminate wrong answers

Option B is wrong because it uses StorageSharedKeyCredential with the storage account key, which violates the requirement to use Microsoft Entra ID credentials and exposes the account key. Option C is wrong because GenerateUserDelegationSas is not a method on BlobContainerClient; the correct approach requires explicitly calling GetUserDelegationKeyAsync on the BlobServiceClient and then building the SAS with BlobSasBuilder. Option D is wrong because ToSasQueryParameters returns a Uri query string, not a SAS token string; the correct method to generate the token string is GenerateSas on BlobSasBuilder.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because plain environment variables are stored in plaintext and are visible in the Azure portal and container logs, violating the security requirement. Option C is wrong because a public blob containing the password would be accessible to anyone with the URL, completely compromising the password's confidentiality. Option D is wrong because container command-line arguments are logged in the container's startup logs and can be viewed in the portal, making them visible and insecure.

Why this answer

How to eliminate wrong answers

Option B is wrong because Azure Container Registry is a private registry for storing and managing container images, not a runtime storage location for application logs; logs written to ACR would not be accessible from the container's file system and would not persist across restarts. Option C is wrong because Docker volumes in ACI are ephemeral and tied to the container's lifecycle — they are lost when the container is restarted or recreated, failing the persistence requirement. Option D is wrong because an environment variable only passes configuration data (like a log path string) into the container; it does not provide any actual storage mechanism for log data to persist or be accessed from the file system.

Why this answer

How to eliminate wrong answers

Option B (Page Blob) is wrong because page blobs are designed for random read/write access in 512-byte pages (e.g., VHDs for Azure VMs) and have higher storage costs and write latency due to sector alignment requirements, making them suboptimal for large file overwrites. Option C (Append Blob) is wrong because append blobs only support appending data to the end of the blob and do not allow overwriting existing content in place. Option D (Archive Blob) is wrong because archive blobs are for cold data with infrequent access, have high read latency (hours to rehydrate), and are not designed for frequent overwrites.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting batch size to 1 only limits how many messages are fetched at once, but does not prevent concurrent processing of multiple messages from the same partition—multiple function instances could still process them in parallel. Option C is wrong because the Consumption Plan does not automatically limit concurrency per partition; it only scales the number of function instances, which can still lead to concurrent processing of the same partition. Option D is wrong because a queue trigger (e.g., Storage Queue) does not support session-based ordering or partition-level concurrency control; it processes messages in a first-in-first-out manner but without guaranteed ordering or partition isolation.

Why this answer

How to eliminate wrong answers

Option B is wrong because Log Analytics is used for querying raw log data with Kusto Query Language (KQL), not for directly creating real-time metric dashboards from pre-aggregated metrics. Option C is wrong because Application Map provides a visual topology of service dependencies and transaction flow, not time-series charts of request counts or response times. Option D is wrong because Smart Detection uses machine learning to automatically detect anomalies and performance issues, but it does not allow you to build custom metric dashboards.

Why this answer

How to eliminate wrong answers

Option A is wrong because using a high block size (e.g., 100 MB) for small log entries (<1 KB) wastes storage and reduces write throughput due to the overhead of committing large blocks for tiny data. Option C is wrong because page blobs are designed for random read/write access (e.g., Azure VM disks) and are not optimized for append-only logging; they also incur higher costs due to premium storage pricing. Option D is wrong because while low block size reduces wasted space, block blobs still require each append to be staged as a separate block and then committed, adding latency and complexity compared to the native append operation of append blobs.

Why this answer

How to eliminate wrong answers

Option B is wrong because Azure CDN custom domain is a content delivery feature that caches and serves public endpoints, not a mechanism for outbound VNet access from an app. Option C is wrong because Application Gateway path routing is an inbound load-balancing and routing feature for HTTP traffic, not an outbound connectivity feature from App Service to a VNet. Option D is wrong because a Private Endpoint for the web app only provides inbound access from the VNet to the app, not outbound access from the app to resources in the VNet.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because deploying directly to production during business hours risks exposing users to a faulty release, causing 502 errors and downtime without any validation or rollback safety. Option C is wrong because restarting the App Service plan before each deployment does not prevent 502 errors; it causes all instances to restart simultaneously, leading to downtime and potential request failures. Option D is wrong because disabling health checks removes the mechanism that detects unhealthy instances, allowing faulty deployments to serve traffic and worsen 502 errors.

Why this answer

Why this answer