Courseiva

Microsoft Azure Developer Associate AZ-204 (AZ-204) — Questions 451525

881 questions total · 12pages · All types, answers revealed

Page 6

Page 7 of 12

Page 8
451
MCQmedium

An application calls a third-party shipping API through HTTP. The developer must implement retries without overwhelming the remote system during partial outages. Which retry pattern is best?

A.Immediate infinite retries
B.Retry only after restarting the application
C.Exponential backoff with jitter and a maximum retry limit
D.Disable all timeout settings
AnswerC

Backoff with jitter reduces retry storms and gives the remote service time to recover.

Why this answer

Exponential backoff with jitter and a maximum retry limit is the best pattern because it progressively increases the delay between retries, preventing the client from overwhelming the third-party shipping API during partial outages. Jitter randomizes the delay to avoid thundering herd problems where multiple clients retry simultaneously, and the maximum retry limit ensures the system does not retry indefinitely, preserving resources and allowing for graceful degradation.

Exam trap

The trap here is that candidates may choose immediate infinite retries (Option A) thinking it ensures delivery, but they overlook the risk of overwhelming the remote system and violating rate limits, which is explicitly tested in the context of third-party API consumption.

How to eliminate wrong answers

Option A is wrong because immediate infinite retries would flood the third-party API with requests during a partial outage, likely exacerbating the outage or triggering rate limiting and throttling responses (e.g., HTTP 429). Option B is wrong because retrying only after restarting the application introduces unnecessary downtime and delays recovery; the application should handle transient faults programmatically without requiring a restart. Option D is wrong because disabling all timeout settings would cause the application to hang indefinitely on unresponsive requests, leading to resource exhaustion (e.g., thread pool starvation) and no mechanism to detect or recover from failures.

452
MCQeasy

You are developing a web app that uses Azure Key Vault to retrieve secrets. The app must authenticate using a system-assigned managed identity. Which endpoint should you use to get an access token for Key Vault?

A.https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
B.http://169.254.169.254/metadata/identity/oauth2/token?resource=https://vault.azure.net&api-version=2018-02-01
C.https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vaultName}
D.https://graph.microsoft.com/v1.0/me
AnswerB

This is the correct endpoint for acquiring an access token using an Azure Managed Identity. The Azure Instance Metadata Service (IMDS) is a REST endpoint accessible only from within an Azure VM or other Azure compute resource, providing information about the running instance. When a managed identity is enabled, IMDS exposes a specific endpoint (169.254.169.254) that the resource can query to securely obtain an OAuth 2.0 access token for a specified resource, such as Azure Key Vault, without needing to manage credentials.

Why this answer

It uses the Azure Instance Metadata Service (IMDS) endpoint, which is the standard way for Azure resources with a system-assigned managed identity to obtain an access token. The request includes the resource parameter set to 'https://vault.azure.net' to specify Key Vault as the target service, and the API version '2018-02-01' is required for the IMDS token endpoint. This token is then used to authenticate to Key Vault without storing any credentials in the application code.

Exam trap

The trap here is that candidates often confuse the IMDS endpoint with the standard Azure AD OAuth endpoint (Option A), not realizing that managed identity authentication uses a special non-routable IP and requires the 'resource' parameter instead of 'scope'.

How to eliminate wrong answers

Option A is wrong because it is the standard Azure AD OAuth 2.0 token endpoint used for client credentials or authorization code flows with a registered application, not for managed identity authentication; it requires a client ID and secret, which defeats the purpose of using a managed identity. Option C is wrong because it is the Azure Resource Manager REST API endpoint for managing Key Vault resources (e.g., creating or updating a vault), not for obtaining an access token to retrieve secrets. Option D is wrong because it is the Microsoft Graph API endpoint for accessing user profile information, which is unrelated to Key Vault authentication and does not provide tokens for Azure services.

453
MCQeasy

You are building a web application that stores user-uploaded images in Azure Blob Storage. The application requires that images be accessible only via a time-limited URL. Which security mechanism should you use?

A.Use storage account access keys in the application code.
B.Generate a shared access signature (SAS) token for each blob.
C.Assign the 'Storage Blob Data Reader' role to the application's managed identity.
D.Use Azure Key Vault to store and retrieve the storage account key.
AnswerB

Generating a Shared Access Signature (SAS) token for each blob is the most appropriate solution for providing secure, time-limited access to specific storage resources. A SAS token is a URI that grants restricted permissions to Azure Storage resources for a specified interval or with specific permissions, such as read or write. This allows the application to provide users with temporary, granular access to upload or retrieve individual blobs without exposing the storage account's primary keys, aligning perfectly with the need for controlled, temporary access.

Why this answer

A shared access signature (SAS) token provides delegated, time-limited access to a specific blob without exposing the storage account key. By generating a SAS token with an expiration time, you can enforce that the image URL is only valid for a limited period, meeting the requirement exactly. This is the standard Azure mechanism for granting granular, time-bound access to blob storage resources.

Exam trap

The trap here is that candidates often confuse persistent access control methods (like RBAC roles or account keys) with the time-limited, delegated access that only a SAS token provides, leading them to pick options that secure the key but do not enforce an expiration on the URL.

How to eliminate wrong answers

Option A is wrong because embedding storage account access keys in application code grants full, unrestricted access to the entire storage account and never expires, violating the time-limited requirement. Option C is wrong because assigning the 'Storage Blob Data Reader' role via managed identity provides persistent, role-based access without any built-in time limitation, so it cannot enforce a time-bound URL. Option D is wrong because storing the storage account key in Azure Key Vault secures the key but does not create a time-limited URL; you would still need to generate a SAS token from that key to achieve the time-bound requirement.

454
MCQmedium

A long-running claims processing function must process thousands of independent files. The developer wants status tracking, checkpoints, and replay-safe orchestration. Which Azure Functions capability should be used?

A.Durable Functions orchestrator
B.Timer trigger only
C.Azure Policy remediation
D.Blob lifecycle management
AnswerA

Durable Functions orchestrators are specifically designed for complex, stateful, and long-running workflows, making them ideal for processing thousands of claims reliably. They provide built-in checkpointing and durable execution history, ensuring that the workflow state is preserved even across infrastructure failures or reboots. This allows the claims processing function to pause and resume, managing the progress of each claim without losing context and coordinating multiple steps effectively over extended periods.

Why this answer

Durable Functions orchestrator is correct because it provides built-in support for status tracking, checkpoints (via event sourcing), and replay-safe orchestration, which are essential for a long-running claims processing function that must handle thousands of independent files reliably. The orchestrator function manages state and execution flow, automatically saving progress and allowing replay from checkpoints in case of failures, ensuring exactly-once processing semantics.

Exam trap

The trap here is that candidates may confuse a simple timer-triggered function (which can process files on a schedule) with the need for stateful orchestration, overlooking that Durable Functions is the only option that provides built-in checkpointing and replay safety for long-running, fault-tolerant workflows.

How to eliminate wrong answers

Option B is wrong because a Timer trigger only invokes a function on a schedule and does not provide any state management, checkpointing, or replay capabilities for long-running workflows. Option C is wrong because Azure Policy remediation is designed for enforcing compliance rules and automatically remediating non-compliant resources, not for orchestrating business logic or tracking processing status. Option D is wrong because Blob lifecycle management automates tiering or deletion of blobs based on age or tags, but it cannot manage orchestration state, checkpoints, or replay logic for a claims processing workflow.

455
MCQhard

Refer to the exhibit. A developer deploys this ARM template to create a blob container. Later, they attempt to upload a file to the container using a SAS token. What is the result?

A.The upload succeeds only if the SAS token includes read permission.
B.The container is not created because publicAccess is set to None.
C.The upload succeeds if the SAS token has write permission.
D.The upload fails because the container is private.
AnswerC

To successfully upload a blob to an Azure Storage container, the Shared Access Signature (SAS) token must explicitly include `Write` permission. This permission authorizes the client to create new blobs or overwrite existing ones within the specified container. The SAS token provides authenticated access, which overrides the container's public access setting, enabling uploads even to private containers.

Why this answer

The ARM template creates a blob container with `publicAccess` set to `None`, meaning no anonymous public access. However, a SAS token with write permission grants delegated access to the container, bypassing the public access setting. Therefore, the upload succeeds because the SAS token provides the necessary authorization, regardless of the container's public access level.

Exam trap

The trap here is that candidates mistakenly think setting `publicAccess` to `None` blocks all access, including SAS tokens, when in fact SAS tokens provide explicit delegated access that overrides the public access setting.

How to eliminate wrong answers

Option A is wrong because the SAS token needs write permission, not read permission, to upload a file; read permission alone would not allow the upload operation. Option B is wrong because setting `publicAccess` to `None` does not prevent container creation; it only disables anonymous public access, and the container is created successfully. Option D is wrong because the container being private (no public access) does not cause the upload to fail when a valid SAS token with write permission is used; SAS tokens are designed to grant access to private containers.

456
MCQhard

A storage account for thumbnail metadata must allow an application to read only blobs under one container for two hours. The application should not receive the account key. What should be issued?

A.A public access level on the container
B.A service SAS scoped to the container with read permission and expiry
C.A management group assignment
D.The storage account access key
AnswerB

A service SAS can grant limited, time-bound permissions without exposing account keys.

Why this answer

A service SAS scoped to a container with read permission and an expiry of two hours is the correct approach because it provides delegated, time-limited access to specific blobs under that container without exposing the storage account key. The SAS token is generated using the account key but the application only receives the token, not the key itself, ensuring the key remains secure. This meets the requirement for read-only access to a single container for a limited duration.

Exam trap

The trap here is that candidates often confuse a service SAS with a public access level or account key, failing to recognize that a SAS provides granular, time-bound delegation without exposing the account key, while public access is permanent and account keys grant full control.

How to eliminate wrong answers

Option A is wrong because setting a public access level on the container grants anonymous read access to all blobs in that container indefinitely, with no time restriction and no way to revoke access without changing the container's ACL, which violates the two-hour limit and the requirement to avoid exposing the account key. Option C is wrong because a management group assignment controls access at the Azure subscription or management group level for administrative operations, not at the blob or container level for data operations, and it cannot grant time-limited read access to blobs. Option D is wrong because providing the storage account access key grants full administrative access to all storage account operations (read, write, delete) across all containers and services, with no time restriction, which is excessive and insecure for the stated requirement.

457
Multi-Selecthard

An Azure Functions report export service processes Service Bus messages. The function sometimes fails after partially completing work. Which two practices improve correctness?

Select 2 answers
A.Use dead-letter handling for repeatedly failing messages
B.Store connection strings in source code
C.Disable retries for all messages
D.Make the handler idempotent
AnswersA, D

Dead-letter queues isolate messages that cannot be processed after retries.

Why this answer

Azure Functions can use dead-letter handling to isolate messages that repeatedly fail processing, preventing them from blocking the queue and allowing investigation without data loss. This is a standard pattern for Service Bus triggered functions to manage poison messages gracefully.

Exam trap

The trap here is that candidates often confuse disabling retries with improving correctness, when in fact retries with dead-lettering and idempotent handlers are the correct reliability patterns for Service Bus triggered functions.

458
MCQeasy

You are configuring an Azure App Service web app to authenticate users with Microsoft Entra ID. You need to ensure that only users from your organization's tenant can access the app. Which setting should you configure?

A.Set the Issuer URL to https://login.microsoftonline.com/common/v2.0
B.Set the Client ID to the application's Application ID.
C.Set the Allowed token audiences to include the app's Application ID URI.
D.Set the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0
AnswerD

Setting the Issuer URL to https://login.microsoftonline.com/{tenant-id}/v2.0 is the correct method to restrict authentication to a specific Azure AD tenant. The Issuer URL, which corresponds to the 'iss' claim in a JWT, identifies the security token service that issued the token. By specifying a unique {tenant-id} (or a verified domain name) in this URL, the application is configured to only trust and accept tokens issued by that particular Azure AD instance, thereby enforcing single-tenant access control.

Why this answer

Setting the Issuer URL to `https://login.microsoftonline.com/{tenant-id}/v2.0` restricts token validation to only tokens issued by your specific Microsoft Entra ID tenant. This ensures that only users from your organization's tenant can authenticate, as the app will reject tokens from other tenants or the common endpoint.

Exam trap

The trap here is that candidates often confuse the Issuer URL with the Client ID or Allowed token audiences, thinking that setting the Client ID alone will restrict access to a specific tenant, when in fact it only identifies the app, not the tenant.

How to eliminate wrong answers

Option A is wrong because using `https://login.microsoftonline.com/common/v2.0` as the Issuer URL allows tokens from any Microsoft Entra ID tenant or personal Microsoft accounts, which would permit users outside your organization to access the app. Option B is wrong because setting the Client ID to the application's Application ID is required for the app to identify itself to Microsoft Entra ID, but it does not restrict access to a specific tenant; it only ensures the correct app is being used during authentication. Option C is wrong because configuring the Allowed token audiences to include the app's Application ID URI ensures that the token is intended for your app, but it does not enforce tenant-level restrictions; it only validates the token's audience claim.

459
MCQhard

You are designing a microservices solution using Azure Container Apps. One service must be exposed externally via HTTPS, while others should only be accessible within the environment. You need to configure networking for this scenario. What should you do?

A.Enable external ingress at the environment level and use network policies to restrict access.
B.Deploy the external service in a different environment and use an internal load balancer.
C.Configure each container app's ingress: set the external service to 'External' and the internal services to 'Internal'.
D.Use a Dapr sidecar to route requests between services.
AnswerC

Azure Container Apps provides granular control over ingress at the individual container app level, making this the correct and most efficient solution. For the external service, configuring its ingress as 'External' makes it publicly accessible via a fully qualified domain name (FQDN) generated by the platform. Conversely, setting the ingress for internal services to 'Internal' ensures they are only reachable by other container apps within the same environment, or via VNet integration, without exposing them to the public internet. This approach directly addresses the requirement for mixed external and internal access within a single, unified environment.

Why this answer

Azure Container Apps allows you to control ingress at the individual container app level. Setting the external service's ingress to 'External' makes it reachable from the internet via HTTPS, while setting internal services to 'Internal' restricts access to only within the Container Apps environment, using the internal FQDN. This provides the required isolation without needing separate environments or complex network policies.

Exam trap

The trap here is that candidates may think network policies or separate environments are needed for isolation, but Azure Container Apps provides per-app ingress control as a simpler and more direct solution.

How to eliminate wrong answers

Option A is wrong because Azure Container Apps does not support network policies at the environment level; ingress is configured per container app, not globally. Option B is wrong because deploying the external service in a different environment would require separate management and an internal load balancer is not used for external HTTPS exposure; the external service should be in the same environment with external ingress enabled. Option D is wrong because Dapr sidecars handle service-to-service communication and state management, not ingress or network exposure control.

460
MCQhard

A company uses Azure Cosmos DB for a global e-commerce platform. They need to query product inventory across multiple regions with low latency. The data is partitioned by product category. Some queries filter on category and price range. What indexing policy should be configured to optimize these queries?

A.Use a wildcard index for all properties.
B.Create a composite index with (category, price).
C.Add a hash index on category and a range index on price.
D.Enable spatial index on price.
AnswerB

Creating a composite index on `(category, price)` is the optimal solution for queries that filter, sort, or combine operations on both these fields efficiently. This index allows Azure Cosmos DB to quickly locate documents matching specific categories and price ranges, drastically reducing RU/s consumption and query latency. It provides a pre-sorted structure that accelerates multi-field filtering and `ORDER BY` clauses, making it ideal for e-commerce product searches.

Why this answer

A composite index on (category, price) allows Cosmos DB to efficiently satisfy queries that filter on both fields in a single index seek, avoiding a full scan. Composite indexes are designed for multi-property filters and sort orders, which directly matches the requirement to query by category and price range with low latency.

Exam trap

The trap here is that candidates confuse Cosmos DB indexing with SQL Server indexing, assuming a hash index on a single property is valid, when Cosmos DB only supports range (default) and spatial index types for single properties.

How to eliminate wrong answers

Option A is wrong because a wildcard index indexes all properties indiscriminately, which increases RU consumption and storage overhead without optimizing multi-property filter queries like category + price. Option C is wrong because Cosmos DB does not support a 'hash index' on a single property; the indexing types are consistent (range) or spatial, and a hash index is a SQL Server concept, not applicable here. Option D is wrong because a spatial index is used for geospatial queries (e.g., points, polygons), not for numeric range filtering on price.

461
MCQeasy

You are developing an application that needs to retrieve secrets from Azure Key Vault. The application will run as an Azure Functions app. Which authentication method should you use to access Key Vault?

A.Use a client certificate stored in the function app
B.Use a system-assigned managed identity
C.Use the Key Vault connection string from app settings
D.Use the storage account access key from the function app
AnswerB

A system-assigned managed identity provides an Azure Function with an automatically managed identity in Microsoft Entra ID, directly tied to the resource's lifecycle. This identity can then be granted specific, fine-grained permissions to access Azure Key Vault secrets, certificates, or keys without needing to store any credentials (like connection strings or client certificates) in the function app's configuration. This approach adheres to the principle of least privilege and significantly enhances security by eliminating the burden of credential rotation.

Why this answer

A system-assigned managed identity is the recommended authentication method for Azure Functions to access Key Vault because it eliminates the need to store credentials in code or configuration. When enabled, Azure automatically creates a service principal in Azure AD for the function app, and the function can authenticate to Key Vault using this identity via the Azure Identity SDK (e.g., DefaultAzureCredential). This approach is secure, fully managed, and aligns with the principle of least privilege.

Exam trap

The trap here is that candidates may confuse Key Vault authentication with storage account access methods, or assume that a connection string or certificate is required, when in fact managed identities are the preferred and most secure approach for Azure-hosted services.

How to eliminate wrong answers

Option A is wrong because a client certificate stored in the function app introduces certificate management overhead and potential exposure; managed identities are simpler and more secure for Azure-hosted services. Option C is wrong because Key Vault does not use connection strings—it uses URIs and authentication via Azure AD tokens, not a connection string. Option D is wrong because storage account access keys are for authenticating to Azure Storage, not Key Vault, and using them would be a security anti-pattern for secret retrieval.

462
MCQmedium

You need to securely transfer an on-premises database backup to Azure Blob Storage. The backup file is 500 GB. You have limited bandwidth (10 Mbps) and need the transfer to complete within 24 hours. What is the best solution?

A.Use Azure File Sync to replicate the backup to Azure Files.
B.Use Azure Data Box to physically ship the data to Azure.
C.Use AzCopy to copy the backup file directly to Blob Storage.
D.Set up an ExpressRoute connection and use AzCopy.
AnswerB

Azure Data Box is a robust, secure physical appliance specifically engineered for offline data transfer of terabytes to petabytes of data into Azure Blob Storage or Azure Files. When on-premises network bandwidth is insufficient or unreliable for large datasets, physically shipping the encrypted device directly to an Azure datacenter completely bypasses network limitations, making it the most efficient and secure method for initial bulk data ingestion within a tight time requirement.

Why this answer

Given the 500 GB backup file and a 10 Mbps bandwidth limit, the theoretical maximum transfer time over the internet is approximately 500 GB * 8 bits/byte / (10 Mbps) = 400,000 seconds ≈ 111 hours, far exceeding the 24-hour requirement. Azure Data Box is the best solution because it allows you to physically ship the data on a secure, ruggedized device, bypassing network constraints entirely and ensuring the transfer completes within the required timeframe.

Exam trap

The trap here is that candidates may overlook the bandwidth calculation and assume AzCopy or ExpressRoute can handle the transfer within 24 hours, failing to recognize that even with a dedicated connection, the raw throughput is insufficient for 500 GB at 10 Mbps.

How to eliminate wrong answers

Option A is wrong because Azure File Sync is designed for synchronizing file shares over a network, not for bulk data transfer of a single large backup file; it would still be constrained by the 10 Mbps bandwidth and would not meet the 24-hour deadline. Option C is wrong because AzCopy relies on network bandwidth; at 10 Mbps, transferring 500 GB would take over 111 hours, far exceeding the 24-hour limit. Option D is wrong because ExpressRoute provides a dedicated private connection but does not increase bandwidth beyond the 10 Mbps limit; the transfer would still take over 111 hours, failing the time constraint.

463
MCQmedium

You are deploying an Azure App Service using an ARM template. After deployment, you find that the application settings are not applied. What is the most likely issue?

A.The resource is missing a dependsOn property for the parent site
B.The resource type should be 'Microsoft.Web/sites/appsettings'
C.The apiVersion is outdated, use '2021-02-01'
D.The property 'MyApp:Setting1' uses a colon, which is not allowed
AnswerA

When deploying nested resources like application settings (Microsoft.Web/sites/config) for an Azure App Service, it is crucial to explicitly define a dependency on the parent Microsoft.Web/sites resource. Without the dependsOn property, Azure Resource Manager (ARM) might attempt to deploy the child configuration resource before the parent App Service instance has been fully provisioned and is ready to accept configuration changes. This can lead to deployment failures, as the target parent resource for the settings would not yet exist or be in a stable state.

Why this answer

When deploying application settings via an ARM template, the 'Microsoft.Web/sites/config' resource (which contains the appsettings) must have a 'dependsOn' property referencing the parent 'Microsoft.Web/sites' resource. Without this dependency, Azure Resource Manager may attempt to apply the settings before the site exists, causing the settings to be silently ignored or not applied. This is a common deployment ordering issue.

Exam trap

The trap here is that candidates often focus on syntax errors (like colons or resource types) rather than the implicit deployment ordering requirement, missing that the 'dependsOn' property is mandatory for child resources to ensure they are applied after the parent site exists.

How to eliminate wrong answers

Option B is wrong because the correct resource type for application settings is 'Microsoft.Web/sites/config' with the name 'appsettings', not 'Microsoft.Web/sites/appsettings'. Option C is wrong because while apiVersion matters, an outdated version would typically cause a validation error, not silent failure of settings application; the core issue is the missing dependency. Option D is wrong because colons are allowed in App Service application setting names; they are commonly used for .NET Core configuration keys like 'MyApp:Setting1'.

464
MCQeasy

You need to send email notifications from an Azure Function app when a new user registers in your application hosted on Azure App Service. Which Azure service should you use to send the emails?

A.Microsoft 365 SMTP relay
B.Azure Communication Services
C.SendGrid
D.Azure Logic Apps
AnswerC

SendGrid is a cloud-based email service suitable for transactional emails.

Why this answer

SendGrid is a cloud-based email delivery service that integrates directly with Azure Functions via an output binding, making it the simplest and most cost-effective option for sending transactional emails like registration notifications. It handles SMTP relay, deliverability, and scaling without requiring a dedicated email server or complex configuration.

Exam trap

The trap here is that candidates might choose Azure Communication Services because it now supports email, but SendGrid is still the recommended and simplest option for transactional emails from Azure Functions due to its native output binding and lower cost for high volumes. Alternatively, candidates might overcomplicate the solution by choosing Logic Apps when a simple output binding suffices.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 SMTP relay requires a licensed Microsoft 365 mailbox and is designed for internal organizational email, not for high-volume transactional emails from an Azure Function; it also lacks native Azure Functions output binding support. Option B is wrong because Azure Communication Services is focused on communication APIs (SMS, voice, chat) and does not include a built-in email sending capability; it would require additional integration with an email provider. Option D is wrong because Azure Logic Apps is an orchestration service that can send emails via connectors, but it is not the direct service for sending emails from a Function; using Logic Apps would add unnecessary complexity and cost compared to the simpler SendGrid output binding.

465
MCQhard

You query Application Insights with the KQL query in the exhibit. The chart shows a spike in 500 errors at 2:00 PM. What is the next step to diagnose the cause?

A.Check availability tests for the same period
B.Query exceptions and traces for the 2:00 PM hour
C.Scale up the App Service plan
D.Run a profiler on the 2:00 PM time range
AnswerB

Querying "exceptions" and "traces" tables in Application Insights for the specific 2:00 PM hour is the most effective diagnostic step. The "exceptions" table captures details of unhandled exceptions thrown by the application, including stack traces and error messages, directly indicating code failures. Correlating these with "traces" (custom log messages) provides crucial contextual information, such as variable states or execution flow leading up to the exception, enabling a precise root cause analysis.

Why this answer

When a spike in 500 errors is detected in Application Insights, the next logical step is to query exceptions and traces for the specific time period (2:00 PM). This allows you to correlate the error count with detailed exception messages, stack traces, and dependency calls, which directly reveal the root cause of the failures. KQL queries like `exceptions | where timestamp between (datetime(14:00) .. datetime(15:00))` or joining with `traces` provide the granular data needed for diagnosis.

Exam trap

The trap here is that candidates confuse diagnostic steps with remediation actions, choosing to scale up (Option C) or run a profiler (Option D) instead of first investigating the actual error data via exceptions and traces.

How to eliminate wrong answers

Option A is wrong because availability tests measure endpoint responsiveness and uptime from external locations, not the internal server-side errors (500s) shown in the chart; they would not provide exception details. Option C is wrong because scaling up the App Service plan is a reactive scaling action, not a diagnostic step—it does not help identify the cause of the errors and may waste resources if the issue is code-related. Option D is wrong because the Application Insights Profiler captures performance traces for slow requests, not for error diagnostics; it is designed for latency analysis, not for examining exception details or error causes.

466
MCQeasy

You are deploying a function app that processes sensitive data. You need to ensure that all function app secrets (e.g., connection strings) are stored securely and automatically rotated. Which service should you use?

A.Azure Key Vault
B.Azure Managed Identity
C.Azure App Configuration
D.Azure DevOps Variable Groups
AnswerA

Key Vault securely stores secrets and supports automatic rotation.

Why this answer

Azure Key Vault is the correct service because it provides centralized, hardware-backed storage for secrets such as connection strings, API keys, and certificates. It supports automatic rotation policies via integration with Azure Event Grid and can be triggered by expiration events or custom logic, ensuring secrets are rotated without manual intervention. Function apps can securely reference Key Vault secrets using a managed identity, eliminating the need to store secrets in code or configuration files.

Exam trap

The trap here is that candidates often confuse Azure Managed Identity (an authentication method) with a secret storage service, or they assume Azure App Configuration can handle secret rotation, when in fact it lacks the security guarantees and rotation features of Key Vault.

How to eliminate wrong answers

Option B is wrong because Azure Managed Identity is an authentication mechanism that provides an automatically managed service principal for Azure resources, not a secret storage or rotation service. Option C is wrong because Azure App Configuration is designed for managing application configuration settings and feature flags, but it does not natively support automatic secret rotation or hardware-backed security. Option D is wrong because Azure DevOps Variable Groups store secrets in Azure DevOps, but they lack native automatic rotation capabilities and are not integrated with Azure's key management infrastructure.

467
MCQmedium

An application stores sensor readings in Azure Table Storage. Each sensor produces thousands of readings per hour. Queries always filter by sensor ID and time range. A developer needs to choose the partition key and row key. Which design best balances query performance and write throughput?

A.Partition key: sensor ID; row key: ISO timestamp of the reading
B.Partition key: a single constant ('all-sensors'); row key: sensor ID + timestamp
C.Partition key: timestamp (rounded to the hour); row key: sensor ID
D.Partition key: random GUID per reading; row key: timestamp
AnswerA

This design effectively leverages Azure Table Storage's partitioning strategy. Grouping all readings for a specific sensor ID within a single partition ensures efficient retrieval of all data related to that sensor, as queries can target a specific partition. Using an ISO timestamp as the row key provides natural chronological ordering within the partition, enabling highly performant time-range queries for a given sensor without scanning unrelated data. This combination optimizes both data locality and query efficiency for typical IoT sensor data access patterns.

Why this answer

It uses sensor ID as the partition key, which ensures all readings for a given sensor are stored in the same partition, enabling efficient range queries by row key (timestamp). This design avoids hot partitions by distributing writes across different sensors, while the row key allows fast point lookups and range scans within a time window, balancing query performance and write throughput.

Exam trap

The trap here is that candidates often choose a partition key that groups data by time (Option C) to optimize time-range queries, but they overlook that this creates a hot partition for all sensors in that time window, severely limiting write throughput.

How to eliminate wrong answers

Option B is wrong because using a single constant partition key ('all-sensors') forces all writes and queries into one partition, creating a hot partition that throttles throughput and degrades performance. Option C is wrong because using timestamp rounded to the hour as the partition key can cause all sensors' data for the same hour to land in the same partition, leading to write contention and poor query performance when filtering by sensor ID (which requires a full partition scan). Option D is wrong because using a random GUID as the partition key scatters each reading across partitions, making queries that filter by sensor ID and time range inefficient (they must scan all partitions) and defeating the purpose of partition key design.

468
MCQeasy

Your company stores API keys and connection strings in Azure Key Vault. You need to grant an Azure Function read access to these secrets using the principle of least privilege. Which identity type should you assign to the Function App?

A.System-assigned managed identity
B.User-assigned managed identity
C.Service principal
D.Access policy on the Key Vault
AnswerA

A system-assigned managed identity is automatically created and managed by Azure, directly tied to the lifecycle of a single Azure resource, such as a Virtual Machine or App Service. This identity can be granted specific Azure Key Vault access policies, allowing the resource to securely retrieve secrets without any hardcoded credentials or manual secret rotation. It inherently adheres to the principle of least privilege and offers the simplest, most secure method for a single resource to access Key Vault.

Why this answer

A system-assigned managed identity is the correct choice because it is directly tied to the lifecycle of the Azure Function, automatically managed by Azure, and requires no manual credential rotation. It provides the most restrictive scope (only that specific Function App) and adheres to the principle of least privilege by granting access only to the identity that needs it, without the overhead of managing a separate identity or service principal.

Exam trap

The trap here is that candidates often confuse 'access policy' (a permission assignment) with an 'identity type,' or they incorrectly assume a user-assigned managed identity is always more flexible and thus better, overlooking that a system-assigned identity is more restrictive and simpler for a single-resource scenario.

How to eliminate wrong answers

Option B is wrong because a user-assigned managed identity is a standalone resource that can be shared across multiple Azure services, which violates the principle of least privilege by potentially granting broader access than necessary. Option C is wrong because a service principal requires manual credential management (secrets or certificates) and is typically used for external applications or automation, not for a first-party Azure resource like a Function App where a managed identity is simpler and more secure. Option D is wrong because an access policy on the Key Vault is not an identity type; it is a permission assignment mechanism that must be applied to an identity (such as a managed identity or service principal), so it cannot be the identity type itself.

469
MCQmedium

You are building an Azure Logic App that must call an external API that uses the OAuth 2.0 authorization code grant. The API requires the user to sign in interactively to grant consent. You want to minimize development effort and securely manage the token lifecycle. Which built-in action and authentication method should you use?

A.Use the 'HTTP' action with 'OAuth 2.0' authentication and configure the authorization endpoint, client ID, and client secret.
B.Use the 'HTTP + Swagger' action with 'Identity Provider' authentication.
C.Use the 'API Connection' action with a custom connector that uses OAuth 2.0.
D.Use the 'HTTP' action with 'Managed identity' authentication.
AnswerA

The 'HTTP' action in Azure Logic Apps is highly versatile and directly supports the OAuth 2.0 authorization code grant flow. By configuring the authorization endpoint, client ID, and client secret, the Logic App can initiate the OAuth flow, handle user consent, and acquire an access token to authenticate requests to the external API. This built-in capability minimizes development effort for integrating with standard OAuth 2.0 protected services.

Why this answer

The 'HTTP' action with 'OAuth 2.0' authentication type in Azure Logic Apps is specifically designed to handle the authorization code grant flow, including interactive user consent. It manages the token lifecycle (acquisition, refresh, and storage) automatically, minimizing development effort. You only need to configure the authorization endpoint, client ID, and client secret, and the runtime handles the redirect and token exchange.

Exam trap

The trap here is that candidates often confuse 'Managed identity' (which is for Azure AD resources without user interaction) with OAuth 2.0 flows that require interactive consent, or they overcomplicate the solution by choosing a custom connector when the built-in 'HTTP' action already supports the authorization code grant natively.

How to eliminate wrong answers

Option B is wrong because the 'HTTP + Swagger' action with 'Identity Provider' authentication is used for calling APIs described by a Swagger/OpenAPI definition, not for OAuth 2.0 authorization code grant with interactive consent; it relies on a pre-configured identity provider (like Azure AD) and does not support the interactive user consent flow. Option C is wrong because using an 'API Connection' action with a custom connector that uses OAuth 2.0 requires you to build and manage a custom connector, which increases development effort and does not minimize it; the built-in 'HTTP' action is simpler. Option D is wrong because 'Managed identity' authentication is intended for authenticating to Azure resources (e.g., Azure Key Vault, Azure SQL) without user interaction, and it cannot handle the OAuth 2.0 authorization code grant that requires interactive user consent.

470
MCQhard

You are querying Azure Monitor metrics using Kusto Query Language (KQL). The query is supposed to return average metric values per hour per resource provider, but it returns no results. What is the most likely issue?

A.The ORDER BY clause should be before GROUP BY.
B.The 'bin' function is used incorrectly; it should be 'bin(TimeGenerated, 1h)' without the alias.
C.The table name should be 'AzureMetrics' instead of 'metrics'.
D.The GROUP BY clause cannot include a computed column like 'bin'.
AnswerC

Azure Monitor resource metrics, when ingested into a Log Analytics workspace, are specifically stored in the 'AzureMetrics' table. The table name 'metrics' is not a standard or recognized table for this type of data within a Log Analytics workspace. Therefore, any KQL query attempting to retrieve Azure Monitor metrics must explicitly reference 'AzureMetrics' to access the relevant time-series data and associated dimensions.

Why this answer

C is correct because the Azure Monitor metrics table is named 'AzureMetrics', not 'metrics'. When querying Azure Monitor metrics using KQL, referencing the wrong table name will result in no results being returned, as the query engine cannot find the specified table.

Exam trap

The trap here is that candidates may assume the table is simply named 'metrics' based on general database conventions, but Azure Monitor specifically uses 'AzureMetrics' as the table name for metric data.

How to eliminate wrong answers

Option A is wrong because ORDER BY is typically placed after GROUP BY in KQL, and the order of clauses does not affect whether results are returned; it only affects sorting. Option B is wrong because 'bin(TimeGenerated, 1h)' is a valid syntax and does not require an alias; the alias is optional and does not cause the query to return no results. Option D is wrong because GROUP BY can include computed columns like 'bin', and this is a common practice in KQL for aggregating data into time buckets.

471
MCQhard

You are designing a solution that requires asynchronous processing of messages from an Azure Service Bus queue. The solution must guarantee at-least-once delivery and handle poison messages automatically. Which combination of Service Bus features should you use?

A.ReceiveAndDelete mode with a separate dead-letter queue
B.ReceiveAndDelete mode with automatic forwarding
C.PeekLock mode with sessions
D.PeekLock mode with dead-letter queue
AnswerD

PeekLock mode is the correct choice for reliable asynchronous processing because it ensures at-least-once delivery. When a message is received in PeekLock mode, it is locked for a configurable duration, making it invisible to other consumers. If processing fails, the lock expires or the message is explicitly abandoned, making it available for redelivery. After a message exceeds the MaxDeliveryCount due to repeated failures, Azure Service Bus automatically moves it to the associated dead-letter queue, allowing for later inspection and manual reprocessing of poison messages.

Why this answer

PeekLock mode is required for at-least-once delivery because it allows the consumer to process the message and then explicitly complete it, ensuring the message is not removed from the queue until processing succeeds. The dead-letter queue automatically handles poison messages by moving messages that exceed the maximum delivery count or fail processing, preventing them from blocking the queue.

Exam trap

The trap here is that candidates often confuse sessions with poison message handling, but sessions are for message ordering and grouping, not for automatically moving failed messages to a dead-letter queue.

How to eliminate wrong answers

Option A is wrong because ReceiveAndDelete mode removes the message from the queue immediately upon retrieval, which cannot guarantee at-least-once delivery if the consumer crashes after receiving but before processing. Option B is wrong because ReceiveAndDelete mode with automatic forwarding still removes the message immediately, and automatic forwarding does not provide poison message handling—it simply routes messages to another queue or topic. Option C is wrong because while PeekLock mode supports at-least-once delivery, sessions are used for ordered processing and grouping related messages, not for automatic poison message handling; dead-letter queue is the feature designed for that purpose.

472
MCQeasy

You are developing a solution that needs to perform a multi-step workflow. The workflow involves calling several third-party APIs, and some steps may require waiting for a human approval via email. The workflow may run for hours. You want to use Azure Functions to implement this orchestration. Which Azure Functions feature should you use?

A.Durable Functions
B.Timer trigger functions
C.Service Bus queue trigger functions
D.Blob storage trigger functions
AnswerA

Durable Functions is designed for stateful orchestrations, supporting long-running workflows, waiting for external events, and managing multi-step processes.

Why this answer

Durable Functions is the correct choice because it is an extension of Azure Functions that enables stateful, long-running orchestration workflows. It supports waiting for external events (like human approval via email), managing multi-step API calls, and handling execution that may run for hours, all while preserving state through checkpoints and replay.

Exam trap

The trap here is that candidates may confuse trigger-based functions (like Timer or Queue triggers) with orchestration capabilities, not realizing that Durable Functions is the only Azure Functions feature that provides built-in state management and external event waiting for long-running workflows.

How to eliminate wrong answers

Option B is wrong because Timer trigger functions are designed for scheduled, time-based execution and cannot handle multi-step orchestration or wait for external events like human approval. Option C is wrong because Service Bus queue trigger functions process individual messages and do not provide built-in orchestration capabilities for chaining steps or pausing for external input. Option D is wrong because Blob storage trigger functions react to blob creation or updates and are not suited for orchestrating multi-step workflows with human interaction.

473
MCQeasy

Messages failing to process are redelivered by Azure Service Bus. After a message has been delivered and abandoned the maximum number of times (MaxDeliveryCount), where does Service Bus move the message?

A.The message is moved to the dead-letter sub-queue of the original queue
B.The message is permanently deleted from the queue
C.The message is returned to the front of the queue with its DeliveryCount reset to zero
D.The message expires and is discarded according to the Time-to-Live setting
AnswerA

When a message's DeliveryCount property exceeds the MaxDeliveryCount setting on an Azure Service Bus queue or subscription, the Service Bus automatically moves that message to the associated dead-letter sub-queue. This action is performed by the Service Bus runtime itself, ensuring that messages that cannot be processed after multiple attempts are isolated for further inspection. The DeadLetterReason property of the message will be set to 'MaxDeliveryCountExceeded' in the dead-letter queue.

Why this answer

When a message in Azure Service Bus is delivered and abandoned the maximum number of times (as defined by the MaxDeliveryCount property, default 10), the message is automatically moved to the dead-letter sub-queue of the original queue. This dead-letter sub-queue stores messages that cannot be processed successfully, allowing you to inspect and handle them separately without losing the message entirely.

Exam trap

The trap here is that candidates often assume messages are simply deleted or returned to the queue when the delivery count is exceeded, but Azure Service Bus explicitly moves them to a dead-letter sub-queue to ensure no data loss and to provide a mechanism for manual handling.

How to eliminate wrong answers

Option B is wrong because Service Bus does not permanently delete messages that exceed MaxDeliveryCount; instead, it moves them to the dead-letter sub-queue to preserve them for later analysis. Option C is wrong because returning the message to the front of the queue with a reset DeliveryCount would defeat the purpose of the MaxDeliveryCount limit and could cause infinite processing loops. Option D is wrong because the Time-to-Live (TTL) setting controls message expiration independently of MaxDeliveryCount; a message that exceeds MaxDeliveryCount is moved to the dead-letter sub-queue regardless of its TTL, unless the TTL expires first.

474
MCQmedium

Your team is using Azure DevOps to deploy an Azure Kubernetes Service (AKS) cluster. You want to automatically roll back a deployment if the new version causes a high error rate. Which Azure service should you use to implement this?

A.Azure Service Health
B.Azure Monitor
C.Azure Traffic Manager
D.Azure Policy
AnswerB

Azure Monitor is the comprehensive observability platform for collecting, analyzing, and acting on telemetry data from your Azure resources, including AKS. It can ingest metrics like HTTP error rates, CPU utilization, and pod restart counts, allowing you to define alert rules that trigger when deployment health degrades. These alerts can then invoke webhooks or Azure Functions, which an Azure DevOps pipeline can use as a signal to automatically initiate a rollback to a previously stable version of your application.

Why this answer

Azure Monitor, specifically Application Insights, can be configured with alert rules that trigger on metrics like server error rate. When the error rate exceeds a threshold, an Azure Monitor alert can invoke an Azure Automation runbook or a webhook to initiate a Kubernetes rollback via `kubectl rollout undo` or a Helm rollback. This provides automated, event-driven rollback without manual intervention.

Exam trap

The trap here is that candidates confuse Azure Monitor (which monitors application metrics and can trigger automated actions) with Azure Service Health (which only monitors Azure platform health, not your application's error rate).

How to eliminate wrong answers

Option A is wrong because Azure Service Health provides notifications about Azure service outages and planned maintenance, not application-level error rate monitoring or automated rollback actions. Option C is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes traffic across endpoints; it does not monitor application error rates or trigger deployment rollbacks. Option D is wrong because Azure Policy enforces compliance rules on Azure resources (e.g., tagging, allowed SKUs) and cannot monitor runtime application errors or execute Kubernetes rollback commands.

475
MCQhard

Your company has an Azure Kubernetes Service (AKS) cluster that hosts multiple microservices. You are tasked with deploying a new microservice that processes incoming HTTP requests and publishes messages to an Azure Service Bus topic. The microservice must scale based on the number of messages in the topic, and it must support graceful shutdown to complete in-flight requests. You need to choose the appropriate compute platform. The microservice is stateless and can be containerized. You want to minimize operational overhead and cost. The solution must automatically scale to zero when there are no messages. Which option should you choose? Option A: Deploy the microservice as an Azure Function with a Service Bus trigger on the Consumption plan. Option B: Deploy the microservice as a container in AKS with a Horizontal Pod Autoscaler based on Service Bus queue length. Option C: Deploy the microservice as an Azure Container App with a Service Bus scale rule. Option D: Deploy the microservice as an Azure App Service WebJob with continuous mode.

A.Deploy the microservice as an Azure Function with a Service Bus trigger on the Consumption plan.
B.AKS with HPA based on Service Bus queue length
C.Deploy the microservice as an Azure Container App with a Service Bus scale rule.
D.Azure App Service WebJob with continuous mode
AnswerC

Azure Container Apps with a Service Bus scale rule is the correct choice because it offers event-driven scaling to zero, supports containerized workloads, and provides configurable graceful shutdown, all with minimal operational overhead.

Why this answer

Azure Container Apps (ACA) with a Service Bus scale rule is the correct choice because it provides event-driven scaling based on the number of messages in a Service Bus topic, can scale to zero when there are no messages, supports graceful shutdown via terminationGracePeriodSeconds, and minimizes operational overhead compared to AKS. ACA is a serverless container platform that abstracts Kubernetes complexity while still allowing containerized workloads, making it ideal for stateless microservices that need to scale on demand. Azure Functions with a Service Bus trigger also scales based on messages and can scale to zero, but it does not natively support containerization (unless using custom containers which adds complexity) and has less control over graceful shutdown.

AKS requires managing a cluster and does not scale to zero. App Service WebJobs are not containerized and do not scale based on Service Bus metrics.

Exam trap

The trap is that candidates often choose Azure Functions for its event-driven scaling and scale-to-zero capability, but overlook the requirement for containerization and graceful shutdown. Azure Container Apps provides both container support and fine-grained shutdown control, making it the optimal choice.

How to eliminate wrong answers

Option B (AKS with HPA based on Service Bus queue length) is wrong because the Horizontal Pod Autoscaler (HPA) in AKS cannot natively scale based on Service Bus queue length; it requires a custom metrics adapter or KEDA, and AKS does not scale to zero pods (minimum replica count is typically 1). Option C (Azure Function with Service Bus trigger on Consumption plan) is wrong because Azure Functions are not containerized; the requirement states the microservice must be containerized, and Functions run as code, not containers. Option D (Azure App Service WebJob with continuous mode) is wrong because WebJobs run in an App Service plan that cannot scale to zero (always has at least one instance) and does not support containerized deployments natively.

476
Multi-Selectmedium

Which THREE Azure services can be used to send email notifications from an application?

Select 3 answers
A.Azure Event Grid
B.Azure Logic Apps
C.Azure Communication Services Email
D.Azure Functions (with SendGrid binding)
E.Azure Service Bus
AnswersB, C, D

Azure Logic Apps provide a serverless workflow engine to integrate applications, data, services, and systems. It offers a vast library of pre-built connectors, including direct integrations with popular email services like Office 365 Outlook, Gmail, and SendGrid, allowing developers to easily design workflows that send email notifications based on various triggers and actions without writing custom code.

Why this answer

Azure Logic Apps is correct because it provides built-in connectors (e.g., Office 365 Outlook, SMTP, SendGrid) that allow you to design workflows to send email notifications without writing custom code. You can trigger these workflows from various sources (HTTP requests, timers, Azure services) and include conditional logic, making it a serverless, low-code solution for email notifications.

Exam trap

The trap here is that candidates often confuse Azure Event Grid or Service Bus as email-sending services because they are messaging/event services, but they lack native email delivery capabilities and require additional services to actually send the email.

477
MCQmedium

You are designing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job is expected to run for up to 2 hours. You need to minimize costs. Which ACI configuration should you use?

A.Use a container group with a restart policy of 'OnFailure' or 'Never'.
B.Use GPU-enabled containers for faster processing.
C.Deploy the container group in a virtual network.
D.Use a container group with a restart policy of 'Always'.
AnswerA

The container stops after the job completes, reducing cost.

Why this answer

Setting the restart policy to 'OnFailure' or 'Never' ensures that the container does not restart after the batch job completes, avoiding unnecessary compute charges. ACI bills per second of container runtime, so any idle or restarted container time directly increases cost. For a finite batch job, a restart policy that prevents automatic restarts is the most cost-effective choice.

Exam trap

The trap here is that candidates often assume 'Always' is safer for reliability, but for batch jobs that complete successfully, 'Always' causes continuous restarts and unbounded costs, while 'OnFailure' or 'Never' align with the cost-minimization goal.

How to eliminate wrong answers

Option B is wrong because GPU-enabled containers incur significantly higher costs per second and are unnecessary for standard batch processing jobs that do not require GPU acceleration. Option C is wrong because deploying a container group in a virtual network adds networking overhead and does not reduce compute costs; it is typically used for security or integration, not cost minimization. Option D is wrong because a restart policy of 'Always' causes the container to restart indefinitely after the job completes, leading to continuous billing for idle runtime, which directly contradicts the goal of minimizing costs.

478
MCQmedium

You are designing a solution that requires atomic operations on a counter stored in Azure Blob Storage. The counter must be updated by multiple instances without conflicts. Which approach should you use?

A.Store the counter in Azure Cosmos DB and use stored procedures to increment atomically.
B.Use Azure Queue Storage to queue increment messages.
C.Store the counter in Azure Table Storage and use optimistic concurrency with ETags.
D.Use Append Blob to append each increment as a new block and sum them later.
AnswerA

Azure Cosmos DB stored procedures execute as a single, ACID-compliant transaction within a logical partition. When a stored procedure increments a counter, all operations within that procedure—reading the current value, incrementing it, and writing the new value—are guaranteed to either fully succeed or fully fail. This transactional boundary ensures that concurrent attempts to update the counter will not result in lost updates, making the increment operation truly atomic.

Why this answer

Azure Cosmos DB stored procedures execute within the database engine's transactional scope, providing ACID-compliant atomic operations. This ensures that concurrent increments from multiple instances are serialized without conflicts, which is not natively supported by Azure Blob Storage's eventual consistency model.

Exam trap

The trap here is that candidates assume Azure Blob Storage's lease or append features can provide atomicity, but Blob Storage lacks server-side atomic read-modify-write operations, making Cosmos DB the only Azure service among the options that natively supports atomic counter updates with stored procedures.

How to eliminate wrong answers

Option B is wrong because Azure Queue Storage decouples message processing but does not guarantee atomic updates to a counter; multiple workers can process messages concurrently, leading to race conditions unless additional locking is implemented. Option C is wrong because Azure Table Storage's optimistic concurrency with ETags only detects conflicts after the fact (via HTTP 412 Precondition Failed), requiring retry logic and still allowing lost updates under high contention. Option D is wrong because Append Blob appends data sequentially but does not provide atomic read-modify-write semantics; summing blocks later is an offline batch operation that cannot ensure real-time atomicity.

479
Multi-Selectmedium

Which TWO Azure services can be used to monitor and diagnose performance issues in an Azure Kubernetes Service (AKS) cluster?

Select 2 answers
A.Microsoft Defender for Cloud
B.Azure Network Watcher
C.Application Insights for AKS
D.Azure SQL Analytics
E.Azure Monitor Container Insights
AnswersC, E

Application Insights for AKS, a feature of Azure Monitor, provides comprehensive application performance management (APM) capabilities, including distributed tracing, dependency mapping, and real-time application telemetry. It allows developers to monitor live applications, detect performance anomalies, diagnose failures, and understand user behavior across microservices deployed on AKS. This makes it highly effective for deep application-level monitoring and diagnosis.

Why this answer

Application Insights for AKS (option C) is correct because it provides application-level monitoring, including distributed tracing, dependency tracking, and performance diagnostics for microservices running in AKS. It integrates with the AKS cluster to collect telemetry from pods and containers, enabling detection of slow requests, exceptions, and dependency failures that impact application performance.

Exam trap

The trap here is that candidates often confuse security monitoring (Defender for Cloud) with performance monitoring, or assume Network Watcher covers container-level diagnostics, when in fact only Application Insights and Container Insights provide the necessary application and container performance telemetry for AKS.

480
MCQmedium

You are monitoring an Azure App Service using Application Insights. You notice that the server response time is high for certain requests. You need to drill down to see which external dependencies (like databases or APIs) are causing the delay. Which Application Insights feature should you use?

A.Live Metrics
B.Application Map
C.Profiler
D.Snapshot Debugger
AnswerC

Profiler captures detailed, per-request execution traces, including the full call stack and the precise time spent in each method, I/O operation, and external dependency call (e.g., database queries, HTTP requests). By analyzing these traces, it can pinpoint exactly which part of the code or which specific external dependency is consuming the most time within a slow request. This granular data is invaluable for identifying the root cause of performance bottlenecks, such as a slow database query or an inefficient API call, by showing its exact contribution to the overall request duration.

Why this answer

Profiler (C) is correct because it provides a detailed, code-level view of request processing, including the time spent on each external dependency call (e.g., SQL queries, HTTP calls to APIs). It captures execution traces that break down the total server response time into individual dependency durations, allowing you to pinpoint which external service is causing the delay.

Exam trap

The trap here is that candidates confuse Application Map (which shows dependency relationships) with Profiler (which shows per-request timing), leading them to select a visualization tool instead of a performance-analysis tool.

How to eliminate wrong answers

Option A is wrong because Live Metrics shows real-time telemetry (e.g., request rate, failure count) but does not provide dependency-level breakdowns or call-duration details. Option B is wrong because Application Map visualizes the topology of your application and its dependencies but does not drill into per-request timing or trace individual dependency calls. Option D is wrong because Snapshot Debugger captures debug snapshots on exceptions, not for analyzing response-time delays caused by dependencies.

481
MCQhard

Refer to the exhibit. You run these Azure CLI commands for an Azure Function app. When the app is accessed from https://app.contoso.com, what is the expected behavior?

A.Only GET requests are allowed
B.Requests from the allowed origin are accepted
C.Requests are blocked because FTPS is required
D.All requests are blocked because no origins are allowed
AnswerB

The `az webapp cors add --origins https://app.contoso.com` command successfully configures the Azure Web App's Cross-Origin Resource Sharing (CORS) policy. This action explicitly adds `https://app.contoso.com` to the list of allowed origins, meaning that web browsers will permit JavaScript code running on `https://app.contoso.com` to make cross-origin HTTP requests to the web app. Consequently, requests originating from this specific URL will be accepted and processed according to the CORS specification.

Why this answer

The Azure CLI commands shown configure CORS (Cross-Origin Resource Sharing) for the Function App. The `az functionapp cors add` command adds `https://app.contoso.com` as an allowed origin, and `az functionapp cors show` confirms that this origin is in the allowed list. When a browser-based client at `https://app.contoso.com` makes a request to the Function App, the browser checks the `Access-Control-Allow-Origin` response header.

Since the origin matches, the browser permits the request to proceed, and the Function App processes it normally. Therefore, requests from the allowed origin are accepted.

Exam trap

The trap here is that candidates confuse CORS with authentication or authorization, assuming that adding an origin somehow restricts HTTP methods or enables FTPS, when in fact CORS only controls cross-origin browser access and does not affect direct server-to-server or non-browser requests.

How to eliminate wrong answers

Option A is wrong because CORS does not restrict HTTP methods globally; it only controls which origins are allowed to make cross-origin requests, and the Function App still processes GET, POST, PUT, DELETE, etc., based on its own authorization and route configuration. Option C is wrong because FTPS (FTP over SSL) is unrelated to CORS or HTTP request handling; the commands shown do not configure FTPS, and FTPS is a separate deployment protocol, not a request-level restriction. Option D is wrong because the `cors add` command explicitly added `https://app.contoso.com` as an allowed origin, so the allowed origins list is not empty; requests from that origin are permitted.

482
MCQmedium

Your application stores sensitive data in Azure Table Storage. You need to encrypt the data at rest. What should you do?

A.Implement client-side encryption using Azure Key Vault.
B.Enable server-side encryption with customer-managed keys in Azure Key Vault.
C.No action needed; Azure Storage Service Encryption (SSE) is enabled by default.
D.Enable Azure Disk Encryption on the virtual machines accessing the storage.
AnswerC

No action is needed because Azure Storage Service Encryption (SSE) is automatically enabled for all Azure Storage accounts, including Table Storage, by default. This means that all data written to Azure Table Storage is encrypted at rest using Microsoft-managed keys without any explicit configuration required from the user. This built-in encryption ensures that sensitive data is protected according to industry standards as soon as it is stored, satisfying the core security requirement.

Why this answer

Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in Azure Table Storage using 256-bit AES encryption, and it is enabled by default for all new and existing storage accounts. Since the question asks about encrypting data at rest and does not specify a need for customer-managed keys or client-side control, the default SSE meets the requirement without any additional configuration.

Exam trap

The trap here is that candidates often overthink and assume they need to take explicit action (like client-side encryption or customer-managed keys) to encrypt data at rest, when in fact Azure Storage Service Encryption is enabled by default and requires no configuration.

How to eliminate wrong answers

Option A is wrong because client-side encryption is an additional layer that encrypts data before it is sent to Azure Storage, but it is not required for data at rest encryption since SSE already provides that; implementing it would add unnecessary complexity and is not the default or simplest solution. Option B is wrong because server-side encryption with customer-managed keys (CMK) is an optional feature that allows you to use your own key in Azure Key Vault, but it is not needed when the default SSE (which uses Microsoft-managed keys) already encrypts data at rest; enabling CMK is an extra step for specific compliance requirements, not the default action. Option D is wrong because Azure Disk Encryption encrypts the OS and data disks of virtual machines using BitLocker or DM-Crypt, but it does not encrypt the data stored in Azure Table Storage, which is a PaaS service separate from VM disks.

483
Drag & Dropmedium

Arrange the steps to create a CI/CD pipeline using Azure DevOps for an Azure App Service in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence for setting up a CI/CD pipeline in Azure DevOps is: First, create a repository and push your application code. Next, create a build pipeline to compile and package your application. Then, configure the CI trigger within the build pipeline to automate builds on code changes.

After that, create a release pipeline to define the deployment steps for the build artifacts. Finally, set up approval gates within the release pipeline to control deployments to different environments.

484
MCQmedium

A developer needs to run a Kusto query against application request data to identify 95th percentile latency by operation. Where should the query be run? The architecture review board prefers a managed Azure-native control.

A.Logs in Application Insights or the associated Log Analytics workspace
B.Microsoft Entra audit logs
C.Azure Key Vault diagnostic settings
D.Azure Resource Graph only
AnswerA

Application Insights stores telemetry that can be queried with KQL in Logs.

Why this answer

Application Insights stores telemetry data, including request latency, in a Log Analytics workspace. Kusto queries against this data can compute percentiles (e.g., 95th) using the `percentile()` function. This is the correct location because the architecture review board prefers a managed Azure-native control, and Log Analytics is the native Azure monitoring service for running such queries.

Exam trap

The trap here is that candidates may confuse Azure Resource Graph with Log Analytics, thinking it can query telemetry data, but Resource Graph only returns resource inventory and configuration state, not performance metrics.

How to eliminate wrong answers

Option B is wrong because Microsoft Entra audit logs contain sign-in and directory activity, not application request latency data. Option C is wrong because Azure Key Vault diagnostic settings capture vault access logs (e.g., get, list, delete operations), not application performance metrics like latency. Option D is wrong because Azure Resource Graph only queries Azure resource metadata and configurations, not telemetry or performance data from applications.

485
MCQeasy

Your company has an Azure App Service web app that runs on a Standard App Service plan. You need to scale out the app to handle increased traffic during business hours and scale in during off-hours. What should you configure?

A.Configure autoscale rules on the App Service plan to scale out and in based on CPU usage.
B.Manually increase the instance count during business hours.
C.Scale up the App Service plan to a Premium plan.
D.Use Azure Traffic Manager to distribute load.
AnswerA

Autoscale rules on the App Service plan provide the capability to automatically adjust the number of instances (scale out) when demand, such as CPU usage, exceeds a defined threshold, and scale in when demand decreases. This ensures the web app maintains optimal performance and availability under fluctuating loads without requiring manual intervention, making it the most efficient and automated solution for dynamic capacity management.

Why this answer

Azure App Service autoscale rules allow you to automatically scale out (increase instance count) and scale in (decrease instance count) based on metrics like CPU usage. This meets the requirement to handle increased traffic during business hours and reduce costs during off-hours without manual intervention. Autoscale is configured at the App Service plan level, not the web app itself, and works with the Standard tier and above.

Exam trap

The trap here is confusing 'scaling up' (increasing the plan tier or instance size) with 'scaling out' (increasing the number of instances), and assuming that manual scaling or Traffic Manager can achieve automatic scaling based on load.

How to eliminate wrong answers

Option B is wrong because manually increasing the instance count during business hours does not automate the process; the requirement is to scale out and in automatically based on traffic patterns, not manually. Option C is wrong because scaling up to a Premium plan increases the resources (e.g., CPU, memory) of each instance but does not scale out (add more instances) to handle increased traffic; autoscale is already available on the Standard plan. Option D is wrong because Azure Traffic Manager distributes traffic across endpoints for global load balancing and failover, but it does not scale the number of instances in an App Service plan; it works at the DNS level, not the compute scaling level.

486
MCQmedium

A queue-processing application stores work items in Azure Queue Storage. A worker crashes after receiving a message. What determines when the message becomes available for another worker?

A.Blob lease duration
B.Visibility timeout
C.Message TTL only
D.Poison queue threshold only
AnswerB

The visibility timeout hides a received message temporarily; it reappears if not deleted before the timeout expires.

Why this answer

When a worker receives a message from Azure Queue Storage, the message becomes invisible to other workers for a period defined by the visibility timeout. If the worker crashes without deleting or updating the message, the visibility timeout expires and the message reappears in the queue, making it available for another worker to process. This mechanism ensures at-least-once processing and prevents message loss on worker failure.

Exam trap

The trap here is confusing the visibility timeout with message TTL or poison queue handling, leading candidates to overlook the specific mechanism that controls message reavailability after a worker crash.

How to eliminate wrong answers

Option A is wrong because blob lease duration applies to Azure Blob Storage leases for exclusive write access, not to queue messages. Option C is wrong because Message TTL (Time-to-Live) only sets the maximum time a message stays in the queue before being deleted, not when it becomes visible after a worker crash. Option D is wrong because the poison queue threshold defines how many times a message can be dequeued before being moved to a poison queue, not when it becomes available after a crash.

487
MCQeasy

You need to store and retrieve large binary files (up to 100 GB each) with low latency. The files will be accessed by multiple geographic regions. Which Azure storage solution should you recommend?

A.Azure Queue Storage with messages.
B.Azure Files with Azure File Sync.
C.Azure Blob Storage with geo-redundant storage (GRS).
D.Azure SQL Database with file tables.
AnswerC

Azure Blob Storage is purpose-built for storing massive amounts of unstructured data, including large binary files, images, videos, and backups, making it the ideal choice for objects up to 100 GB. It offers unparalleled scalability, cost-effectiveness across various access tiers, and robust APIs for object management. Implementing Geo-Redundant Storage (GRS) further enhances data durability and availability by asynchronously replicating data to a secondary Azure region hundreds of miles away, providing comprehensive protection against regional outages.

Why this answer

Azure Blob Storage is designed for storing large binary objects (up to 4.7 TB per blob) and offers low-latency access via HTTP/HTTPS. Geo-redundant storage (GRS) replicates data to a paired secondary region, providing durability and availability for multi-region access. This combination meets the requirements for large files (up to 100 GB) and low-latency retrieval from multiple geographic regions.

Exam trap

The trap here is that candidates may confuse Azure Files (SMB shares) with Blob Storage for large binary files, not realizing that Azure Files has a 1 TB file size limit and is optimized for shared file access, not for high-throughput blob storage with geo-replication.

How to eliminate wrong answers

Option A is wrong because Azure Queue Storage is a messaging service for decoupling application components, not for storing or retrieving large binary files; messages are limited to 64 KB each. Option B is wrong because Azure Files provides SMB file shares with a maximum file size of 1 TB (not 100 GB per file) and Azure File Sync is for caching on-premises, not optimized for low-latency multi-region blob access. Option D is wrong because Azure SQL Database with file tables stores file metadata in a relational database, but the actual binary data is stored in Azure Blob Storage behind the scenes, and SQL Database is not designed for direct high-throughput binary access with low latency for files up to 100 GB.

488
MCQeasy

You are developing an Azure Function that runs on a Consumption plan. The function needs to process a large file uploaded to Azure Blob Storage. The processing is CPU-intensive and may take up to 30 minutes. What should you use to implement the function?

A.Use a blob trigger and set the batchSize to 1 to avoid timeouts.
B.Configure the function app to use a Premium plan to allow longer execution times.
C.Set the functionTimeout in host.json to 30 minutes on the Consumption plan.
D.Create an orchestrator function using Durable Functions to manage the processing.
AnswerB

The Azure Functions Premium plan is specifically designed to support longer execution durations, allowing functions to run for up to 60 minutes. This plan provides pre-warmed instances to eliminate cold starts and offers dedicated compute resources, making it ideal for workloads requiring extended processing times beyond the Consumption plan's inherent limits. Migrating to a Premium plan directly addresses the need for increased execution time by providing a higher platform-level timeout.

Why this answer

Azure Functions on a Consumption plan have a maximum execution timeout of 10 minutes (or 5 minutes by default). For CPU-intensive processing that may take up to 30 minutes, you must use a Premium plan, which supports unlimited execution duration (subject to the functionTimeout setting, which can be set up to 60 minutes by default and up to unlimited if configured). The Premium plan also provides dedicated instances and pre-warmed workers, which are suitable for long-running, resource-intensive workloads.

Exam trap

The trap here is that candidates often assume they can simply increase the functionTimeout in host.json on a Consumption plan, not realizing that the Consumption plan enforces a hard cap of 10 minutes regardless of the setting.

How to eliminate wrong answers

Option A is wrong because a blob trigger on a Consumption plan still enforces the 10-minute timeout; setting batchSize to 1 only controls concurrency, not execution duration, and does not prevent timeout. Option C is wrong because the functionTimeout setting on a Consumption plan cannot exceed 10 minutes (the maximum allowed is 10 minutes, and the default is 5 minutes); setting it to 30 minutes would be ignored or cause an error. Option D is wrong because Durable Functions are designed for orchestrating stateful workflows and fan-out/fan-in patterns, not for simply extending the execution timeout of a single CPU-intensive function; they add complexity and overhead without solving the fundamental timeout limitation on a Consumption plan.

489
Multi-Selecthard

Which THREE factors should you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for a containerized workload? (Choose three.)

Select 3 answers
A.The need for orchestration of multiple containers
B.The restart policy for containers
C.The need for GPU-accelerated compute
D.The availability of Azure Application Gateway Ingress Controller
E.The maximum resource limits per container instance
AnswersA, D, E

AKS provides full orchestration capabilities for managing multiple containers across a cluster, including service discovery, load balancing, and scaling. ACI is designed for single-container or simple multi-container groups without native orchestration, making AKS the appropriate choice when complex orchestration is required.

Why this answer

AKS provides full orchestration capabilities for managing multiple containers across a cluster, including service discovery, load balancing, and scaling. ACI is designed for single-container or simple multi-container groups without native orchestration, making AKS the appropriate choice when complex orchestration is required (A).

Azure Container Instances (ACI) has specific maximum resource limits for a single container group (e.g., 16 vCPU, 112 GiB memory), making it suitable for smaller, burstable workloads. Azure Kubernetes Service (AKS) allows for much larger, distributed applications by scaling out across multiple nodes and pods, making the overall resource capacity a key differentiator (E).

The Azure Application Gateway Ingress Controller (AGIC) is an AKS-specific feature that allows Application Gateway to act as an Ingress controller for an AKS cluster. If a workload requires this specific ingress solution, AKS is the appropriate choice, whereas ACI does not offer this native integration (D).

Exam trap

The trap here is that candidates mistakenly think GPU support is exclusive to AKS, but ACI also supports GPU-accelerated compute, making it a non-differentiating factor. Another trap is misinterpreting the role of specific integration features like the Application Gateway Ingress Controller (AGIC). AGIC is an AKS-only feature; therefore, the *need* for AGIC is a critical factor when choosing between AKS and ACI.

While both ACI and AKS have restart policies, the advanced orchestration capabilities of AKS (covered by option A) provide more robust and automated restart management and self-healing across a cluster, making 'restart policy' alone a less precise differentiating factor compared to orchestration, resource limits, or specific integration needs.

490
MCQeasy

A company has an Azure App Service web app that occasionally returns 500 errors. You need to diagnose the root cause without impacting production traffic. Which feature should you use?

A.Kudu console
B.Deployment slots
C.Application Insights
D.Autoscaling rules
AnswerC

Application Insights provides comprehensive Application Performance Monitoring (APM) by collecting telemetry such as requests, exceptions, dependencies, and performance counters directly from your application. It offers end-to-end transaction tracing, allowing developers to visualize the flow of requests and pinpoint the exact code path and dependencies causing HTTP 500 errors, complete with stack traces and contextual data. This non-intrusive monitoring solution is ideal for diagnosing production issues without impacting user experience or requiring manual intervention.

Why this answer

Application Insights is a powerful diagnostic tool that provides detailed telemetry and performance monitoring for your web app. It can automatically detect and analyze 500 errors, showing stack traces, request details, and dependencies. This allows you to identify the root cause without impacting production traffic, as it works passively by collecting data.

Exam trap

The trap here is that candidates might consider deployment slots for isolating issues, but while slots are excellent for safe deployments and testing new code, they are not the primary tool for *diagnosing the root cause* of *existing, occasional 500 errors* in a live production application. Application Insights is specifically designed for passive monitoring and detailed telemetry collection to identify such root causes without direct interaction or reproduction efforts.

How to eliminate wrong answers

Option A is wrong because the Kudu console provides direct file system access and command-line tools for debugging, but it operates on the live production site and can impact traffic if misused, and it does not isolate traffic for safe diagnosis. Option C is wrong because Application Insights is a monitoring and telemetry service that helps identify performance issues and errors after they occur, but it does not provide an isolated environment to reproduce and debug errors without affecting production traffic. Option D is wrong because Autoscaling rules automatically adjust the number of instances based on load, but they do not help diagnose the root cause of 500 errors and may even mask underlying issues by scaling out.

491
MCQeasy

Your application uses Azure App Service and needs to authenticate users via Microsoft Entra ID. You want to minimize code changes. Which feature should you use?

A.Azure AD B2C
B.Microsoft.Identity.Web library
C.App Service Authentication (Easy Auth)
D.MSAL.js
AnswerC

App Service Authentication, commonly known as Easy Auth, is a platform-level feature of Azure App Service that provides built-in authentication and authorization capabilities without requiring code changes within the application. It acts as an authentication proxy, intercepting requests and handling the entire authentication flow with Microsoft Entra ID, then passing user claims to the application via HTTP headers. This approach offers seamless integration with enterprise identities and significantly reduces development overhead, making it ideal for scenarios prioritizing minimal application code modifications.

Why this answer

App Service Authentication (also known as Easy Auth) is the correct choice because it enables authentication with Microsoft Entra ID (formerly Azure AD) at the platform level, requiring no code changes in your application. It automatically handles token validation, session management, and redirects by intercepting HTTP requests before they reach your app code, which directly satisfies the requirement to minimize code changes.

Exam trap

The trap here is that candidates often choose Microsoft.Identity.Web or MSAL.js because they are familiar with code-based authentication, overlooking that the question explicitly prioritizes minimizing code changes, which is the core advantage of Easy Auth's platform-level integration.

How to eliminate wrong answers

Option A is wrong because Azure AD B2C is designed for customer-facing identity management with social logins and custom policies, not for enterprise authentication with Microsoft Entra ID, and it requires significant code changes to integrate. Option B is wrong because the Microsoft.Identity.Web library is a code-based middleware that requires adding NuGet packages, modifying startup code, and configuring authentication handlers, which contradicts the goal of minimizing code changes. Option D is wrong because MSAL.js is a client-side JavaScript library that requires you to write authentication logic in the browser, handle token acquisition and renewal in code, and does not offload authentication to the platform layer like Easy Auth does.

492
MCQmedium

You have a web application monitored by Application Insights. You want to receive an alert when the average server response time exceeds 2 seconds for a rolling 5-minute period. Which alert rule type should you create?

A.Application Insights metric alert on 'Server response time' with condition 'Greater than 2' and evaluation frequency 5 minutes
B.Log alert based on a Kusto query that measures average response time in 5-minute windows
C.Smart Detection alert on response time degradation
D.Availability test alert for HTTP response time
AnswerA

This option correctly identifies the most appropriate monitoring tool for the requirement. An Application Insights metric alert on 'Server response time' directly monitors the average duration of server-side request processing, which is a standard metric collected by the Application Insights SDK. Setting a condition 'Greater than 2' with a 5-minute evaluation frequency ensures that an alert will fire efficiently when the average response time consistently exceeds 2 seconds over that period, precisely matching the scenario's need for threshold-based monitoring.

Why this answer

A metric alert on 'Server response time' is the correct choice because it continuously evaluates the average server response time over a rolling 5-minute window and triggers when the value exceeds 2 seconds. Metric alerts are designed for near-real-time monitoring of performance counters like response time, with a fixed evaluation frequency that matches the aggregation window, making them ideal for this scenario.

Exam trap

The trap here is confusing metric alerts (which evaluate pre-aggregated performance counters in near-real-time) with log alerts (which require querying raw telemetry data and have higher latency), leading candidates to incorrectly choose the log-based option for a simple threshold-based metric condition.

How to eliminate wrong answers

Option B is wrong because a Log alert based on a Kusto query is designed for analyzing log data (e.g., traces, exceptions) and incurs ingestion latency, making it unsuitable for low-latency, rolling-window performance thresholds like server response time. Option C is wrong because Smart Detection alerts use machine learning to detect anomalies in response time patterns, not a fixed threshold of 2 seconds over a 5-minute period. Option D is wrong because Availability test alerts monitor the availability and responsiveness of an endpoint from multiple locations, not the average server response time for all requests over a rolling window.

493
MCQhard

Your application uses Azure Cosmos DB for NoSQL. You need to implement server-side computed properties that depend on multiple document fields. The computation must be performed atomically. Which approach should you use?

A.Use a pre-trigger to compute the property on write
B.Use the change feed to compute the property asynchronously
C.Use a user-defined function (UDF) in queries
D.Use a stored procedure to compute and update the property in a single transaction
AnswerD

Stored procedures in Azure Cosmos DB for NoSQL are JavaScript functions executed directly on the database engine within a single transaction. They provide full ACID (Atomicity, Consistency, Isolation, Durability) guarantees for all operations performed within a single logical partition. This ensures that if a stored procedure computes a property and then updates the document, either all operations commit successfully as a single unit, or none do, guaranteeing the atomic persistence of the computed property with the document's state.

Why this answer

Stored procedures in Azure Cosmos DB for NoSQL execute within a transactional scope, allowing you to atomically compute a property based on multiple document fields and update the document in a single operation. This ensures that the computation and update are performed as an all-or-nothing unit, which is required for atomicity. Pre-triggers, change feeds, and UDFs do not provide atomic read-modify-write semantics across multiple fields.

Exam trap

The trap here is that candidates often confuse the atomic execution of a stored procedure with the eventual consistency of the change feed or the query-time computation of a UDF, failing to recognize that only stored procedures provide a transactional scope for read-modify-write operations on the same document.

How to eliminate wrong answers

Option A is wrong because pre-triggers run before a write operation but cannot atomically read the existing document fields, compute a new property, and update the same document in a single transaction—they only modify the document being written. Option B is wrong because the change feed processes changes asynchronously, which breaks atomicity; the computed property would be applied in a separate operation, not within the same transaction as the original write. Option C is wrong because user-defined functions (UDFs) are stateless and only compute values at query time; they cannot persist computed properties back to the document or guarantee atomic updates.

494
MCQeasy

You are developing an application that stores user secrets. You need to ensure that the secrets are encrypted at rest and rotated automatically. Which Azure service should you integrate?

A.Azure Storage.
B.Azure Key Vault.
C.Azure Security Center.
D.Microsoft Entra ID.
AnswerB

Azure Key Vault is purpose-built for the secure storage and management of cryptographic keys, secrets, and certificates. It provides robust protection for secrets using FIPS 140-2 Level 2 validated Hardware Security Modules (HSMs), offers fine-grained access control through Azure RBAC and Key Vault access policies, and supports automatic secret rotation, versioning, and comprehensive auditing. This dedicated design ensures the confidentiality and integrity of sensitive user secrets throughout their lifecycle.

Why this answer

Azure Key Vault is the correct choice because it provides centralized management of secrets, keys, and certificates with built-in encryption at rest using FIPS 140-2 Level 2 validated hardware security modules (HSMs). It also supports automatic rotation of secrets through integration with Azure Event Grid and Azure Functions, enabling you to schedule or trigger key rotation policies without manual intervention.

Exam trap

The trap here is that candidates often confuse Azure Storage's built-in encryption at rest with the need for a dedicated secrets management service, overlooking that Key Vault alone provides both encryption at rest and automated rotation for secrets.

How to eliminate wrong answers

Option A is wrong because Azure Storage encrypts data at rest by default using server-side encryption (SSE) but does not provide native secret rotation capabilities or a dedicated secrets management interface. Option C is wrong because Azure Security Center is a unified security management and threat protection service that monitors security posture and provides recommendations, but it does not store or rotate secrets. Option D is wrong because Microsoft Entra ID (formerly Azure AD) is an identity and access management service that handles authentication and authorization, not the storage or rotation of application secrets.

495
MCQeasy

You are developing a web application that runs on Azure App Service. The application needs to store session state. Which Azure service provides the best performance and reliability for session state storage?

A.Azure Table Storage
B.Azure Blob Storage
C.Azure Cache for Redis
D.Azure SQL Database
AnswerC

Azure Cache for Redis is an in-memory data store based on the open-source Redis, providing extremely low-latency data access and high throughput. This makes it ideal for caching and managing session state in distributed web applications. Its support for various data structures, along with built-in features like data expiration and atomic operations, perfectly aligns with the requirements for efficient, scalable, and resilient session management.

Why this answer

Azure Cache for Redis provides the best performance and reliability for session state storage because it is an in-memory data store with sub-millisecond latency, designed for high-throughput, low-latency scenarios like session caching. It supports session state providers natively in ASP.NET and ASP.NET Core, ensuring fast reads and writes for each user request without the overhead of disk I/O or network latency associated with other storage options.

Exam trap

The trap here is that candidates often choose Azure SQL Database or Table Storage because they are familiar with them for data storage, but they overlook that session state is a transient, high-frequency access pattern that demands an in-memory cache like Redis, not a durable or relational store.

How to eliminate wrong answers

Option A is wrong because Azure Table Storage is a NoSQL key-value store optimized for structured, non-relational data at scale, but it has higher latency (typically 10-50 ms per operation) and lacks the in-memory speed needed for session state, which requires frequent, fast reads and writes. Option B is wrong because Azure Blob Storage is designed for storing large unstructured data like images and videos, not for high-frequency, low-latency access patterns; its latency (often 50-100+ ms) and lack of native session state provider support make it unsuitable for session state. Option D is wrong because Azure SQL Database is a relational database with transactional consistency, but its disk-based storage and connection overhead (e.g., TCP handshake, query parsing) introduce higher latency (typically 5-50 ms) compared to Redis, and it is overkill for simple key-value session data, leading to unnecessary cost and complexity.

496
MCQeasy

You need to monitor the performance of an Azure App Service web app. You want to track the number of HTTP 500 errors over the last hour. Which Azure Monitor metric should you use?

A.Data In
B.Average Response Time
C.Http5xx
D.Requests
AnswerC

The 'Http5xx' metric specifically counts the number of HTTP responses with a status code in the 500-599 range, which unequivocally indicates server-side errors. These errors signify that the App Service or the underlying application encountered an unexpected condition that prevented it from fulfilling a valid request. Monitoring this metric is a direct and critical way to identify and track application performance degradation caused by internal server failures.

Why this answer

The Http5xx metric in Azure Monitor tracks the count of HTTP 500-level server error responses returned by your App Service. Since the question specifically asks for the number of HTTP 500 errors over the last hour, this metric directly provides that count without any aggregation or filtering needed.

Exam trap

The trap here is that candidates may confuse 'Http5xx' with 'Requests' or 'Average Response Time', thinking that a high error count would be reflected in those metrics, but they do not directly count error status codes.

How to eliminate wrong answers

Option A is wrong because Data In measures the amount of incoming data (in bytes) to the app, not error counts. Option B is wrong because Average Response Time measures the average time taken to serve requests, not the count of specific HTTP status codes. Option D is wrong because Requests tracks the total number of HTTP requests received, regardless of their response status, so it does not isolate 500 errors.

497
Multi-Selecteasy

Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)

Select 2 answers
A.Storage account key (Shared Key).
B.Microsoft Entra ID (formerly Azure AD) authentication.
C.Certificate-based authentication.
D.Managed Service Identity (MSI).
E.Shared access signature (SAS) token.
AnswersA, B

A storage account key, also known as a Shared Key, provides full administrative access to all data within an Azure storage account. When using Shared Key authentication, every request to Azure Storage is cryptographically signed with this key, allowing the storage service to verify the request's authenticity. This method grants comprehensive control over blobs, files, queues, and tables, making it a powerful but sensitive authentication mechanism that should be protected diligently.

Why this answer

The storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.

Exam trap

The trap here is that candidates often confuse Managed Service Identity (MSI) as a standalone authentication method, when in reality it is an identity provider that relies on Entra ID tokens, and they may also mistake SAS tokens as an authentication option rather than a delegated authorization mechanism.

498
MCQmedium

You are developing a microservice that processes images. After processing, it needs to store the result in Azure Blob Storage and send a message to Azure Service Bus for further processing. Which Azure SDK client should you use to minimize overhead?

A.Use the Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages
B.Deploy the microservice as an Azure Function
C.Call the Azure REST APIs directly using HttpClient
D.Use Azure SignalR Service for messaging
AnswerA

For a microservice processing images, Azure Blob Storage is the standard solution for storing the images, and the Azure.Storage.Blobs NuGet package provides a robust, idiomatic .NET client library for interacting with it. Similarly, Azure Service Bus is a highly reliable enterprise-grade messaging service ideal for asynchronous communication between microservices, and the Azure.Messaging.ServiceBus package offers a high-performance, feature-rich client for sending and receiving messages, enabling efficient decoupled processing workflows.

Why this answer

The Azure.Storage.Blobs and Azure.Messaging.ServiceBus NuGet packages are the official, high-level Azure SDK client libraries that provide optimized, asynchronous APIs for interacting with Azure Blob Storage and Azure Service Bus. These libraries handle connection pooling, retry policies, serialization, and authentication automatically, minimizing overhead compared to lower-level approaches.

Exam trap

The trap here is that candidates may confuse a hosting option (Azure Functions) or a different service (SignalR) with the correct client library, or assume that raw REST calls are simpler when they actually introduce more overhead due to manual protocol handling.

How to eliminate wrong answers

Option B is wrong because deploying the microservice as an Azure Function does not change the SDK client used to interact with Blob Storage or Service Bus; it is a hosting model, not a client library, and introduces additional overhead from the Functions runtime. Option C is wrong because calling the Azure REST APIs directly using HttpClient requires manual handling of authentication (e.g., SAS tokens or OAuth), retry logic, and request/response serialization, which increases development and operational overhead. Option D is wrong because Azure SignalR Service is designed for real-time web messaging (e.g., WebSocket push), not for queue-based or pub/sub messaging patterns like Service Bus, and using it would add unnecessary complexity and protocol mismatch.

499
MCQeasy

You deploy a web app to Azure App Service. Users report intermittent 500 errors. How should you enable detailed error logging?

A.Configure Azure Storage account diagnostics
B.Set up Azure DNS logging
C.Enable Application Insights for the web app
D.Enable Azure Front Door logging
AnswerC

Application Insights, a powerful feature of Azure Monitor, is specifically designed for comprehensive monitoring of live web applications, including Azure App Service. It automatically collects vital telemetry data such as request rates, response times, failure rates, dependencies, and critically, application exceptions and custom traces from within the application's code. By integrating Application Insights, developers gain deep, real-time insights into application performance, user behavior, and can effectively identify and diagnose the root cause of user-reported errors and crashes.

Why this answer

Application Insights provides built-in server-side telemetry for Azure App Service, including detailed error tracking, stack traces, and request logs. Enabling it captures the full exception details for intermittent 500 errors, which are typically unhandled exceptions or crashes in the application code. This is the most direct and integrated way to get detailed error logs without additional infrastructure.

Exam trap

The trap here is that candidates confuse platform-level diagnostics (like storage or Front Door logs) with application-level telemetry, assuming any logging option will capture detailed error details, but only Application Insights provides the deep exception context needed for intermittent 500 errors.

How to eliminate wrong answers

Option A is wrong because Azure Storage account diagnostics store platform-level metrics and logs (e.g., CPU, network) but do not capture application-level error details like stack traces for 500 errors. Option B is wrong because Azure DNS logging records DNS query traffic, not HTTP request/response details or application errors. Option D is wrong because Azure Front Door logging captures edge-level request/response data and WAF logs, but does not provide the application server's detailed error stack traces or exception logs needed to diagnose 500 errors.

500
MCQmedium

A company uses Azure Logic Apps to integrate with a third-party CRM system. The CRM API requires OAuth 2.0 authentication. The developer needs to securely store the client secret and refresh token. Which Azure service should the developer use?

A.Azure App Configuration
B.Azure Key Vault
C.Azure Managed Identity
D.Azure SQL Database
AnswerB

Azure Key Vault is the dedicated Azure service for securely storing and managing cryptographic keys, certificates, and secrets, including API keys, connection strings, and OAuth tokens. It provides robust security features such as hardware security module (HSM)-backed protection, granular access policies, and comprehensive auditing capabilities. Logic Apps can seamlessly integrate with Key Vault to retrieve these secrets at runtime, ensuring credentials are never exposed in application code or configuration.

Why this answer

Azure Key Vault is the correct service because it provides a secure, centralized store for secrets such as client secrets and refresh tokens. By storing these sensitive values in Key Vault, the developer can reference them in the Logic App workflow using the Key Vault connector, ensuring that secrets are never exposed in code or configuration. This aligns with the OAuth 2.0 requirement to protect long-lived credentials like refresh tokens.

Exam trap

The trap here is that candidates often confuse Azure Managed Identity with a secret storage solution, not realizing that Managed Identity is an authentication mechanism for Azure resources, not a service for storing arbitrary secrets like OAuth client secrets or refresh tokens.

How to eliminate wrong answers

Option A is wrong because Azure App Configuration is designed for managing application configuration settings (e.g., feature flags, connection strings) but does not provide the same level of encryption, access policies, or audit logging as Key Vault for secrets; it is not a secure secret store. Option C is wrong because Azure Managed Identity provides an automatically managed service principal for authenticating to Azure services without storing credentials, but it cannot be used to store or retrieve arbitrary secrets like a client secret or refresh token; it is an identity, not a secret store. Option D is wrong because Azure SQL Database is a relational database service and is not designed for secure secret storage; storing secrets directly in a database would expose them to SQL injection risks and lack the built-in encryption and access control features of Key Vault.

501
MCQmedium

You need to deploy an Azure Functions app that runs on a dedicated App Service plan. The function must be triggered by an HTTP request and call a downstream API that requires OAuth 2.0 authentication. Which approach should you use to store the API credentials securely?

A.Use Azure App Configuration with plain text
B.Store credentials in a configuration file in the deployment package
C.Use Key Vault references in the function app settings
D.Store credentials in the function code as constants
AnswerC

Using Key Vault references in Azure Function app settings is the recommended and most secure method for managing sensitive credentials. This approach allows the function app to retrieve secrets dynamically from Azure Key Vault at runtime, without ever storing the secret value directly in the app's configuration or code. The function app uses its managed identity to authenticate with Key Vault, ensuring that secrets are accessed securely, rotated easily, and never exposed in plain text within the application environment.

Why this answer

Azure Key Vault references in function app settings allow you to securely store and retrieve sensitive information like OAuth 2.0 credentials (client ID, client secret) without exposing them in code or configuration files. The function app resolves these references at runtime using a managed identity, ensuring credentials are never stored in plaintext or accessible via source control.

Exam trap

The trap here is that candidates may confuse Azure App Configuration (a configuration store) with Azure Key Vault (a secrets store), assuming both are equally secure for credentials, but App Configuration does not natively encrypt values or support managed identity-based access for secrets without Key Vault integration.

How to eliminate wrong answers

Option A is wrong because Azure App Configuration is a service for managing application settings and feature flags, but storing credentials as plain text there violates security best practices and does not provide encryption at rest or access control for secrets. Option B is wrong because storing credentials in a configuration file within the deployment package exposes them to anyone with access to the package or source repository, and they are not encrypted or managed centrally. Option D is wrong because hardcoding credentials as constants in function code makes them visible in source control, difficult to rotate, and a severe security risk; Azure Functions should never embed secrets directly in code.

502
MCQhard

A Durable Functions workflow for a booking backend must call five independent activity functions and continue only after all results are available. Which pattern is appropriate?

A.Monitor pattern
B.Fan-out/fan-in
C.Human interaction
D.Function chaining
AnswerB

Fan-out/fan-in runs activities in parallel and aggregates results after all complete.

Why this answer

The fan-out/fan-in pattern is designed for scenarios where multiple independent tasks must execute in parallel, and the workflow must wait for all results before proceeding. In Durable Functions, this is implemented using `Task.WhenAll()` to fan out activity function calls and then aggregate their results, which matches the requirement of calling five independent activities and continuing only after all results are available.

Exam trap

The trap here is that candidates often confuse the fan-out/fan-in pattern with function chaining, mistakenly thinking that sequential execution is sufficient, or they incorrectly apply the Monitor pattern when the requirement is simply parallel execution without polling.

How to eliminate wrong answers

Option A is wrong because the Monitor pattern is used for polling an external resource until a specific condition is met, not for parallel execution of independent tasks. Option C is wrong because the Human Interaction pattern involves waiting for manual input or approval, which is not applicable to automated parallel activity calls. Option D is wrong because Function chaining executes activities sequentially, one after another, which does not achieve the parallel execution required here.

503
MCQhard

You have an Azure App Service web app that uses a custom domain with TLS/SSL binding. You need to migrate the app to a new App Service plan in a different region. What is the correct order of steps?

A.Create the new plan, deploy the app, export the current plan, bind the domain
B.Export the current plan, create the new plan, bind the domain, deploy the app
C.Bind the domain to the new plan, export the current plan, create the new plan, deploy the app
D.Export the current plan, create the new plan, deploy the app, bind the domain and certificate
AnswerD

This is the correct order for migrating an App Service with a custom domain and certificate, ensuring minimal downtime and proper configuration. First, exporting the current plan captures all necessary application settings and environment variables. Next, creating the new App Service Plan and deploying the application with the exported configuration ensures the app is fully functional in the new environment. Finally, binding the custom domain and its TLS/SSL certificate ensures secure and uninterrupted service delivery to end-users.

Why this answer

The proper sequence for migrating an Azure App Service web app with a custom domain and TLS/SSL binding to a new plan in a different region is: first, capture the existing web app's configuration (e.g., by exporting its ARM template, which includes custom domain and certificate binding details), then create the new App Service plan in the target region, deploy the app (which involves creating the new web app resource and deploying its code, potentially using the captured configuration), and finally bind the custom domain and certificate to the new web app. This ensures the custom domain and TLS/SSL binding are correctly associated with the new web app after it's deployed, avoiding downtime or misconfiguration.

Exam trap

The trap here is that candidates often think they can bind the domain and certificate before deploying the app, or that exporting the plan is optional, but Azure requires the app to be deployed and running to validate domain ownership and certificate binding.

How to eliminate wrong answers

Option A is wrong because exporting the current plan should occur before creating the new plan to capture the app's configuration, and deploying the app before binding the domain and certificate is out of order (binding should come after deployment). Option B is wrong because binding the domain before deploying the app is incorrect; the app must be deployed first to have the necessary endpoints and configuration for domain binding. Option C is wrong because binding the domain to the new plan before exporting the current plan and creating the new plan is logically impossible and violates the dependency order.

504
MCQhard

You are designing a solution that requires storing millions of small (1-5 KB) messages from IoT devices. Each message has a unique device ID and timestamp. You need to support efficient point queries by device ID and time range, and also support aggregation queries (e.g., count of messages per device per hour). Which Azure storage solution should you use?

A.Azure Cosmos DB for NoSQL
B.Azure Table Storage
C.Azure Queue Storage
D.Azure Blob Storage with JSON files
AnswerB

Azure Table Storage is a NoSQL key-value store highly optimized for storing massive amounts of structured, non-relational data, making it exceptionally cost-effective for small entities like IoT sensor readings. It provides highly efficient point queries using a composite PartitionKey and RowKey, which is ideal for retrieving specific device data by ID and timestamp. Its schema-less nature and scalability perfectly support millions of records for time-series data.

Why this answer

Azure Table Storage is the correct choice because it is a NoSQL key-value store optimized for storing large volumes of structured, non-relational data. It supports efficient point queries using the PartitionKey (device ID) and RowKey (timestamp), enabling fast retrieval by device ID and time range. Additionally, it allows aggregation queries like counting messages per device per hour via partition-scanned queries or client-side aggregation, and it is cost-effective for storing millions of small (1-5 KB) messages.

Exam trap

The trap here is that candidates often choose Azure Cosmos DB for NoSQL because of its query flexibility and indexing, overlooking the cost implications and the fact that Azure Table Storage provides sufficient query capabilities for simple key-value and range queries at a fraction of the cost.

How to eliminate wrong answers

Option A is wrong because Azure Cosmos DB for NoSQL, while capable of similar queries, is significantly more expensive and over-provisioned for storing millions of small messages; its throughput-based pricing model makes it cost-prohibitive for high-volume, low-value IoT data. Option C is wrong because Azure Queue Storage is a message queuing service for asynchronous communication, not a durable storage solution for point queries or aggregation; it does not support querying by device ID or time range. Option D is wrong because Azure Blob Storage with JSON files is designed for unstructured blob data and lacks native indexing for efficient point queries by device ID and timestamp; querying millions of small JSON files would require scanning all blobs or using external indexing, which is inefficient and costly.

505
MCQmedium

Your application uses Azure App Configuration with Microsoft Entra ID authentication. You want to ensure that only authorized services can read configuration values. What is the recommended approach?

A.Enable public network access only from trusted IPs
B.Use access keys and rotate them frequently
C.Store connection strings in Azure Key Vault and retrieve them at runtime
D.Assign the App Configuration Data Reader role to the managed identity of the consuming service
AnswerD

Assigning the App Configuration Data Reader role to the managed identity of the consuming service is the most secure and recommended approach. A managed identity provides an automatically managed identity in Azure Active Directory for Azure services, eliminating the need for developers to manage credentials. By assigning this specific Azure built-in role, the service is granted least-privilege access to read configuration data directly from App Configuration using its own identity, without any shared secrets or connection strings.

Why this answer

The recommended approach for authorizing access to Azure App Configuration with Microsoft Entra ID is to use role-based access control (RBAC). By assigning the 'App Configuration Data Reader' role to a managed identity, you grant that specific service identity read-only access to configuration values without exposing keys or connection strings. This aligns with the principle of least privilege and eliminates the security risks associated with shared access keys.

Exam trap

The trap here is that candidates often confuse storing connection strings in Key Vault (Option C) as the most secure approach, but the question specifically asks for the recommended approach with Entra ID authentication, which is to use managed identities and RBAC instead of any form of shared access keys.

How to eliminate wrong answers

Option A is wrong because enabling public network access from trusted IPs controls network-level access but does not authenticate or authorize the caller; it still relies on access keys or Entra ID tokens and does not eliminate the need for proper identity-based authorization. Option B is wrong because using access keys and rotating them frequently is a legacy approach that introduces shared secrets, which are more vulnerable to leakage and do not leverage Entra ID's managed identities for fine-grained, identity-based access control. Option C is wrong because storing connection strings in Azure Key Vault and retrieving them at runtime is a valid pattern for secrets management, but it still uses access keys (connection strings) rather than Entra ID authentication, and the consuming service would need permissions to the Key Vault, adding complexity without adopting the recommended identity-based approach.

506
Multi-Selectmedium

Which TWO actions should you take to ensure high availability for a stateful ASP.NET application deployed on Azure App Service?

Select 2 answers
A.Enable ARR Affinity (client affinity) to maintain session state.
B.Scale up the App Service plan to a higher tier.
C.Deploy the application to multiple regions and use Traffic Manager.
D.Store session state in Azure Files share.
E.Disable session state to allow any instance to handle requests.
AnswersA, C

Enabling ARR Affinity, also known as client affinity, ensures that all subsequent requests from a specific client are routed to the same App Service instance that handled the initial request. This mechanism is crucial for maintaining in-memory session state, preventing data loss or inconsistent user experiences if the application relies on server-side session variables. While it doesn't provide redundancy for the session state itself, it guarantees session stickiness, which is vital for the functional continuity of stateful applications within a scaled-out environment. It helps prevent session-related errors that could otherwise impact perceived availability.

Why this answer

Enabling ARR Affinity (client affinity) ensures that all requests from a given client session are routed to the same instance, preserving in-memory session state. Without this, a stateful ASP.NET application would lose session data if subsequent requests are load-balanced to different instances, causing session state errors.

Exam trap

The trap here is that candidates often confuse scaling up (Option B) with high availability, not realizing that scaling up only adds resources to a single instance, whereas high availability requires redundancy across instances or regions.

507
MCQeasy

You are designing a solution to store large amounts of unstructured data that is accessed infrequently (once a quarter). You need to minimize storage costs. Which Azure storage tier should you use?

A.Cold
B.Hot
C.Archive
D.Cool
AnswerD

The Cool access tier is ideal for infrequently accessed data that still requires quick retrieval, typically accessed every 30 days or more. It offers a balance between storage costs and access costs, being cheaper to store than Hot but more expensive to access. This tier is well-suited for scenarios like short-term backups, older media content, or data that is not actively used but may be needed on demand, aligning with the requirement for infrequently accessed data.

Why this answer

The Cool tier is designed for data that is accessed infrequently (about once a quarter) and stored for at least 30 days, offering lower storage costs than Hot while still providing low-latency access. Since the data is unstructured and accessed only quarterly, Cool balances cost and availability without the long retrieval time or minimum storage duration of Archive.

Exam trap

The trap here is that candidates confuse 'Cold' with 'Cool' or assume 'Archive' is always the cheapest option without considering retrieval latency and minimum storage duration penalties.

How to eliminate wrong answers

Option A (Cold) is wrong because Azure Storage does not have a 'Cold' tier; the correct tiers are Hot, Cool, and Archive. Option B (Hot) is wrong because it is optimized for frequent access (multiple times per day) and has the highest storage cost, making it unsuitable for infrequently accessed data. Option C (Archive) is wrong because while it has the lowest storage cost, it requires a retrieval time of up to 15 hours and a minimum storage duration of 180 days, which is excessive for quarterly access and would increase total cost due to early deletion fees.

508
MCQeasy

You are developing a solution that needs to run a background task every 10 minutes to clean up temporary files in Azure Blob Storage. You want to use Azure Functions with the Consumption Plan to minimize cost. Which trigger type should you use?

A.HTTPTrigger
B.TimerTrigger
C.BlobTrigger
D.ServiceBusTrigger
AnswerB

The TimerTrigger is the appropriate choice for executing Azure Functions on a predefined schedule, making it ideal for background tasks that need to run periodically. It leverages CRON expressions, allowing developers to specify precise execution intervals, such as every 10 minutes, daily, or on specific days of the week. This trigger is purpose-built for reliable, time-based task automation without requiring external orchestration.

Why this answer

B is correct because TimerTrigger is designed for scheduled execution of background tasks at fixed intervals, such as every 10 minutes. It uses a cron expression to define the schedule and runs on the Consumption Plan, which scales to zero when idle, minimizing cost. This makes it the ideal choice for periodic cleanup of temporary files in Azure Blob Storage.

Exam trap

The trap here is that candidates may confuse BlobTrigger (event-driven on blob changes) with a scheduled cleanup task, not realizing that TimerTrigger is the only trigger that natively supports recurring time-based execution without external dependencies.

How to eliminate wrong answers

Option A is wrong because HTTPTrigger requires an incoming HTTP request to invoke the function, making it unsuitable for a scheduled background task that must run autonomously every 10 minutes. Option C is wrong because BlobTrigger fires only when a new or updated blob is detected in a container, not on a fixed time schedule, so it cannot enforce a periodic cleanup routine. Option D is wrong because ServiceBusTrigger responds to messages arriving on a Service Bus queue or topic, which would require an external sender to produce messages every 10 minutes, adding unnecessary complexity and cost compared to a simple TimerTrigger.

509
MCQhard

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used? The architecture review board prefers a managed Azure-native control.

A.Azure DNS
B.Azure Event Grid
C.Azure Files
D.Azure Service Bus queue
AnswerB

Event Grid is designed for reactive event routing from Azure services and custom publishers.

Why this answer

Azure Event Grid is the correct choice because it is a fully managed event routing service designed for high-volume, lightweight event notifications using native event routing (HTTP push). It directly supports Azure resource events and serverless handlers like Azure Functions, aligning with the requirement for native event routing without polling or queuing overhead.

Exam trap

The trap here is confusing Azure Event Grid (push-based, lightweight event routing) with Azure Service Bus (pull-based, durable messaging), leading candidates to choose Service Bus for its familiarity with queuing, despite the requirement for native event routing.

How to eliminate wrong answers

Option A is wrong because Azure DNS is a domain name resolution service, not an event routing service; it cannot handle event notifications or trigger serverless handlers. Option C is wrong because Azure Files provides managed file shares via SMB/NFS protocols, which are unsuitable for event-driven, lightweight event routing. Option D is wrong because Azure Service Bus queue is a message broker for ordered, durable messaging with pull-based consumption, not a native event routing service for lightweight, push-based events.

510
MCQeasy

You are building a serverless application that needs to store user profile data. The data includes simple fields like name, email, and preferences. The data is frequently accessed by user ID. You need a schema-less, low-latency storage solution that is cost-effective for millions of small records. Which Azure Storage solution should you use?

A.Azure Blob Storage
B.Azure Queue Storage
C.Azure Table Storage
D.Azure File Storage
AnswerC

Azure Table Storage is a NoSQL key-value store optimized for storing large amounts of structured, non-relational data with a flexible schema. It provides highly scalable and low-latency access to data, making it ideal for user profiles where a unique identifier, like a user ID, can serve as the RowKey or PartitionKey. This design allows for efficient retrieval of individual entities, perfectly aligning with the requirements for storing and quickly accessing user data in a serverless application.

Why this answer

Azure Table Storage is a NoSQL key-value store that is schema-less, making it ideal for storing user profile data with varying fields like name, email, and preferences. It offers low-latency access by user ID via the PartitionKey and RowKey, and it is cost-effective for millions of small records because you pay only for the storage consumed, with no minimum charge per record.

Exam trap

The trap here is that candidates often confuse Azure Table Storage with Azure Cosmos DB for Table API, but the question specifically asks for a cost-effective solution for millions of small records, and Azure Table Storage (part of Azure Storage account) is the cheaper, schema-less option without the premium features and higher cost of Cosmos DB.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage is designed for unstructured binary or text data (e.g., images, videos, documents) and does not provide native key-value querying by user ID; it requires a separate index or metadata system for such lookups. Option B is wrong because Azure Queue Storage is a messaging service for asynchronous communication between application components, not a persistent storage solution for user profile data. Option D is wrong because Azure File Storage provides fully managed file shares accessible via SMB protocol, which is overkill for simple key-value records and incurs higher costs due to per-GB pricing and minimum share size requirements.

511
MCQhard

You have a blob as shown in the exhibit. You need to read the content of this blob. What must you do first?

A.Convert the blob to an AppendBlob type.
B.Use the Get-AzStorageBlobContent cmdlet to download the blob directly.
C.Set the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier.
D.Use the storage account key to access the blob.
AnswerC

Setting the access tier of the blob to Hot or Cool using Set-AzStorageBlobTier is the correct approach because blobs in the Archive tier are offline and not directly readable. This operation initiates a "rehydration" process, moving the blob's data from the low-cost, high-latency Archive tier to a more accessible tier. Once rehydration completes, which can take several hours depending on priority, the blob becomes online and its content can be read.

Why this answer

The blob in the exhibit is an archived blob, which is offline and cannot be read directly. You must first rehydrate it by setting its access tier to Hot or Cool using Set-AzStorageBlobTier, which initiates an asynchronous copy from the archive tier to an online tier. Only after rehydration completes can you read the blob content.

Exam trap

The trap here is that candidates assume a storage account key or a direct download cmdlet can access any blob, but Azure enforces the archive tier's offline state, requiring explicit rehydration before any read operation.

How to eliminate wrong answers

Option A is wrong because converting the blob to an AppendBlob type does not change its offline archive state; AppendBlob is a blob type for append operations, not a tier change, and the blob remains inaccessible. Option B is wrong because Get-AzStorageBlobContent attempts to download the blob directly, but an archived blob is offline and returns a 409 error (BlobArchived) until rehydrated. Option D is wrong because using the storage account key provides authentication but does not bypass the archive tier restriction; the blob is still offline and cannot be accessed regardless of credentials.

512
MCQeasy

You are developing a containerized application that will be deployed to Azure Container Instances (ACI). The application consists of a web front-end and a background worker that processes messages from an Azure Storage Queue. You need to ensure that the worker container runs continuously and processes messages as they arrive. The solution must minimize cost and management overhead. What should you do?

A.Use Azure Container Apps with a scale rule that triggers on queue length.
B.Run the worker inside an Azure virtual machine with a container runtime.
C.Deploy the worker as a container in ACI with the restart policy set to OnFailure.
D.Deploy the worker as a container group in ACI with the restart policy set to Always.
AnswerD

Deploying the worker as a container group in Azure Container Instances (ACI) with the restart policy set to `Always` is the most appropriate solution. ACI offers a serverless platform, eliminating the need to manage underlying virtual machines or orchestration infrastructure. The `Always` restart policy ensures that the container is automatically restarted by ACI if it stops for any reason, guaranteeing continuous availability for the worker process to handle incoming messages efficiently and cost-effectively.

Why this answer

ACI with a restart policy of Always ensures the worker container restarts immediately after it finishes processing a message, allowing it to continuously poll the Azure Storage Queue for new messages. This minimizes cost by using a serverless container model without provisioning VMs or managing orchestration, and it reduces management overhead compared to alternatives like Azure virtual machines.

Exam trap

The trap here is that candidates mistakenly choose the OnFailure restart policy (Option C) thinking it will restart the container after each message, but they overlook that a successful exit (exit code 0) does not trigger a restart, causing the worker to stop after processing one message.

How to eliminate wrong answers

Option A is wrong because Azure Container Apps introduces additional orchestration and scaling complexity, which increases cost and management overhead unnecessarily for a simple background worker that can run continuously in ACI. Option B is wrong because running the worker inside an Azure VM with a container runtime requires managing the VM, patching, and scaling, which increases cost and overhead compared to a serverless ACI solution. Option C is wrong because the OnFailure restart policy only restarts the container if it exits with a non-zero exit code, but a worker that processes messages successfully will exit with code 0 and stop, preventing it from continuously polling the queue.

513
MCQmedium

Your organization uses Azure Policy to enforce compliance. You need to ensure that all Azure SQL databases have Advanced Data Security (ADS) enabled. What type of Azure Policy effect should you use to automatically enable ADS if it is not already enabled?

A.Audit
B.Modify
C.Deny
D.DeployIfNotExists
AnswerD

Deploys the ADS configuration if missing, ensuring automatic remediation.

Why this answer

DeployIfNotExists effect can automatically enable Advanced Data Security (ADS) on Azure SQL databases if it is not already enabled, by deploying the necessary configuration. Option A (Audit) only audits compliance but does not remediate. Option B (Modify) is typically used for tags and not for enabling ADS.

Option C (Deny) blocks creation of non-compliant resources but does not automatically enable ADS on existing resources. Therefore, D is correct.

514
MCQhard

Your company deploys a microservices architecture on Azure Kubernetes Service (AKS). The application consists of a frontend service, an order service, and a payment service. The order service writes messages to an Azure Service Bus queue, and the payment service processes them. You need to ensure that the payment service can scale independently based on the queue length, and that the processing is fault-tolerant: if the payment service crashes during message processing, the message should not be lost and should be retried. You also need to minimize cost by reducing the number of idle instances. You configure the payment service as an Azure Function triggered by the Service Bus queue. Which configuration options should you set?

A.Use an Azure Storage Queue instead of Service Bus. Set the function's batchSize to 10.
B.Disable retries completely to avoid duplicate processing.
C.Set the function to run on a fixed instance count of 3.
D.Set maxDeliveryCount to 5 in the Service Bus queue. Configure the Azure Function's scaling mode to 'Scale based on the number of messages in the queue'.
AnswerD

maxDeliveryCount provides retries; scaling based on queue length optimizes cost.

Why this answer

Setting maxDeliveryCount to 5 on the Service Bus queue ensures that if the payment service crashes during processing, the message is not lost and will be retried up to 5 times. Configuring the Azure Function's scaling mode to 'Scale based on the number of messages in the queue' allows the function to scale out dynamically based on queue length, minimizing idle instances and reducing cost. This combination provides fault-tolerant processing and cost-efficient scaling for the microservices architecture.

Exam trap

The trap here is that candidates may think fixed instance counts or disabling retries are simpler solutions, but they fail to meet both the fault-tolerance and cost-minimization requirements simultaneously, while D correctly leverages Service Bus's built-in retry mechanism and Azure Functions' dynamic scaling.

How to eliminate wrong answers

Option A is wrong because using an Azure Storage Queue instead of Service Bus would not provide the same level of fault tolerance (e.g., no built-in dead-lettering or max delivery count) and setting batchSize to 10 does not address scaling based on queue length or retry behavior. Option B is wrong because disabling retries completely would cause message loss if the payment service crashes during processing, violating the fault-tolerance requirement. Option C is wrong because setting a fixed instance count of 3 prevents dynamic scaling based on queue length, leading to either idle instances (increasing cost) or insufficient capacity during spikes, and does not address retry behavior.

515
Multi-Selecteasy

You are developing an Azure Functions app that processes events from an Event Hubs instance. The function must scale out automatically based on the number of partitions in the Event Hub. You need to ensure that each function instance processes events from at least one partition. Which TWO configurations should you use?

Select 2 answers
A.Set the function app to use the 'Event Scale' mode with a target of one instance per partition.
B.Set the 'MaxBatchSize' property to 1 to ensure even distribution.
C.Configure the function to use an event processor host with blob storage for checkpointing.
D.Select the Premium App Service plan for the function app.
E.Use the EventHubs trigger with the 'PartitionKey' parameter set to the partition ID.
AnswersA, C

Event Scale mode maximizes parallelism per partition.

Why this answer

The 'Event Scale' mode with a target of one instance per partition ensures that the function app scales out to match the number of Event Hub partitions, with each instance processing events from at least one partition. Option C is correct because an event processor host with blob storage for checkpointing enables load balancing across multiple instances, ensuring each instance handles one or more partitions. Option E is incorrect because 'PartitionKey' is used when sending events to Event Hubs to assign a partition, not in the trigger binding; the trigger automatically distributes partitions across instances.

Exam trap

The trap here is that candidates confuse batch size configuration (MaxBatchSize) with scaling behavior, or assume a Premium plan is mandatory for partition-level scaling, when in fact the Event Scale mode and checkpointing are the key mechanisms.

516
MCQeasy

You need to grant access to a blob stored in Azure Blob Storage for 30 minutes to a user who does not have an Azure account. Which security mechanism should you use?

A.Azure RBAC roles
B.Storage account access keys
C.Managed identity
D.Shared Access Signature (SAS) token
AnswerD

A Shared Access Signature (SAS) token is a URI that grants delegated access to specific Azure Storage resources with granular permissions and a defined validity period. It allows clients to access resources like a single blob, a container, or even an entire storage account, without sharing the storage account key or requiring an Azure AD identity. SAS tokens are ideal for securely providing time-limited, restricted access to external users or applications, ensuring the principle of least privilege.

Why this answer

A Shared Access Signature (SAS) token is the correct choice because it provides delegated, time-limited access to a specific blob resource without requiring the user to have an Azure account. You can set the token's expiry to 30 minutes, granting temporary access via a URI that includes the necessary authentication parameters. This mechanism is designed for scenarios where you need to grant granular, time-bound access to external users or clients.

Exam trap

The trap here is that candidates often confuse SAS tokens with storage account access keys, mistakenly thinking keys can be scoped or time-limited, or they assume RBAC can be used for external users without understanding the Azure AD dependency.

How to eliminate wrong answers

Option A is wrong because Azure RBAC roles require the user to have an Azure Active Directory identity and an Azure subscription, which is not the case here. Option B is wrong because storage account access keys grant full administrative access to the entire storage account and cannot be scoped to a single blob or time-limited; sharing keys also exposes the account to security risks. Option C is wrong because managed identity is intended for Azure resources (e.g., VMs, App Services) to authenticate to Azure services without storing credentials, not for granting access to external users without an Azure account.

517
MCQmedium

You are monitoring an Azure web app using Application Insights. You need to create a query that returns the average duration of requests for each HTTP method (GET, POST, etc.) over the last hour, sorted by duration. Which Kusto query should you use?

A.requests | summarize avg(duration) by method | order by avg_duration desc
B.requests | summarize avg(duration) by method | sort by method asc
C.requests | where timestamp > ago(1h) | summarize avg(duration) by method | order by avg_duration desc
D.requests | where timestamp > ago(1h) | summarize avg(duration) by method | sort by method
AnswerC

This KQL query is correctly structured for monitoring recent web app performance. The `where timestamp > ago(1h)` clause efficiently filters the data to only the last hour, ensuring relevance for current operational insights. It then accurately calculates the `avg(duration)` for each `method` and presents the results ordered in `descending` fashion by this average duration, highlighting the slowest request types immediately.

Why this answer

It first filters requests to only those from the last hour using `where timestamp > ago(1h)`, then calculates the average duration grouped by HTTP method with `summarize avg(duration) by method`, and finally orders the results by the computed average duration in descending order using `order by avg_duration desc`. This matches the requirement exactly: last hour, average duration per method, sorted by duration.

Exam trap

The trap here is that candidates often forget to apply the time filter (`where timestamp > ago(1h)`) or mistakenly sort by the method name instead of the computed average duration, because the question explicitly says 'sorted by duration' but the options include plausible but incorrect sort columns.

How to eliminate wrong answers

Option A is wrong because it omits the time filter (`where timestamp > ago(1h)`), so it would return average durations across all historical data, not just the last hour. Option B is wrong because it also lacks the time filter and sorts by method name ascending instead of by average duration, which does not satisfy the 'sorted by duration' requirement. Option D is wrong because although it correctly filters to the last hour and summarizes by method, it sorts by the method name (alphabetically) rather than by the average duration, failing the 'sorted by duration' condition.

518
MCQhard

You are designing a solution that uses Azure Batch for parallel processing of large datasets. Each task requires significant CPU and memory. You need to minimize compute costs while ensuring tasks complete within a deadline. Which pool configuration should you use?

A.A mix of dedicated and low-priority VMs without retry
B.Low-priority VMs with a task retry policy
C.Use Azure Container Instances instead of Batch
D.Dedicated VMs only
AnswerB

This approach is optimal for cost-effective large-scale parallel processing in Azure Batch. Low-priority VMs offer significant cost savings by utilizing surplus Azure capacity, making them ideal for workloads that can tolerate interruptions. The crucial addition of a task retry policy ensures that if a low-priority VM is preempted and a task is interrupted, Azure Batch automatically reschedules and restarts that task on another available node. This combination guarantees eventual task completion and maintains the overall reliability of the solution while dramatically reducing compute costs.

Why this answer

Low-priority VMs (now called Spot VMs) offer significant cost savings but can be preempted. Using them with a task retry policy ensures completion. Dedicated VMs are more expensive.

519
MCQmedium

You are building a solution that uploads large files (up to 100 GB) to Azure Blob Storage. Users frequently experience timeout errors when uploading files over slow network connections. Which approach should you use to maximize reliability?

A.Upload the file as a page blob in 512-byte chunks.
B.Use the Azure Storage SDK to upload the file as a block blob with multiple parallel blocks and implement retry logic with exponential backoff.
C.Increase the client-side timeout value to 10 minutes.
D.Use AzCopy with the /Z parameter to enable checkpointing.
AnswerB

This is the correct approach for uploading large files to Azure Storage. Block blobs are optimized for large, sequential data uploads, allowing files to be broken into independent blocks that can be uploaded in parallel, significantly improving throughput and reducing total upload time. The Azure Storage SDK inherently supports this parallelization and provides robust, configurable retry logic with exponential backoff, which is crucial for handling transient network issues and service throttling, ensuring reliable delivery of the entire file even under adverse conditions.

Why this answer

Uploading a large file as a block blob with multiple parallel blocks maximizes throughput and reliability over slow networks. The Azure Storage SDK automatically splits the file into blocks (up to 100 MB each), uploads them concurrently, and implements retry logic with exponential backoff to handle transient failures. This approach is specifically designed for large file uploads and mitigates timeout errors by keeping individual block transfers small and resumable.

Exam trap

The trap here is that candidates may confuse AzCopy's checkpointing (Option D) as the only reliable method for large uploads, but the question specifies building a solution (SDK-based), not using a standalone tool, and AzCopy cannot be programmatically embedded in an application.

How to eliminate wrong answers

Option A is wrong because page blobs are optimized for random read/write access (e.g., VHDs), not for large file uploads; they require 512-byte alignment and do not support parallel upload with retry logic for slow networks. Option C is wrong because simply increasing the client-side timeout to 10 minutes does not address the root cause of timeouts over slow connections; it only delays the failure and does not provide resumability or parallelism. Option D is wrong because AzCopy with the /Z parameter enables checkpointing for resuming interrupted transfers, but it is a command-line tool, not a programmatic SDK approach; the question asks for a solution you are building, implying code-level integration, and AzCopy is not suitable for embedding in an application.

520
MCQeasy

A company deploys an Azure Function app that processes orders. The function needs to scale out automatically when the queue length grows and be billed only for execution time. Which hosting plan should you use?

A.App Service Plan
B.Consumption Plan
C.Premium Plan
D.Dedicated Plan
AnswerB

The Consumption Plan is the quintessential serverless hosting option for Azure Functions, automatically provisioning and scaling compute resources on demand in response to events. It charges only for the resources consumed (memory, CPU) and the execution time, billed per second, making it highly cost-efficient for intermittent or variable workloads. This plan eliminates the need to manage infrastructure and ensures costs directly align with actual function usage for processing orders.

Why this answer

The Consumption Plan is correct because it automatically scales out the function app based on the length of the Azure Storage queue trigger, and you are billed only for the execution time (per-second billing) and resources consumed. This plan is ideal for event-driven workloads like order processing, where scaling is demand-driven and idle time incurs no cost.

Exam trap

The trap here is that candidates often confuse the Premium Plan's pre-warmed instances and VNET support with the Consumption Plan's true pay-per-execution model, mistakenly thinking Premium is required for auto-scaling, when in fact the Consumption Plan handles queue-length-based scaling natively and is the only plan with pure execution-time billing.

How to eliminate wrong answers

Option A is wrong because the App Service Plan runs on dedicated VMs and incurs continuous billing even when the function is idle, and it does not provide automatic scale-out based solely on queue length without manual configuration or auto-scale rules. Option C is wrong because the Premium Plan, while offering pre-warmed instances and VNET connectivity, incurs a baseline cost for always-ready instances and is not billed purely on execution time like the Consumption Plan. Option D is wrong because the Dedicated Plan is essentially the same as the App Service Plan, running on reserved instances with continuous billing and no built-in queue-length-based auto-scaling without additional setup.

521
MCQhard

A system receives high-volume event notifications from Azure resources and routes them to serverless handlers. Events are lightweight and should use native event routing. Which service should be used?

A.Azure DNS
B.Azure Event Grid
C.Azure Files
D.Azure Service Bus queue
AnswerB

Event Grid is designed for reactive event routing from Azure services and custom publishers.

Why this answer

Azure Event Grid is the correct choice because it is a fully managed event routing service designed for high-volume, lightweight event notifications using native event routing (HTTP-based push model). It supports serverless handlers like Azure Functions and automatically delivers events to subscribers with built-in retry and dead-lettering, making it ideal for reacting to Azure resource state changes.

Exam trap

The trap here is confusing Azure Event Grid (push-based, lightweight event routing) with Azure Service Bus (pull-based, message queuing), leading candidates to choose Service Bus for event scenarios when Event Grid is the native, serverless-optimized choice.

How to eliminate wrong answers

Option A is wrong because Azure DNS is a domain name resolution service (translates domain names to IP addresses) and does not handle event routing or serverless event processing. Option C is wrong because Azure Files provides fully managed file shares accessible via SMB or NFS protocols, not event notification or routing capabilities. Option D is wrong because Azure Service Bus queue is a message broker designed for reliable, ordered message delivery with features like sessions and transactions, but it uses pull-based messaging and is not optimized for lightweight, native event routing; it is better suited for decoupled messaging with complex processing requirements.

522
MCQmedium

You have an Azure App Service web app that experiences high CPU usage during peak hours. You need to scale out automatically based on CPU load. What should you configure?

A.Manually increase the instance count during peak hours.
B.Configure an autoscale rule to scale up the App Service plan.
C.Configure an autoscale rule to scale out based on CPU percentage.
D.Use Azure Front Door to distribute load across multiple instances.
AnswerC

Configuring an autoscale rule to "scale out" based on CPU percentage is the most effective solution for an Azure App Service web app experiencing high variability. Scaling out dynamically adds more instances of the web app to the App Service plan when the average CPU utilization across existing instances exceeds a defined threshold. This horizontal scaling distributes the incoming load across multiple instances, ensuring consistent performance and responsiveness during peak demand without manual intervention.

Why this answer

Azure App Service autoscale rules allow you to scale out (increase instance count) based on a metric like CPU percentage. This automatically adds more instances when CPU exceeds a threshold, distributing the load and reducing CPU usage per instance during peak hours.

Exam trap

The trap here is that candidates often confuse 'scale up' (changing the plan tier) with 'scale out' (adding instances), and may incorrectly select Option B thinking it addresses CPU load, but scaling up does not increase instance count.

How to eliminate wrong answers

Option A is wrong because manually increasing the instance count is not an automatic solution; it requires human intervention and does not meet the requirement to scale automatically. Option B is wrong because 'scale up' refers to increasing the resources (e.g., SKU size) of the App Service plan, not adding more instances; scaling up changes the plan tier (e.g., from Standard to Premium) and does not directly address high CPU load via horizontal scaling. Option D is wrong because Azure Front Door is a global load balancer and CDN service that distributes traffic at the application layer, but it does not automatically scale the number of instances; it can route traffic to multiple instances but does not configure autoscaling rules based on CPU load.

523
MCQmedium

You are monitoring an Azure Web App with Application Insights. You notice that the dependency duration for a SQL database call has significantly increased. You need to identify the specific SQL query that is causing the slowness. Which Application Insights feature should you use?

A.Application Map
B.Performance blade and drill into Dependencies
C.Live Metrics Stream
D.Smart Detection
AnswerB

The Performance blade within Application Insights is specifically designed to analyze the performance of various operations, including external dependencies. By navigating to the 'Dependencies' tab within this blade, users can view a comprehensive list of all dependency calls, such as SQL database interactions. Crucially, it provides detailed telemetry including the full SQL query text, average duration, call count, and success rate, enabling precise identification and investigation of slow or failing database queries.

Why this answer

The Performance blade in Application Insights allows you to drill into specific operations, including dependencies. By selecting the SQL dependency with increased duration, you can view the 'Dependencies' tab to see the exact SQL query text, duration, and other details. This directly identifies the slow query without needing to instrument code changes.

Exam trap

The trap here is that candidates often confuse the high-level monitoring view (Application Map) or real-time streaming (Live Metrics) with the diagnostic drill-down capability of the Performance blade, which is specifically designed for root-cause analysis of slow operations.

How to eliminate wrong answers

Option A is wrong because Application Map provides a visual overview of component interactions and dependency health, but it does not show the specific SQL query text or allow drilling into individual slow queries. Option C is wrong because Live Metrics Stream shows real-time performance data but does not retain historical query details or allow deep analysis of specific slow dependencies. Option D is wrong because Smart Detection proactively alerts on anomalies but does not provide the raw query text or a drill-down interface to identify the specific SQL statement causing slowness.

524
MCQeasy

You need to send notifications to mobile devices when a new file is uploaded to Azure Blob Storage. Which Azure service should you use to route the event to a notification hub?

A.Azure Service Bus
B.Azure Queue Storage
C.Azure Event Grid
D.Azure Event Hubs
AnswerC

Azure Event Grid is the correct choice because it is a fully managed event routing service designed for building reactive, event-driven architectures. It enables you to easily publish events from various sources and deliver them to multiple subscribers, including Azure Functions or Logic Apps, which can then trigger mobile notifications. Its publish-subscribe model and ability to filter events make it ideal for efficiently fanning out discrete events to diverse endpoints for real-time alerts.

Why this answer

Azure Event Grid is the correct choice because it provides a fully managed event routing service that can react to Blob Storage events (such as 'BlobCreated') and deliver them directly to Azure Notification Hubs. This enables push notifications to mobile devices without polling or custom middleware, using a publish-subscribe model with low latency.

Exam trap

The trap here is confusing event-driven routing (Event Grid) with message queuing (Service Bus or Queue Storage) or data streaming (Event Hubs), leading candidates to pick a wrong option that handles different workloads like ordered processing or high-throughput ingestion.

How to eliminate wrong answers

Option A is wrong because Azure Service Bus is a message broker designed for enterprise messaging, command-and-control patterns, and ordered delivery, not for event-driven routing to Notification Hubs. Option B is wrong because Azure Queue Storage is a simple message queue for decoupling components, but it lacks built-in event filtering and direct integration with Notification Hubs for push notifications. Option D is wrong because Azure Event Hubs is optimized for high-throughput telemetry ingestion and big data streaming, not for event routing to Notification Hubs with event subscription capabilities.

525
MCQeasy

You are developing an Azure Function that processes messages from an Azure Storage queue. The function must handle transient failures when writing to a downstream database. You need to implement a retry policy. What is the recommended approach?

A.Do nothing; Azure Functions automatically retries failed executions indefinitely.
B.Use a try-catch block in the function code to retry on failure.
C.Configure the retry policy in the function's host.json file.
D.Use Durable Functions with a retry policy.
AnswerC

Configuring the retry policy within the function's `host.json` file is the recommended and most efficient method for handling transient failures in Azure Functions. This built-in capability allows developers to declaratively specify retry counts, delay strategies (fixed or exponential backoff), and maximum retry intervals, offloading the retry logic from application code to the robust runtime.

Why this answer

Azure Functions provides a built-in retry policy that can be configured declaratively in the host.json file, specifically using the 'retry' section for fixed-delay or exponential-backoff strategies. This is the recommended approach for handling transient failures in a clean, configurable manner without custom code, and it applies to all function executions in the function app.

Exam trap

The trap here is that candidates often assume custom try-catch logic (Option B) is the only way to implement retries, overlooking the fact that Azure Functions provides a declarative, built-in retry mechanism in host.json that is simpler and more maintainable.

How to eliminate wrong answers

Option A is wrong because Azure Functions does not automatically retry failed executions indefinitely; the default behavior is to retry up to a limited number of times (e.g., 5 for consumption plan) with a delay, but this is not indefinite and can be overridden. Option B is wrong because using a try-catch block to implement custom retry logic is error-prone, mixes concerns, and bypasses the built-in retry infrastructure that handles backoff, poison messages, and logging consistently. Option D is wrong because Durable Functions with a retry policy is overkill for a simple queue-triggered function; it introduces orchestration overhead and is intended for long-running workflows, not for transient database write failures in a straightforward message processing scenario.

Page 6

Page 7 of 12

Page 8