AZ-204 Practice Question: Monitor, troubleshoot, and optimize Azure solutions
Network Topology
Refer to the exhibit. You run these Azure CLI commands for an Azure Function app. When the app is accessed from https://app.contoso.com, what is the expected behavior?
⚠ Common exam trap
Candidates often confuse CORS with authentication or authorization, assuming that adding an origin somehow restricts HTTP methods or enables FTPS, when in fact CORS only controls cross-origin browser access and does not affect direct server-to-server or non-browser requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requests from the allowed origin are accepted
The Azure CLI commands shown configure CORS (Cross-Origin Resource Sharing) for the Function App. The `az functionapp cors add` command adds `https://app.contoso.com` as an allowed origin, and `az functionapp cors show` confirms that this origin is in the allowed list. When a browser-based client at `https://app.contoso.com` makes a request to the Function App, the browser checks the `Access-Control-Allow-Origin` response header. Since the origin matches, the browser permits the request to proceed, and the Function App processes it normally. Therefore, requests from the allowed origin are accepted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only GET requests are allowed
Why it's wrong here
The `az webapp cors add` command primarily configures the `Access-Control-Allow-Origin` header, which dictates which origins are permitted to make cross-origin requests. It does not, by default, impose restrictions on the HTTP methods (like GET, POST, PUT, DELETE) that can be used from an allowed origin. Method restrictions are typically handled by the application's API implementation or by explicitly configuring `Access-Control-Allow-Methods` if a preflight request is involved, which is not implied by merely adding an origin.
- ✓
Requests from the allowed origin are accepted
Why this is correct
The `az webapp cors add --origins https://app.contoso.com` command successfully configures the Azure Web App's Cross-Origin Resource Sharing (CORS) policy. This action explicitly adds `https://app.contoso.com` to the list of allowed origins, meaning that web browsers will permit JavaScript code running on `https://app.contoso.com` to make cross-origin HTTP requests to the web app. Consequently, requests originating from this specific URL will be accepted and processed according to the CORS specification.
- ✗
Requests are blocked because FTPS is required
Why it's wrong here
FTPS (File Transfer Protocol Secure) is a protocol exclusively used for secure file transfer operations, primarily for deploying application code and content to an Azure Web App's underlying file system. It has no bearing whatsoever on how client-side web applications interact with the web app's runtime HTTP/HTTPS endpoints. CORS addresses browser-based security for HTTP requests, making FTPS entirely irrelevant to the success or failure of cross-origin API calls.
- ✗
All requests are blocked because no origins are allowed
Why it's wrong here
The execution of the `az webapp cors add` command with `https://app.contoso.com` as a specified origin directly modifies the web app's CORS configuration. This command explicitly instructs the Azure Web App to include `https://app.contoso.com` in its `Access-Control-Allow-Origin` response header. Therefore, it is incorrect to assert that no origins are allowed, as this specific origin has been successfully configured to permit cross-origin requests.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.