CCNA Connect Consume Services Questions — Page 3 of 4

151

MCQmedium

You are building an Azure Logic App that calls an external REST API secured with the OAuth 2.0 client credentials flow. You have registered an app in Microsoft Entra ID with client ID and client secret stored in Azure Key Vault. The Logic App uses a system-assigned managed identity with Get permission on the secret. Which action should you use in the Logic App designer to authenticate to the API?

A.HTTP action with 'Active Directory OAuth' authentication type, referencing the client ID and client secret

B.HTTP action with 'Managed Identity' authentication type

C.Invoke an API with OAuth predefined connector

D.HTTP action with 'Basic' authentication and pass the secret as password

AnswerA

This option correctly leverages the "Active Directory OAuth" authentication type within the Logic Apps HTTP action. This type is specifically designed for scenarios where a client application (like a Logic App) needs to obtain an access token from Microsoft Entra ID (formerly Azure AD) using its own identity, rather than on behalf of a user. By providing the client ID and client secret, the Logic App performs the OAuth 2.0 Client Credentials flow, allowing it to authenticate and acquire a token to call the external REST API securely.

Why this answer

The OAuth 2.0 client credentials flow requires a client ID and client secret to obtain an access token from Microsoft Entra ID. The HTTP action's 'Active Directory OAuth' authentication type directly supports this flow, allowing you to reference the client ID and the client secret stored in Azure Key Vault. The Logic App's system-assigned managed identity has Get permission on the secret, enabling it to retrieve the secret at runtime without exposing it in the workflow definition.

Exam trap

The trap here is that candidates confuse 'Managed Identity' authentication (which works only for Azure resources like Azure SQL or Storage) with the need to authenticate to an external API using OAuth client credentials, leading them to incorrectly select Option B instead of the HTTP action with Active Directory OAuth.

How to eliminate wrong answers

Option B is wrong because the 'Managed Identity' authentication type is used to authenticate to Azure resources that support managed identity (e.g., Azure Storage, Azure SQL), not to external REST APIs secured with OAuth 2.0 client credentials; it cannot provide a client ID and client secret for token acquisition. Option C is wrong because 'Invoke an API with OAuth predefined connector' is not a built-in Logic App action; there is no generic 'OAuth predefined connector' that dynamically handles client credentials with Key Vault secrets—connectors are specific to services like Microsoft Graph or Salesforce. Option D is wrong because 'Basic' authentication sends the client ID and secret as a plaintext username:password pair in the HTTP Authorization header, which violates the OAuth 2.0 client credentials flow that requires a token endpoint exchange and does not support Basic auth for bearer token issuance.

Practice this question →

152

MCQhard

You are developing a solution that processes events from Azure Event Hubs and stores them in Azure Blob Storage. The processing must be idempotent and exactly-once. Which approach should you use?

A.Use EventProcessorHost with checkpointing and blob leases to track processed events

B.Use Azure Functions with Event Hubs trigger and store events in batches

C.Use a simple consumer group and delete events after reading from Event Hubs

D.Implement a transactional outbox pattern with Azure SQL Database

AnswerA

EventProcessorHost (or the modern EventProcessorClient) is the recommended pattern for robustly consuming events from Azure Event Hubs. It automatically manages partition ownership across multiple instances using blob leases in Azure Storage, ensuring that each partition is processed by only one consumer instance at a time. Checkpointing involves periodically recording the last successfully processed event's offset and sequence number to blob storage, allowing the consumer to resume processing from the correct point after failures or rebalancing, thereby achieving at-least-once delivery and enabling idempotent processing for effective exactly-once semantics.

Why this answer

The EventProcessorHost (EPH) pattern with checkpointing and blob leases provides the foundation for exactly-once processing in Event Hubs. Checkpointing records the offset of the last successfully processed event in Azure Blob Storage, while blob leases ensure partition ownership and prevent duplicate processing by competing consumers. This combination allows the processor to resume from the last checkpoint after a failure, guaranteeing that each event is processed exactly once.

Exam trap

The trap here is that candidates often confuse 'at-least-once' delivery (which is the default for Event Hubs and Azure Functions) with 'exactly-once' processing, and they overlook the critical role of checkpointing and lease management in achieving idempotent, exactly-once semantics.

How to eliminate wrong answers

Option B is wrong because Azure Functions with Event Hubs trigger does not natively guarantee exactly-once processing; it can result in at-least-once delivery due to retries and lack of built-in idempotency enforcement. Option C is wrong because deleting events after reading from Event Hubs is not supported (Event Hubs does not allow event deletion) and consumer groups do not provide idempotent or exactly-once guarantees. Option D is wrong because the transactional outbox pattern is designed for reliable message publishing from a database, not for idempotent consumption from Event Hubs, and it introduces unnecessary complexity and latency for this scenario.

Practice this question →

153

MCQeasy

Your company uses Azure Logic Apps to automate workflows. A workflow must call an external REST API that requires an API key in the header. You need to securely store the API key and reference it in the Logic App without exposing it in the workflow definition. What should you do?

A.Store the API key in plain text directly in the Logic App HTTP action header.

B.Store the API key in Azure Key Vault and use the Key Vault connector to retrieve it dynamically in the Logic App.

C.Store the API key in an App Service application setting and reference it using the 'appsetting' expression.

D.Create an Azure Function with the API key hardcoded as an environment variable and call it from the Logic App.

AnswerB

This securely stores the key in Key Vault and allows the Logic App to reference it at runtime without exposing it in the definition.

Why this answer

Azure Key Vault provides a secure, centralized store for secrets like API keys, and the Logic App Key Vault connector retrieves the key at runtime without exposing it in the workflow definition. This approach ensures the secret is never stored in plain text within the Logic App's JSON definition or source control, aligning with Azure security best practices for managed identities and access policies.

Exam trap

The trap here is that candidates may confuse App Service application settings (Option C) with Logic App environment variables, but Logic Apps do not support the 'appsetting' expression, and Azure Key Vault is the only secure, native way to inject secrets into Logic Apps without exposing them in the definition.

How to eliminate wrong answers

Option A is wrong because storing the API key in plain text directly in the HTTP action header exposes the secret in the workflow definition, which can be viewed by anyone with read access to the Logic App and is a severe security risk. Option C is wrong because App Service application settings are designed for App Service apps, not Logic Apps; the 'appsetting' expression is not supported in Logic Apps, and even if it were, the setting would be stored in plain text in the App Service configuration. Option D is wrong because hardcoding the API key as an environment variable in an Azure Function still stores the secret in plain text within the Function's configuration, and calling a separate Azure Function adds unnecessary complexity and latency without improving security over directly using Key Vault.

Practice this question →

154

MCQhard

You are developing a web application that relies on a third-party weather API. The API has a rate limit of 10 requests per second per API key. You need to ensure your application never exceeds this limit and also caches responses for 10 minutes to reduce call frequency. Which combination of Azure services should you implement?

A.Azure Functions with Durable Functions to throttle calls and a static in-memory cache.

B.Azure Logic Apps with a retry policy and a cache using Azure Redis Cache.

C.Azure API Management with rate-limit and caching policies.

D.Azure Traffic Manager to distribute requests and Azure Front Door for caching.

AnswerC

Azure API Management is specifically designed to act as a facade for APIs, offering robust, declarative policies for both rate limiting and caching. Its `rate-limit-by-key` or `rate-limit` policies can effectively throttle calls to the third-party API, preventing exceeding quotas, while its response caching policies significantly reduce latency and load by serving cached responses directly, improving overall application performance and resilience.

Why this answer

Azure API Management (APIM) provides built-in rate-limit and caching policies that directly address the requirements: the `rate-limit` policy enforces a per-key request quota (e.g., 10 calls/second), and the `cache-store`/`cache-lookup` policies cache responses for a configurable duration (e.g., 10 minutes). This eliminates the need for custom throttling logic or external caching services, making it the most straightforward and maintainable solution.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a combination of services (e.g., Functions + Redis) when Azure API Management's single, purpose-built policy set directly solves both rate limiting and caching without custom code.

How to eliminate wrong answers

Option A is wrong because Durable Functions are designed for orchestrating long-running workflows, not for fine-grained per-second rate limiting, and a static in-memory cache in a serverless function app is not shared across instances, leading to cache inconsistency and potential rate-limit breaches. Option B is wrong because Azure Logic Apps' retry policy handles transient failures but does not provide proactive rate limiting, and Azure Redis Cache, while a valid distributed cache, adds unnecessary complexity and cost when APIM's built-in caching suffices. Option D is wrong because Azure Traffic Manager distributes traffic at the DNS level for global load balancing and does not enforce per-key rate limits, and Azure Front Door's caching is for static content at the edge, not for API response caching with per-key granularity.

Practice this question →

155

MCQhard

An application uses Azure Event Hubs to ingest telemetry data. The team wants to process the data in near real-time and store aggregated results in Azure SQL Database. Which Azure service should they use?

A.Azure HDInsight

B.Azure Functions

C.Azure Stream Analytics

D.Azure Data Lake Storage Gen2

AnswerC

Azure Stream Analytics is a fully managed, real-time analytics service specifically designed for processing large volumes of streaming data from sources like Azure Event Hubs. It enables users to define complex event processing (CEP) queries using a SQL-like language to filter, aggregate, and transform data in motion, often incorporating windowing functions for time-based analysis. This service is ideal for scenarios requiring low-latency insights from telemetry, allowing direct output to various sinks, including Azure SQL Database, for immediate consumption or further analysis.

Why this answer

Azure Stream Analytics is the correct choice because it is a fully managed stream processing engine designed for real-time analytics on high-throughput data from sources like Event Hubs. It can ingest telemetry data, apply SQL-based queries for aggregation (e.g., tumbling windows), and output results directly to Azure SQL Database with exactly-once semantics, meeting the near-real-time requirement.

Exam trap

The trap here is that candidates often confuse Azure Functions as a real-time stream processor, but it lacks native windowed aggregation and state management, making Stream Analytics the correct choice for this specific near-real-time aggregation requirement.

How to eliminate wrong answers

Option A is wrong because Azure HDInsight is a big data batch/processing platform (Hadoop/Spark) that is overkill for simple near-real-time aggregation and introduces significant operational overhead; it is not optimized for low-latency stream processing from Event Hubs to SQL Database. Option B is wrong because Azure Functions can process Event Hubs events but lacks built-in windowed aggregation and stateful stream processing capabilities, making it unsuitable for computing aggregated results like sums or averages over time windows without complex custom code. Option D is wrong because Azure Data Lake Storage Gen2 is a hierarchical storage service for big data analytics, not a real-time processing engine; it cannot perform aggregations or write directly to Azure SQL Database.

Practice this question →

156

Multi-Selectmedium

Which THREE actions should you take to securely access Azure Key Vault from an Azure App Service? (Choose three.)

Select 3 answers

A.Configure network restrictions on the Key Vault to allow only the App Service's outbound IP.

B.Grant the managed identity the 'Key Vault Secrets User' role.

C.Enable managed identity on the App Service.

D.Use DefaultAzureCredential in the application code.

E.Store the Key Vault URL and a client secret in App Service application settings.

AnswersB, C, D

This role allows reading secrets from Key Vault.

Why this answer

Granting the managed identity the 'Key Vault Secrets User' role uses Azure RBAC to authorize the App Service to read secrets from Key Vault without requiring any keys or secrets to be stored in the application. This aligns with the principle of least privilege and eliminates the need for client secrets or certificates in code or configuration.

Exam trap

The trap here is that candidates often think network restrictions (Option A) are sufficient for security, but they overlook the dynamic nature of App Service outbound IPs and the need for identity-based access control, leading them to choose a less secure and less reliable option.

Practice this question →

157

MCQmedium

You are reviewing an ARM template that deploys an Azure App Service. The template sets an app setting 'MyApiKey' that references a Key Vault secret. However, the deployment fails with an error that the app service cannot access the secret. What is the most likely cause?

A.The Key Vault reference syntax '@Microsoft.KeyVault(SecretUri=...)' is incorrect.

B.The ARM template cannot use Key Vault references in app settings.

C.The secret name in the URI does not match the actual secret name.

D.The App Service does not have a managed identity enabled and the Key Vault access policy is missing.

AnswerD

For an Azure App Service to successfully retrieve a secret using a Key Vault reference, it must first be configured with a system-assigned or user-assigned managed identity. Subsequently, this managed identity requires an explicit access policy within the target Azure Key Vault, granting it 'Get' permissions on secrets. Without both the enabled managed identity and the corresponding Key Vault access policy, the App Service lacks the necessary authentication and authorization to resolve the secret, leading to a runtime failure.

Why this answer

An Azure App Service must have a managed identity enabled and the Key Vault must have an access policy granting that identity the 'Get' permission for secrets. Without these, the App Service cannot authenticate to Key Vault, causing the deployment to fail with an access error.

Exam trap

The trap here is that candidates often assume the Key Vault reference syntax is the issue, when in reality the error message 'cannot access the secret' points directly to an authentication or authorization failure, not a syntax or naming problem.

How to eliminate wrong answers

Option A is wrong because the correct Key Vault reference syntax is '@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/)', and if it were incorrect, the error would be about parsing, not access. Option B is wrong because ARM templates can use Key Vault references in app settings; this is a supported feature for secure secret injection. Option C is wrong because a mismatched secret name would produce a 'SecretNotFound' error, not an access error.

Practice this question →

158

MCQmedium

A company is developing an application that processes orders. The application uses Azure Service Bus queues to decouple order submission from processing. During peak hours, some messages are not processed within the required time, causing order delays. The team needs to increase throughput without changing the existing message processing logic. What should they do?

A.Use Azure Event Hubs instead of Service Bus.

B.Increase the number of concurrent listeners on the queue.

C.Enable sessions on the queue to group related messages.

D.Increase the lock duration on messages.

AnswerB

Increasing the number of concurrent listeners on an Azure Service Bus queue directly enhances the application's ability to process messages in parallel. Each additional listener can fetch and process messages independently, allowing multiple messages to be consumed simultaneously from the queue. This parallel processing significantly boosts the overall message throughput, reducing the backlog and improving the responsiveness of the order processing application by distributing the workload across more consumer instances.

Why this answer

Increasing the number of concurrent listeners on the Service Bus queue allows multiple message receivers to process messages in parallel, directly increasing throughput without altering the existing message processing logic. This leverages the competing consumers pattern, where each listener independently receives and processes messages from the same queue, effectively scaling out the processing capacity.

Exam trap

The trap here is that candidates often confuse increasing lock duration (a reliability setting) with increasing throughput, or they assume that enabling sessions or switching to Event Hubs will magically improve performance without understanding the fundamental scalability mechanism of competing consumers.

How to eliminate wrong answers

Option A is wrong because Azure Event Hubs is designed for high-throughput event ingestion and telemetry streaming, not for decoupled order processing with guaranteed delivery and transactional support; it does not support message lock, deferral, or dead-lettering, which are required for reliable order processing. Option C is wrong because enabling sessions on a queue groups related messages and ensures ordered processing per session, but it does not increase throughput; in fact, it can reduce parallelism because all messages in a session must be processed by a single receiver. Option D is wrong because increasing the lock duration on messages gives more time to process a message before it becomes available to other consumers, but it does not increase throughput; it only prevents premature message abandonment and can actually delay processing if a message is locked for too long.

Practice this question →

159

MCQeasy

The mobile app team needs to send push notifications to 10 million devices running both iOS and Android. On iOS, notifications go through Apple Push Notification service (APNs); on Android, through Firebase Cloud Messaging (FCM). The team wants a single Azure service that abstracts platform differences and scales without managing separate APNs and FCM integrations per platform. Which service should they use?

A.Azure Notification Hubs with APNs and FCM credentials configured in the hub namespace

B.Azure Service Bus with topics — one subscription per platform, each subscription delivering to APNs or FCM

C.Azure Event Grid with a custom endpoint handler per platform that calls APNs or FCM directly

D.Azure Communication Services email with HTML-formatted alerts sent to device email addresses

AnswerA

Notification Hubs is the Azure service designed for exactly this use case. Configure your APNs certificate and FCM server key once. The backend then calls Notification Hubs with a unified API, specifying templates or platform-specific payloads. The hub routes and delivers to the appropriate PNS for each device's platform.

Why this answer

Azure Notification Hubs is the correct choice because it is a fully managed push notification service designed to abstract platform-specific notification systems like APNs (iOS) and FCM (Android). By configuring the APNs and FCM credentials in the hub namespace, the team can send a single notification that is automatically routed to the correct platform service, scaling to millions of devices without managing separate integrations.

Exam trap

The trap here is that candidates may confuse Azure Service Bus or Event Grid as viable push notification services, but neither provides direct, platform-abstracted push notification delivery to mobile devices like Notification Hubs does.

How to eliminate wrong answers

Option B is wrong because Azure Service Bus Topics are a message broker for decoupling applications, not a push notification service; they lack native integration with APNs or FCM and cannot directly deliver push notifications to mobile devices. Option C is wrong because Azure Event Grid is an event routing service that requires custom endpoint handlers to call APNs or FCM, which defeats the purpose of abstracting platform differences and adds complexity. Option D is wrong because Azure Communication Services email is designed for sending emails, not push notifications, and cannot reach mobile devices via APNs or FCM.

Practice this question →

160

MCQeasy

You are developing a web application that uses Azure Cosmos DB for NoSQL. You need to perform a point read by document ID and partition key. Which API method should you use to achieve the best performance and lowest cost?

A.Call ReadItemAsync with the partition key and document ID.

B.Call QueryAsync with a SQL query that filters by ID.

C.Call CreateItemAsync and check for conflict.

D.Call ReadManyAsync with a list of IDs.

AnswerA

Calling ReadItemAsync with the partition key and document ID is the most efficient and cost-effective method for retrieving a single item in Azure Cosmos DB. This operation is known as a point read, which directly accesses the physical partition where the item resides, bypassing the more resource-intensive query engine. It consumes the fewest Request Units (RUs) because it's a direct key-value lookup, making it ideal for scenarios requiring high performance and low latency for single-item retrieval.

Why this answer

The `ReadItemAsync` method is the most efficient way to perform a point read in Azure Cosmos DB for NoSQL because it directly accesses the document by its partition key and ID, using the resource ID (self-link) for a single request unit (RU) cost of exactly 1 RU for a 1 KB document. This bypasses the query engine entirely, providing the lowest latency and cost.

Exam trap

The trap here is that candidates often assume a SQL query with a filter by ID is equivalent to a point read, but they overlook that the query engine always adds extra RU overhead and latency compared to the direct `ReadItemAsync` method.

How to eliminate wrong answers

Option B is wrong because `QueryAsync` with a SQL query, even if filtered by ID, incurs additional RU overhead (minimum 2-3 RU) and higher latency due to query parsing, indexing, and execution, making it less performant and more expensive than a direct point read. Option C is wrong because `CreateItemAsync` is designed to insert a new document, not read an existing one, and checking for conflict would be an incorrect and costly workaround for a read operation. Option D is wrong because `ReadManyAsync` is intended for batch reading multiple items by their IDs and partition keys, which is overkill for a single document and may incur higher RU costs due to the batch operation overhead.

Practice this question →

161

Multi-Selectmedium

You are designing a solution that processes orders from an e-commerce website. The solution must guarantee that each order is processed exactly once. Which TWO Azure services can you use to achieve this requirement?

Select 2 answers

A.Azure Service Bus

B.Azure Storage Queues

C.Azure Event Grid

D.Azure Cache for Redis

E.Azure Event Hubs

AnswersA, E

Service Bus supports duplicate detection for exactly-once.

Why this answer

Azure Service Bus supports sessions and message deferral, which enable exactly-once processing by ensuring that a message is not removed from the queue until the consumer explicitly completes it after successful processing. If the consumer fails, the message becomes visible again, preventing duplicate processing. This guarantee is achieved through the Peek-Lock receive mode and the use of duplicate detection, which automatically discards duplicate messages within a defined time window.

Exam trap

The trap here is that candidates often confuse 'at-least-once' delivery (which Azure Storage Queues and Event Grid provide) with 'exactly-once' delivery, or they incorrectly assume that any queue-based service inherently guarantees exactly-once processing without considering the specific mechanisms like duplicate detection or checkpointing.

Practice this question →

162

MCQhard

Refer to the exhibit. You are creating an Azure Service Bus queue using an ARM template. The requirement is that messages should be automatically dead-lettered after 3 failed delivery attempts. Does this configuration meet the requirement?

A.No, because lockDuration should be shorter

B.Yes, because defaultMessageTimeToLive ensures messages expire

C.No, because maxDeliveryCount should be 3

D.Yes, because maxDeliveryCount is set

AnswerC

To ensure a message is automatically moved to the dead-letter queue after precisely three failed delivery attempts, the `maxDeliveryCount` property must be explicitly set to 3. This property directly controls the threshold for automatic dead-lettering due to repeated processing failures by incrementing with each delivery. With the current setting (implied to be 10 from the exhibit), messages would endure seven additional failed attempts before being dead-lettered, which does not meet the requirement of dead-lettering after three attempts.

Why this answer

The `maxDeliveryCount` property in Azure Service Bus determines the number of attempts to deliver a message before it is automatically moved to the dead-letter queue. The requirement specifies 3 failed delivery attempts, so `maxDeliveryCount` must be set to 3. The exhibit shows `maxDeliveryCount` set to 10, which does not meet the requirement.

Exam trap

The trap here is that candidates may see `maxDeliveryCount` is present and assume it meets the requirement, without checking that its value must be exactly 3 to match the specified number of failed delivery attempts.

How to eliminate wrong answers

Option A is wrong because `lockDuration` controls how long a message is locked for a receiver, not the number of delivery attempts; shortening it would not cause dead-lettering after 3 attempts. Option B is wrong because `defaultMessageTimeToLive` sets the time after which messages expire and are discarded or dead-lettered, not the number of delivery attempts. Option D is wrong because while `maxDeliveryCount` is set, its value is 10, not 3, so it does not satisfy the requirement of dead-lettering after exactly 3 failed delivery attempts.

Practice this question →

163

MCQmedium

An application publishes order events that multiple independent subscribers must process. Subscribers may be added later without changing the publisher. Which Azure messaging service should be used? The architecture review board prefers a managed Azure-native control.

A.Azure Blob Storage lifecycle policy

B.Azure Storage Queue

C.Azure Cache for Redis list only

D.Azure Service Bus topic

AnswerD

Service Bus topics support publish-subscribe messaging with independent subscriptions.

Why this answer

Azure Service Bus topics support a publish-subscribe pattern where multiple independent subscribers can process the same message. Subscribers can be added later without modifying the publisher, and each subscriber receives its own copy of the message through subscriptions. This matches the requirement for order events that must be processed by multiple independent subscribers.

Exam trap

The trap here is that candidates often confuse Azure Storage Queue (point-to-point) with Service Bus topics (pub-sub), failing to recognize that multiple independent subscribers require a topic-based pattern, not a queue.

How to eliminate wrong answers

Option A is wrong because Azure Blob Storage lifecycle policy is used to manage blob tiering and deletion based on age, not for messaging or event distribution. Option B is wrong because Azure Storage Queue implements a point-to-point queue pattern where a single consumer processes each message; it does not support multiple independent subscribers receiving the same message. Option C is wrong because Azure Cache for Redis list only provides a simple list data structure for FIFO operations, not a managed pub-sub messaging system with durable subscriptions and independent subscriber processing.

Practice this question →

164

MCQmedium

Backend APIs exposed through Azure API Management are consumed by multiple subscribers. The product owner wants to prevent any single subscriber from sending more than 100 requests per minute, while allowing subscribers with heavier plans to have higher limits configured separately. Which APIM policy implements per-subscriber rate limiting?

A.Apply the rate-limit-by-key policy using the subscription key as the counter key, with calls set to 100 and renewal-period to 60

B.Apply the quota policy to the product with a total of 100 calls per minute shared across all subscribers

C.Apply an ip-filter policy that blocks IP addresses making more than 100 requests per minute

D.Configure a backend circuit breaker policy to return cached responses after 100 calls

AnswerA

rate-limit-by-key with counter-key='@(context.Subscription.Id)' (or the subscription key header) creates a separate 100-calls/60-second counter per subscriber. When a subscriber's counter reaches 100, APIM returns 429 Too Many Requests for that subscriber while other subscribers continue at full rate.

Why this answer

The `rate-limit-by-key` policy in Azure API Management enforces a per-key rate limit, and using the subscription key as the counter key ensures each subscriber is limited individually. The `calls` parameter set to 100 and `renewal-period` to 60 seconds matches the requirement of 100 requests per minute per subscriber, while allowing different limits for different plans by applying separate policies with different call counts.

Exam trap

The trap here is confusing the `quota` policy (which sets a total limit shared across all subscribers of a product) with the `rate-limit-by-key` policy (which enforces per-subscriber limits), leading candidates to pick Option B when they see 'product' and 'per minute' without recognizing the shared vs. individual distinction.

How to eliminate wrong answers

Option B is wrong because the `quota` policy applied to a product with 100 calls per minute shared across all subscribers enforces a total limit for the entire product, not per subscriber, so a single subscriber could consume all 100 calls and block others. Option C is wrong because the `ip-filter` policy blocks or allows traffic based on IP addresses, but it cannot track request counts per minute or differentiate between subscribers sharing the same IP (e.g., behind a NAT), and it does not provide rate limiting based on subscription keys. Option D is wrong because a backend circuit breaker policy is used to protect the backend from overload by returning cached responses after a failure threshold, not to limit client request rates; it does not track per-subscriber request counts or enforce rate limits.

Practice this question →

165

MCQmedium

You are building an Azure Logic App that must consume messages from an Azure Service Bus queue. The queue messages are JSON payloads containing order information. The Logic App must process each message exactly once and in the order they are received. You need to configure the trigger in the Logic App. Which trigger type and property should you choose?

A.Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to false

B.Use a Service Bus trigger with the 'ReceiveAndDelete' mode

C.Use a Service Bus trigger with the 'PeekLock' mode and set the 'IsSessionsEnabled' property to true

D.Use an Event Grid trigger for Service Bus

AnswerC

The 'PeekLock' mode ensures 'at-least-once' delivery by requiring the Logic App to explicitly complete or abandon a message, allowing for reprocessing on failure. Crucially, enabling 'IsSessionsEnabled' on the Service Bus queue or topic guarantees First-In, First-Out (FIFO) ordering for messages within a specific session. Combining these features provides both reliable message processing with retry capabilities and strict message order, fulfilling the requirements for exactly-once processing and ordered consumption.

Why this answer

Service Bus sessions provide first-in-first-out (FIFO) ordering and exactly-once processing. By enabling sessions (IsSessionsEnabled = true) and using PeekLock mode, the Logic App can lock a message while processing, ensuring it is not delivered to other consumers, and sessions guarantee that messages with the same session ID are processed in order. This meets the requirement of processing each message exactly once and in the order received.

Exam trap

The trap here is that candidates often assume PeekLock mode alone guarantees ordering, but without sessions, multiple concurrent trigger instances can pick up messages from the same queue out of order, breaking the FIFO requirement.

How to eliminate wrong answers

Option A is wrong because PeekLock mode without sessions (IsSessionsEnabled = false) does not guarantee message ordering; messages may be processed out of order if multiple triggers fire concurrently. Option B is wrong because ReceiveAndDelete mode removes the message from the queue immediately upon retrieval, making it impossible to retry processing on failure and violating exactly-once semantics. Option D is wrong because an Event Grid trigger for Service Bus is designed for event-driven notifications (e.g., when a queue has messages) but does not provide built-in ordering or exactly-once processing guarantees; it also introduces potential duplicate deliveries.

Practice this question →

166

MCQeasy

You are building an Azure Logic App that must call an external REST API. The API requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App without exposing it in the workflow definition. What should you do?

A.A

B.B

C.C

D.D

AnswerA

Azure Key Vault is the recommended service for securely storing secrets like API keys. It encrypts secrets at rest and in transit, and access is controlled via Azure RBAC or Key Vault access policies. By assigning a Managed Identity to the Logic App and granting it "Get" permissions on the secret in Key Vault, the Logic App can securely retrieve the API key at runtime using the built-in Key Vault connector, ensuring the key is never exposed in the Logic App's definition or logs.

Why this answer

Azure Logic Apps can securely reference API keys stored in Azure Key Vault using a managed identity. By configuring the Logic App with a system-assigned or user-assigned managed identity, you grant it access to retrieve the secret from Key Vault at runtime without hardcoding the key in the workflow definition or connection parameters. This approach ensures the API key is never exposed in the Logic App's JSON definition or source control.

Exam trap

The trap here is that candidates often confuse Azure App Configuration with Azure Key Vault, assuming App Configuration's encrypted storage is sufficient for secrets, but Key Vault is the only service designed for managing and auditing access to sensitive secrets like API keys.

How to eliminate wrong answers

Option B is wrong because storing the API key directly in the Logic App's connection parameters or workflow definition, even if marked as a secure string, still embeds the secret in the definition file and can be exposed through source control or runtime history. Option C is wrong because using an Azure App Configuration reference with a plain-text value does not provide encryption at rest or access control; it still requires the key to be stored in the configuration store without native secret management. Option D is wrong because passing the API key as a query parameter in the HTTP request URL exposes the secret in server logs, browser history, and network traces, violating security best practices.

Practice this question →

167

MCQmedium

You are building an integration solution that connects an on-premises SQL Server database to Azure Data Factory. The on-premises network does not allow direct inbound connections from Azure. You need to securely transfer data from the database to Azure Blob Storage. Which data factory component should you use?

A.Self-hosted Integration Runtime

B.Azure Integration Runtime

C.Azure-SSIS Integration Runtime

D.Azure Data Lake Storage connector

AnswerA

The Self-hosted Integration Runtime is the correct choice because it is specifically designed to be installed on a machine within the on-premises network. This runtime acts as a secure, outbound-only gateway, initiating connections to Azure Data Factory via HTTPS. It allows Azure services to securely access on-premises data sources like SQL Server without requiring any inbound firewall ports to be opened, aligning perfectly with strict security requirements for hybrid data movement.

Why this answer

The Self-hosted Integration Runtime (SHIR) is required because the on-premises SQL Server database resides in a network that blocks direct inbound connections from Azure. SHIR acts as a bridge, running on a local machine or VM within the on-premises network, enabling Azure Data Factory to securely connect to the database via outbound HTTPS (port 443) or the Microsoft Service Bus. It handles data movement and transformation without exposing the on-premises network to inbound traffic.

Exam trap

The trap here is that candidates often confuse the Azure Integration Runtime (which works only for cloud-to-cloud scenarios) with the Self-hosted Integration Runtime, assuming Azure's built-in runtime can somehow tunnel into on-premises networks without explicit configuration.

How to eliminate wrong answers

Option B (Azure Integration Runtime) is wrong because it operates entirely within Azure's public cloud and cannot access on-premises resources behind a firewall that blocks inbound connections. Option C (Azure-SSIS Integration Runtime) is wrong because it is designed for lifting and shifting SQL Server Integration Services (SSIS) packages to Azure, not for direct data transfer between on-premises SQL Server and Azure Blob Storage via ADF pipelines. Option D (Azure Data Lake Storage connector) is wrong because it is a data sink or source connector, not a compute component for connectivity; it requires an Integration Runtime to actually move data.

Practice this question →

168

MCQeasy

You need to deploy a web app that uses Azure SQL Database. The connection string must be securely stored and automatically rotated without application downtime. What should you use?

A.Store the connection string as an environment variable in the App Service.

B.Store the connection string in a web.config file with encrypted configuration.

C.Store the connection string in Azure App Configuration and use a managed identity.

D.Store the connection string in Azure Key Vault and configure automatic rotation.

AnswerD

Azure Key Vault is the recommended service for securely storing and managing sensitive information like connection strings, API keys, and certificates. It provides a centralized, highly secure repository with robust access control policies, auditing capabilities, and crucially, support for automatic secret rotation. By integrating Key Vault with an Azure App Service using a managed identity, the application can securely retrieve the connection string at runtime without ever exposing it in configuration files or environment variables, ensuring optimal security and compliance.

Why this answer

Azure Key Vault provides centralized, secure storage for secrets like connection strings, and its automatic rotation feature (via Key Vault rotation policies or integration with Azure SQL) allows secrets to be updated without requiring application restarts or downtime. The App Service can access the vault using a managed identity, ensuring the connection string is never exposed in code or configuration files.

Exam trap

The trap here is that candidates confuse Azure App Configuration (which is for app settings, not secrets) with Azure Key Vault, or assume that encrypted configuration files or environment variables are sufficient for automatic rotation, overlooking the need for a dedicated secret store with rotation capabilities.

How to eliminate wrong answers

Option A is wrong because environment variables in App Service are not automatically rotated and require manual updates or redeployments, which can cause downtime or configuration drift. Option B is wrong because encrypting a web.config file does not provide automatic rotation and still exposes the connection string at rest within the application package, violating security best practices for secret management. Option C is wrong because Azure App Configuration is designed for feature flags and application settings, not for secret storage; it lacks native automatic rotation capabilities and does not enforce access policies like Key Vault.

Practice this question →

169

MCQmedium

Refer to the exhibit. You are reviewing an ARM template for a storage account. A security audit requires that all storage accounts enforce TLS 1.2 or higher. Does this configuration meet the requirement?

A.No, because supportsHttpsTrafficOnly does not enforce TLS version

B.Yes, because minimumTlsVersion is set to TLS1_2

C.No, because minimumTlsVersion is not a valid property

D.No, because the property should be minimumTlsVersion: "1.2"

AnswerB

This property enforces the minimum TLS version.

Why this answer

The `minimumTlsVersion` property in the ARM template explicitly enforces the minimum TLS version for requests to the storage account. Setting it to `TLS1_2` ensures that only TLS 1.2 or higher connections are accepted, meeting the security audit requirement. The `supportsHttpsTrafficOnly` property only enforces HTTPS but does not control the TLS version, so it alone is insufficient.

Exam trap

The trap here is that candidates confuse `supportsHttpsTrafficOnly` (which only enforces HTTPS, not TLS version) with the `minimumTlsVersion` property, or they assume the property uses a version string like `"1.2"` instead of the correct enum value `TLS1_2`.

How to eliminate wrong answers

Option A is wrong because `supportsHttpsTrafficOnly` only redirects HTTP traffic to HTTPS but does not restrict the TLS version; the `minimumTlsVersion` property is required to enforce TLS 1.2 or higher. Option C is wrong because `minimumTlsVersion` is a valid property for Azure Storage accounts in ARM templates, with accepted values like `TLS1_0`, `TLS1_1`, and `TLS1_2`. Option D is wrong because the correct value for TLS 1.2 in the ARM template is `TLS1_2` (with an underscore), not `"1.2"`; the property expects a string matching the predefined enum values.

Practice this question →

170

MCQeasy

Refer to the exhibit. A developer is creating an Azure Data Factory pipeline to copy data from Azure Blob Storage to Azure SQL Database. The pipeline fails with a timeout error when copying large files. Which action should the developer take to resolve the issue?

A.Change the source type to DelimitedTextSource

B.Enable Data Integration Units (DIU) to increase throughput

C.Increase the timeout value in the copy activity settings

D.Use a staging copy with Azure Data Lake Storage Gen2

AnswerC

Increasing the timeout value directly addresses the problem of an activity failing because it exceeds its maximum allowed execution duration. For Azure Data Factory copy activities, this setting dictates how long the activity will attempt to run before being terminated. When dealing with large files, slow source/sink systems, or network latency, extending this timeout provides the necessary window for the entire data transfer operation to complete successfully, preventing premature termination errors.

Why this answer

The copy activity in Azure Data Factory has a default timeout of 7 days, but when copying large files, the activity may fail due to the default timeout for the underlying HTTP request to Blob Storage (which is 7 minutes for a single block). Increasing the timeout value in the copy activity settings allows more time for the entire file transfer to complete, especially for large files that require multiple retries or slower network conditions.

Exam trap

The trap here is that candidates often confuse increasing throughput (DIU) with increasing timeout, not realizing that the error is caused by a fixed time limit per request, not by insufficient parallelism or compute resources.

How to eliminate wrong answers

Option A is wrong because changing the source type to DelimitedTextSource does not affect the timeout behavior; it only changes how the data is parsed, not the underlying network or transfer timeout. Option B is wrong because Data Integration Units (DIU) control the parallelism and compute resources for the copy activity, not the timeout duration; enabling DIU increases throughput but does not prevent a timeout error caused by a fixed time limit. Option D is wrong because using a staging copy with Azure Data Lake Storage Gen2 is an optimization for cross-region or hybrid copies, but it does not inherently resolve a timeout error; the timeout issue would still apply to the staging copy operation.

Practice this question →

171

MCQeasy

A company uses Azure Functions to process orders. The function needs to read messages from an Azure Service Bus queue. Which binding should the developer configure in the function.json?

A.serviceBus

B.eventHubTrigger

C.queueTrigger

D.serviceBusTrigger

AnswerD

The "serviceBusTrigger" binding is the correct and designated mechanism for an Azure Function to be invoked in response to messages arriving on an Azure Service Bus queue or topic. This trigger automatically handles message reception, deserialization, and completion, allowing the function to process messages reliably. It supports various Service Bus features, including peek-lock processing, message sessions, and dead-lettering, making it ideal for robust enterprise messaging scenarios like order processing.

Why this answer

The correct binding for reading messages from an Azure Service Bus queue in an Azure Functions app is `serviceBusTrigger`. This trigger binding listens to a Service Bus queue or topic subscription and invokes the function when a message arrives. Option D is correct because it specifically names the Service Bus trigger, which is designed for this purpose.

Exam trap

The trap here is that candidates confuse Azure Storage queues (`queueTrigger`) with Azure Service Bus queues (`serviceBusTrigger`), as both are messaging services but use different trigger bindings and have distinct features like sessions and topics in Service Bus.

How to eliminate wrong answers

Option A is wrong because `serviceBus` is not a valid binding type; the correct binding names are `serviceBusTrigger` for triggers and `serviceBus` for output bindings. Option B is wrong because `eventHubTrigger` is used to consume events from Azure Event Hubs, not Service Bus queues. Option C is wrong because `queueTrigger` is used for Azure Storage queues, not for Azure Service Bus queues.

Practice this question →

172

MCQmedium

You are building a solution that uses Azure Cosmos DB for NoSQL. You need to implement a change feed processor to handle real-time updates. The application runs on multiple instances to ensure high availability. Which lease container configuration ensures that each instance processes a distinct set of partitions?

A.Set the partition key of the monitored container to /city

B.Configure the change feed to start from the beginning

C.Use a separate lease container with partition key /id

D.Set the lease container's throughput to 1000 RU/s

AnswerC

Using a separate lease container with a partition key of /id is the correct approach because the Change Feed Processor leverages this specific partitioning strategy. Each logical partition of the monitored container is assigned a unique "lease" document in the lease container. By partitioning the lease container by /id, the processor ensures that these lease documents are evenly distributed, allowing different consumer instances to acquire and manage leases for distinct logical partitions in parallel, thereby distributing the workload effectively.

Why this answer

The change feed processor uses a lease container to track which partitions each instance is processing. By setting the partition key to /id, each lease document is uniquely identified, allowing the processor to distribute partitions across instances. This ensures that each instance processes a distinct set of partitions, enabling horizontal scaling without duplication.

Exam trap

The trap here is that candidates confuse the partition key of the monitored container with the partition key of the lease container, assuming they must match or that throughput settings control distribution, when in fact the lease container's partition key must be /id for proper lease management.

How to eliminate wrong answers

Option A is wrong because the partition key of the monitored container (/city) does not affect lease distribution; the lease container's partition key controls how leases are distributed. Option B is wrong because starting from the beginning is a configuration for reading historical changes, not for ensuring distinct partition processing across instances. Option D is wrong because throughput (RU/s) on the lease container affects performance and throttling, not the logical distribution of partitions among instances.

Practice this question →

173

MCQhard

Your company has a microservices application deployed on Azure Kubernetes Service (AKS). One service, OrderProcessor, needs to read messages from an Azure Service Bus queue and write results to Azure Cosmos DB. The processing must be reliable: if the service crashes mid-processing, the message should not be lost and should be retried. You also need to ensure that messages are processed in order within a partition. The solution should minimize code changes and leverage platform features. Which approach should you use?

A.Use the Azure Service Bus SDK with ReceiveAndDelete mode in a background worker.

B.Use Azure Functions with a Service Bus trigger that uses sessions for ordered processing.

C.Use the Azure Service Bus SDK with PeekLock mode and manual message completion.

D.Use Azure Event Hubs with a consumer group and checkpointing.

AnswerB

Azure Functions with a Service Bus trigger provides a robust and scalable solution for processing messages reliably. Functions automatically leverage Service Bus's PeekLock mechanism, handling message retrieval, retries, and completion or dead-lettering without explicit developer code. Furthermore, utilizing Service Bus sessions ensures that related messages are processed in a guaranteed order by the same function instance, which is crucial for maintaining data consistency in microservices architectures.

Why this answer

Azure Functions with a Service Bus trigger using sessions provides exactly-once processing and ordered message delivery within a partition. The Service Bus trigger automatically uses PeekLock mode, ensuring messages are not lost if the function crashes, and sessions guarantee FIFO ordering within a session. This minimizes code changes by leveraging the platform's built-in retry and checkpointing mechanisms.

Exam trap

The trap here is that candidates often confuse ReceiveAndDelete mode with PeekLock mode, or assume that manual completion alone guarantees ordering, but they overlook that sessions are the only way to enforce FIFO ordering within a partition in Service Bus.

How to eliminate wrong answers

Option A is wrong because ReceiveAndDelete mode removes the message from the queue immediately upon retrieval, so if the service crashes mid-processing, the message is lost and cannot be retried. Option C is wrong because while PeekLock mode with manual completion ensures reliability, it does not guarantee ordered processing within a partition; sessions are required for that. Option D is wrong because Azure Event Hubs is designed for high-throughput event ingestion, not for reliable message processing with ordered delivery and retries; it lacks built-in message-level retry and session support like Service Bus.

Practice this question →

174

MCQeasy

You are building a solution that processes images uploaded to Azure Blob Storage. Each image must be analyzed by Azure AI Vision (Computer Vision). You need to trigger the analysis automatically when a new blob is created. Which Azure service should you use?

A.Azure Event Grid

B.Azure Logic Apps

C.Azure Functions

D.Azure WebJobs

AnswerC

Azure Functions is a serverless compute service that enables developers to run small pieces of event-driven code, known as "functions," without managing infrastructure. It offers native integration with Azure Blob Storage, allowing a function to be automatically triggered whenever a new image file is uploaded to a specified container. This makes Azure Functions an ideal and highly scalable choice for executing custom image processing logic, such as resizing, watermarking, or applying machine learning models, directly in response to the upload event.

Why this answer

Azure Functions is the correct choice because it provides a serverless compute service that can be triggered directly by Azure Event Grid when a new blob is created. This allows you to run custom code (e.g., calling Azure AI Vision APIs) in response to the blob storage event without managing infrastructure. The integration is native and efficient, with Event Grid delivering the event to the function via an HTTP trigger or Event Grid trigger binding.

Exam trap

The trap here is that candidates often confuse Azure Event Grid as a standalone solution for executing code, when in fact it is only an event router that requires a subscriber (like Azure Functions) to perform the actual processing.

How to eliminate wrong answers

Option A is wrong because Azure Event Grid is an event routing service, not a compute service; it cannot run the analysis code itself—it only delivers the event to a subscriber like Azure Functions. Option B is wrong because Azure Logic Apps is a workflow orchestration service that can trigger on blob creation, but it is less suitable for custom code execution and incurs higher latency and cost compared to a direct Azure Functions trigger; it also requires a connector or API call to invoke Azure AI Vision, adding complexity. Option D is wrong because Azure WebJobs is a legacy feature of Azure App Service that runs in the same context as a web app, requiring an always-on App Service plan and manual event integration, whereas the question demands a modern, event-driven serverless solution.

Practice this question →

175

MCQhard

You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?

A.The Cognitive Search service is in a different region than the storage account.

B.The Cognitive Search service's admin key is missing.

C.The indexer configuration is missing the storage account key.

D.The storage account is behind a firewall and the Cognitive Search service IP is not allowed.

AnswerD

Azure Storage accounts can be secured with network firewalls that restrict access to specific virtual networks or IP addresses. If the storage account has a firewall enabled and the outbound IP address of the Azure Cognitive Search service (or its associated VNet if integrated) is not explicitly added to the allowed list, the connection attempt will be blocked. This results in an access denied error, as the search service is prevented from establishing a network connection to the storage account.

Why this answer

When a storage account is protected by a firewall, Azure Cognitive Search's indexer must be granted explicit network access. Even if the connection string is correct, the indexer's outbound requests will be blocked unless the storage account's firewall rules include the IP address or subnet of the Cognitive Search service. This is a common misconfiguration that results in 'Data source credentials are invalid' errors despite valid credentials.

Exam trap

The trap here is that candidates assume a valid connection string guarantees access, overlooking that network-level restrictions (firewalls, service endpoints, or private endpoints) can block the indexer's traffic even with correct credentials.

How to eliminate wrong answers

Option A is wrong because Azure Cognitive Search and Azure Blob Storage can be in different regions; cross-region indexing is fully supported and does not cause credential validation errors. Option B is wrong because the admin key is used for managing the search service itself, not for authenticating to an external data source; the indexer uses the storage account connection string, not the search service admin key. Option C is wrong because the storage account key is embedded within the connection string; if the connection string is verified as correct, the key is already present and the indexer configuration does not require a separate key field.

Practice this question →

176

MCQeasy

You are developing a solution that needs to retrieve secrets from Azure Key Vault. The solution will run as an Azure App Service managed identity. Which authentication method should you use?

A.SharedAccessSignatureCredential

B.InteractiveBrowserCredential

C.DefaultAzureCredential

D.ClientSecretCredential

AnswerC

DefaultAzureCredential offers a robust and flexible authentication strategy by attempting to authenticate using a chain of credential types in a predefined order. When deployed in Azure, it automatically prioritizes and leverages Managed Identities (system-assigned or user-assigned) associated with the hosting resource (e.g., Azure App Service, VM, Function App), eliminating the need for explicit credential management. For local development, it intelligently falls back to environment variables, Azure CLI, or Visual Studio credentials, providing a seamless experience across different environments without code changes.

Why this answer

DefaultAzureCredential is the correct choice because it automatically chains multiple authentication sources, including managed identity, environment variables, and Visual Studio credentials. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will first attempt to authenticate using the managed identity endpoint, making it the most seamless and recommended approach for this scenario.

Exam trap

The trap here is that candidates often choose ClientSecretCredential because they think a secret is required, but they overlook that DefaultAzureCredential automatically handles managed identity authentication without needing to store any credentials.

How to eliminate wrong answers

Option A is wrong because SharedAccessSignatureCredential is used for authenticating to Azure Storage services (e.g., Blob, Queue) using a shared access signature token, not for authenticating to Azure Key Vault. Option B is wrong because InteractiveBrowserCredential requires user interaction via a browser to complete the authentication flow, which is unsuitable for a headless, automated App Service managed identity. Option D is wrong because ClientSecretCredential requires a client secret (password) to be stored and managed, which defeats the purpose of using a managed identity and introduces a security risk.

Practice this question →

177

MCQmedium

An app uses Azure Event Grid to publish events. The events must be delivered to an Azure Function that processes them. Which Event Grid event delivery model should be used?

A.Pull delivery

B.Push delivery

C.Batch delivery

D.Poll delivery

AnswerB

Azure Event Grid exclusively employs a push delivery model for event distribution. With push delivery, Event Grid automatically sends events to configured subscriber endpoints as soon as they occur, without the subscriber needing to initiate a request. This server-initiated approach is fundamental to Event Grid's real-time, reactive architecture, enabling immediate invocation of services like Azure Functions, Logic Apps, or webhooks in response to state changes or actions within Azure resources or custom applications.

Why this answer

Azure Event Grid uses a push delivery model to send events to subscribers like Azure Functions. When an event occurs, Event Grid automatically forwards (pushes) the event to the configured endpoint via HTTP POST requests. This ensures near-real-time processing without the subscriber needing to poll for new events.

Exam trap

The trap here is that candidates confuse Event Grid's push model with the pull-based consumption patterns of other Azure messaging services (like Event Hubs or Service Bus), leading them to incorrectly select pull or poll delivery.

How to eliminate wrong answers

Option A is wrong because pull delivery is not a model supported by Event Grid; Event Grid always pushes events to subscribers, and pull-based consumption is used by services like Azure Event Hubs or Kafka. Option C is wrong because batch delivery is a configuration option within push delivery (allowing multiple events per HTTP request), not a separate delivery model. Option D is wrong because poll delivery is not a term used in Event Grid; polling implies the subscriber repeatedly checks for new events, which is the opposite of Event Grid's push-based architecture.

Practice this question →

178

MCQmedium

You are building an Azure Logic App that must connect to a third-party CRM system using a custom API. The API requires an API key in the header of every request. You need to securely store the API key and reference it in the Logic App. Which approach should you use?

A.Store the API key in the Azure Logic App's definition file.

B.Use a parameter and a connection reference in the Logic App.

C.Store the API key in Azure Key Vault and reference it with a dynamic expression.

D.Hardcode the API key in the HTTP action.

AnswerC

Azure Key Vault is the industry-standard service for securely storing and managing secrets, keys, and certificates. By storing the API key in Key Vault, it benefits from encryption at rest, robust access policies (Azure RBAC), and auditing. Logic Apps can then securely retrieve this secret at runtime using a dynamic expression like `@keyVault('secretName')` or `@keyVault('secretUri')`, ensuring the secret is never exposed in the Logic App's definition, source control, or logs.

Why this answer

Azure Key Vault provides a secure, centralized store for secrets like API keys, and Logic Apps can reference these secrets at runtime using a dynamic expression (e.g., `@Microsoft.KeyVault(SecretUri=...)`). This avoids exposing the key in plaintext within the Logic App definition or configuration, aligning with Azure security best practices for managed identities and secret management.

Exam trap

The trap here is that candidates may confuse 'parameter and connection reference' (Option B) as secure because it separates the value from the definition, but it still stores the key in plaintext in the connection resource, whereas Key Vault is the only option that provides encryption and access control via Azure RBAC.

How to eliminate wrong answers

Option A is wrong because storing the API key directly in the Logic App's definition file (JSON workflow) exposes it in plaintext within the source code and deployment artifacts, violating security best practices. Option B is wrong because while parameters and connection references can abstract values, they still store the API key in plaintext within the Logic App's configuration or connection resource, not providing encryption at rest or access control. Option D is wrong because hardcoding the API key in the HTTP action embeds the secret directly in the workflow definition, making it visible to anyone with read access to the Logic App and impossible to rotate without modifying the workflow.

Practice this question →

179

MCQeasy

A developer is building an application that needs to store and retrieve large binary files (e.g., images, videos). The application runs on Azure Virtual Machines. Which Azure service provides the most cost-effective storage for these files?

A.Azure SQL Database

B.Azure Cosmos DB

C.Azure Files

D.Azure Blob Storage

AnswerD

Azure Blob Storage is Microsoft's object storage solution, specifically designed for storing massive amounts of unstructured data, including large binary files like images, videos, backups, and data lakes. It offers high scalability, durability, and cost-effectiveness through various access tiers (Hot, Cool, Archive), making it the optimal choice for storing and serving large binary files directly via HTTP/S. Its architecture is purpose-built for efficient handling of blobs, providing excellent performance and pricing for this workload.

Why this answer

Azure Blob Storage is designed specifically for storing massive amounts of unstructured data, such as images and videos, and offers the lowest cost per gigabyte for large binary files compared to other Azure storage options. It supports scalable, durable, and highly available storage with tiered pricing (Hot, Cool, Archive) to optimize costs based on access patterns.

Exam trap

The trap here is that candidates may confuse Azure Files (a managed file share) with Blob Storage, but Azure Files is designed for SMB-based file sharing and is not the most cost-effective option for storing large binary files at scale.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database is a relational database service optimized for structured transactional data, not for storing large binary files, and it incurs higher costs per GB due to its compute and storage architecture. Option B is wrong because Azure Cosmos DB is a NoSQL database designed for globally distributed, low-latency access to structured or semi-structured data, and its storage cost is significantly higher than Blob Storage for large binary files. Option C is wrong because Azure Files provides fully managed file shares using the SMB protocol, which is suitable for shared file access but is more expensive per GB than Blob Storage and not optimized for storing massive binary objects like videos.

Practice this question →

180

MCQeasy

You are building a solution that processes orders and needs to send order confirmation emails reliably. You choose Azure Logic Apps with a Gmail connector. However, you are concerned about hitting Gmail's sending limits. What should you do to handle this?

A.Use Azure Queue Storage to buffer messages and process them asynchronously.

B.Use a webhook instead of a connector to send emails directly via Gmail API.

C.Increase the Gmail API quota by contacting Google support.

D.Configure a retry policy in the Logic App action to retry on failure with exponential backoff.

AnswerD

Exponential backoff retry policy helps respect rate limits by spacing out retries.

Why this answer

To handle Gmail's sending limits in Azure Logic Apps, you should configure a retry policy with exponential backoff on the Gmail connector action. This automatically retries failed sends due to rate limiting, spacing out retries to avoid further limits. Option A (Azure Queue Storage) is unnecessary because Logic Apps can handle retries natively.

Option B (webhook) bypasses the connector but doesn't address limits inherently. Option C (increasing quota) is possible but not a built-in solution and may not be available. Thus, D is correct.

Practice this question →

181

MCQmedium

You are building an Azure Logic App that needs to call a third-party REST API. The API requires an API key to be passed in the 'X-API-Key' header. You have stored the API key as a secret in Azure Key Vault. The Logic App uses a managed identity that has read access to the Key Vault secret. You want to retrieve the API key securely at runtime and include it in the HTTP request. Which approach should you use?

A.Use the 'Get secret' action from the Azure Key Vault connector, configured to authenticate with a managed identity. Then pass the output to the 'HTTP' action's header as 'X-API-Key'.

B.Create an API connection for the external API, providing the API key in the connection parameters. Then use that connection in the Logic App.

C.Store the API key directly in the Logic App definition's 'constants' section and reference it in the HTTP action.

D.Use the 'HTTP' action with 'Managed Identity' authentication type, and configure the external API to accept Microsoft Entra ID tokens.

AnswerA

This is the correct and most secure approach for handling API keys in Azure Logic Apps. Azure Key Vault is a dedicated service for securely storing secrets, and a Logic App's managed identity provides an automatically managed identity in Microsoft Entra ID. By granting the Logic App's managed identity 'Get' permissions on the specific secret in Key Vault, the 'Get secret' action can retrieve the API key at runtime. This dynamically retrieved value is then passed into the 'HTTP' action's header (e.g., 'X-API-Key'), ensuring the sensitive key is never hardcoded or exposed within the Logic App's definition or deployment artifacts.

Why this answer

It uses the Azure Key Vault connector's 'Get secret' action with managed identity authentication to securely retrieve the API key at runtime. The output is then passed directly into the HTTP action's 'X-API-Key' header, ensuring the secret is never exposed in the Logic App definition or logs. This approach follows the principle of least privilege and avoids hardcoding secrets.

Exam trap

The trap here is that candidates may confuse managed identity authentication on the HTTP action (which sends an Entra ID token) with using a managed identity to authenticate to Key Vault, leading them to select option D, which is technically incorrect for an API key scenario.

How to eliminate wrong answers

Option B is wrong because creating an API connection stores the API key in the connection definition, which is persisted and can be exposed if the connection is shared or exported; it also bypasses the runtime retrieval from Key Vault. Option C is wrong because storing the API key directly in the Logic App definition's 'constants' section hardcodes the secret into the workflow, violating security best practices and exposing it in source control or deployment artifacts. Option D is wrong because the 'HTTP' action with 'Managed Identity' authentication type sends a Microsoft Entra ID token, not an API key; the external API would need to support OAuth 2.0 token validation, which is not the case here—it expects a static API key in the 'X-API-Key' header.

Practice this question →

182

MCQeasy

You need to consume an Azure Cognitive Services Text Analytics API from a Python application. The API requires a subscription key. Where should you store the key to ensure security?

A.Store the key in a text file in the application directory.

B.Store the key in an environment variable on the hosting machine.

C.Use Azure AD authentication instead of a key.

D.Hardcode the key in the Python source code.

AnswerB

Storing the key in an environment variable on the hosting machine is a robust and recommended practice for managing secrets. Environment variables are loaded into the application's process at runtime, keeping the secret out of the source code and deployed files. On Azure App Service or virtual machines, these variables can be securely configured and managed by the platform, often encrypted at rest, significantly reducing the risk of unauthorized access or accidental leakage.

Why this answer

Storing the subscription key in an environment variable on the hosting machine keeps it out of source code and configuration files, reducing the risk of accidental exposure. Environment variables are a standard security best practice for secrets in cloud applications, and Azure Cognitive Services APIs require key-based authentication unless Azure AD is explicitly configured.

Exam trap

The trap here is that candidates may choose Option C (Azure AD authentication) thinking it eliminates the need for a key entirely, but the Text Analytics API does not support Azure AD out-of-the-box without additional configuration, and the question explicitly states the API requires a subscription key.

How to eliminate wrong answers

Option A is wrong because storing the key in a text file in the application directory makes it part of the deployment package, easily accessible if the file system is compromised or if the code is shared via version control. Option C is wrong because Azure AD authentication is not supported by default for the Text Analytics API; it requires additional configuration (e.g., managed identity) and is not a drop-in replacement for the subscription key in this context. Option D is wrong because hardcoding the key in Python source code exposes it to anyone with access to the codebase, including version control history, and violates the principle of separating secrets from code.

Practice this question →

183

MCQhard

Northwind Traders is building a microservices architecture on Azure Kubernetes Service (AKS). One service needs to read messages from an Azure Service Bus queue and write them to an Azure SQL database. The solution must use managed identities for authentication. The AKS cluster is integrated with Microsoft Entra ID. The development team wants to avoid managing service principals and secrets. The team has chosen to use the Azure Identity SDK for authentication. The service will run as a pod in AKS. Which approach should the team use to authenticate to Service Bus and Azure SQL Database?

A.Generate a self-signed certificate, upload it to AKS, and use ClientCertificateCredential in the code.

B.Deploy Azure AD Pod Identity (or Workload Identity) to assign a user-assigned managed identity to the pod. Use DefaultAzureCredential in the code. Grant the identity 'Listen' on Service Bus and 'Connect' on SQL Database.

C.Store Service Bus connection string and SQL connection string in Azure Key Vault. Use Key Vault SDK to retrieve them at runtime.

D.Create a service principal and store its client secret in a Kubernetes secret. Use ClientSecretCredential in the code. Assign the service principal permissions to Service Bus and SQL.

AnswerB

This is the most secure and recommended approach for microservices in AKS. Deploying Azure AD Pod Identity (or its successor, Workload Identity) allows assigning a user-assigned managed identity directly to the Kubernetes pod, eliminating the need for hardcoded credentials or secrets. DefaultAzureCredential then automatically discovers and uses this identity for authentication to Azure services like Service Bus and SQL Database, while granting specific permissions ('Listen', 'Connect') adheres to the principle of least privilege.

Why this answer

Azure AD Pod Identity (or Workload Identity) allows you to assign a user-assigned managed identity to a pod, eliminating the need to manage service principals or secrets. The DefaultAzureCredential from the Azure Identity SDK automatically uses the pod's managed identity to authenticate to Azure services. Granting the identity 'Listen' on Service Bus and 'Connect' on SQL Database provides the minimum required permissions for the service to read messages and write to the database.

Exam trap

The trap here is that candidates may confuse using Azure Key Vault for secret storage (Option C) with using managed identities for authentication, but the question explicitly requires managed identities for authentication, not just for accessing secrets.

How to eliminate wrong answers

Option A is wrong because generating a self-signed certificate and using ClientCertificateCredential still requires managing certificate lifecycle and distribution, which contradicts the requirement to avoid managing secrets and service principals. Option C is wrong because storing connection strings in Key Vault and retrieving them at runtime does not use managed identities for authentication to Service Bus and SQL Database; it still relies on connection strings, which are secrets. Option D is wrong because creating a service principal and storing its client secret in a Kubernetes secret reintroduces secret management and violates the requirement to avoid managing service principals and secrets.

Practice this question →

184

MCQmedium

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured? The design must avoid adding custom operational scripts.

A.Blob soft delete

B.Application Insights sampling

C.Private DNS zone only

D.API Management rate-limit or quota policy

AnswerD

Azure API Management (APIM) policies, specifically the `rate-limit` and `quota` policies, are designed precisely to control and manage the flow of API traffic. These policies allow developers to enforce limits on the number of API calls (rate limit) or the total bandwidth consumed (quota) within a specified time period, per subscription, per user, or per IP address. By applying these policies at various scopes, APIM can effectively throttle client requests, prevent abuse, ensure fair usage, and protect backend services from overload.

Why this answer

Azure API Management provides built-in rate-limit and quota policies that enforce throttling at the subscription level without requiring custom code. These policies allow you to define call rates (e.g., requests per second) or quotas (e.g., requests per month) per subscription key, directly protecting backend services from overuse.

Exam trap

The trap here is that candidates may confuse monitoring features (Application Insights sampling) or unrelated Azure services (Blob soft delete, Private DNS) with API throttling mechanisms, overlooking the purpose-built rate-limit and quota policies in API Management.

How to eliminate wrong answers

Option A is wrong because Blob soft delete is a data protection feature for Azure Blob Storage that recovers accidentally deleted blobs, not a mechanism for throttling API clients. Option B is wrong because Application Insights sampling reduces telemetry volume for monitoring, not API request throttling. Option C is wrong because a Private DNS zone only resolves custom domain names within a virtual network and has no role in rate limiting or quota enforcement.

Practice this question →

185

MCQmedium

You are developing a worker role that processes events from an Azure Event Hub. The worker runs on multiple virtual machines to ensure high availability. Each partition of the Event Hub should be processed by only one instance at a time, and events from the same partition must be processed in order. You need to manage partition leasing and checkpointing efficiently. Which Azure SDK class should you use?

A.EventHubClient

B.PartitionReceiver

C.EventHubConsumerClient

D.EventProcessorHost

AnswerD

EventProcessorHost abstracts partition leasing, checkpointing, and ensures that each partition is processed by a single instance. It processes events in order within partitions and is ideal for high-availability scenarios.

Why this answer

The EventProcessorHost (EPH) class is designed specifically for scenarios requiring distributed processing of Event Hub partitions across multiple instances. It manages partition leasing to ensure each partition is processed by only one instance at a time, handles checkpointing to track progress, and guarantees ordered processing within a partition. This makes it the correct choice for high-availability worker roles that must avoid duplicate processing and maintain event order.

Exam trap

The trap here is that candidates often confuse high-level consumer clients (like EventHubConsumerClient) with the distributed coordination capabilities of EventProcessorHost, overlooking the need for automatic lease management and checkpointing in multi-instance deployments.

How to eliminate wrong answers

Option A is wrong because EventHubClient is a low-level client for sending events and managing Event Hub metadata; it does not provide partition leasing, checkpointing, or distributed processing coordination. Option B is wrong because PartitionReceiver is a single-partition receiver that requires manual management of leases and checkpoints, making it unsuitable for multi-instance high-availability scenarios. Option C is wrong because EventHubConsumerClient is a high-level consumer for reading events from one or more partitions but lacks built-in lease management and checkpoint coordination across multiple instances.

Practice this question →

186

MCQhard

Your application uses Azure Service Bus topics. You need to ensure that messages are processed in the order they were sent within a session. What must you configure?

A.Enable duplicate detection.

B.Enable partitioning on the topic.

C.Enable sessions on the topic and set the SessionId property on messages.

D.Set the MessageId property to a GUID.

AnswerC

Enabling sessions on an Azure Service Bus topic and subsequently setting the SessionId property on messages is the correct mechanism to ensure ordered delivery and processing of related messages. When sessions are active, all messages sharing the same SessionId are guaranteed to be delivered to a single receiver in the exact First-In, First-Out (FIFO) order in which they were sent. This is essential for scenarios requiring sequential processing of a message stream, such as processing a series of steps for a single customer order.

Why this answer

Azure Service Bus sessions provide strict message ordering and exactly-once processing within a session. By enabling sessions on the topic and setting the SessionId property on each message, all messages with the same SessionId are processed in FIFO order, ensuring they are received in the exact sequence they were sent.

Exam trap

The trap here is that candidates often confuse duplicate detection (MessageId) with session-based ordering (SessionId), or assume partitioning (which improves throughput) also guarantees order, when in fact it can break ordering across partitions.

How to eliminate wrong answers

Option A is wrong because duplicate detection prevents duplicate messages from being accepted within a specified time window, but it does not enforce ordering. Option B is wrong because partitioning distributes messages across multiple message brokers for scalability, which can break ordering guarantees. Option D is wrong because the MessageId property is used for duplicate detection, not for maintaining message order within a session.

Practice this question →

187

MCQmedium

Refer to the exhibit. A developer runs this Azure CLI command to set an app setting for a web app. What is the impact on the web app?

A.The command fails because the password is provided in plaintext.

B.The setting is available immediately without restart.

C.The web app restarts to apply the new setting.

D.The setting is stored in a local configuration file.

AnswerC

When an application setting is modified for an Azure App Service, the platform automatically triggers a restart of the web app instance(s). This restart is crucial because it ensures that the updated configuration, which is exposed to the application as environment variables, is properly loaded into the application's runtime process. Without this restart, the running application would continue to use the old, cached environment variables, preventing the new setting from being applied.

Why this answer

When you use the Azure CLI command `az webapp config appsettings set` to modify an app setting for a web app, Azure App Service automatically triggers a restart of the web app to apply the new setting. This is because app settings are injected into the application's environment at startup, and changes require a fresh process to pick them up. Option C correctly identifies this behavior.

Exam trap

The trap here is that candidates may assume app settings are hot-reloaded without a restart (like in some local development frameworks), but Azure App Service requires a restart to apply environment-level configuration changes.

How to eliminate wrong answers

Option A is wrong because the Azure CLI command accepts plaintext passwords in the command line; while not a security best practice, it does not cause the command to fail. Option B is wrong because app settings are not applied immediately without restart; the web app must restart to reload the environment variables. Option D is wrong because app settings are stored in Azure App Service's configuration store, not in a local configuration file on the web app instance.

Practice this question →

188

MCQhard

You are using Azure Cache for Redis to cache frequently accessed database query results. You need to ensure that the cache is updated automatically when the underlying data changes. Which pattern should you implement?

A.Cache-aside pattern with cache invalidation

B.Read-through pattern

C.Event-driven cache invalidation using Azure Event Grid

D.Write-through pattern

AnswerA

The Cache-aside pattern places the responsibility of managing the cache directly with the application. When the application needs data, it first checks the cache; if a miss occurs, it retrieves data from the data store, populates the cache, and returns it. Crucially, when the application modifies data in the underlying data store, it explicitly invalidates or updates the corresponding entry in the cache to ensure data consistency and freshness.

Why this answer

The cache-aside (lazy loading) pattern is the most common approach for caching database queries. In this pattern, the application checks the cache first; on a cache miss, it loads data from the database and stores it in the cache with a TTL. To ensure the cache reflects data changes, the application invalidates (deletes) the cached entry whenever the underlying data is updated, so the next read fetches fresh data.

This pattern is explicitly designed for scenarios like Azure Cache for Redis where automatic updates are needed. Option B (read-through) is similar but the cache itself loads data from the database; however, it does not handle cache invalidation on data changes automatically. Option C (event-driven invalidation using Azure Event Grid) is a valid pattern but is more complex and not the standard caching pattern; it requires additional infrastructure to detect changes and publish events.

Option D (write-through) updates the cache synchronously on writes, but it does not address automatic updates when data changes outside the cache (e.g., direct database updates). Therefore, the cache-aside pattern with explicit invalidation is the correct choice for automatic cache updates.

Practice this question →

189

MCQeasy

A company uses Azure Logic Apps to automate business processes. They need to call an external REST API that requires OAuth 2.0 client credentials grant. Which connector should they use with minimal configuration?

A.HTTP connector

B.HTTP + Swagger connector

C.Azure Functions connector

D.Custom connector

AnswerA

The HTTP connector in Azure Logic Apps is the most direct and efficient way to interact with any REST API, especially when specific authentication methods like OAuth 2.0 client credentials are required. It provides built-in support for various authentication types, including Microsoft Entra ID (OAuth), allowing for straightforward configuration of client ID, client secret, and resource URI without needing to manually manage token acquisition or refresh logic. This makes it ideal for securely calling external APIs that protect their endpoints with standard OAuth 2.0 flows.

Why this answer

The HTTP connector in Azure Logic Apps supports OAuth 2.0 client credentials grant natively with minimal configuration. You can directly set the authentication type to 'Active Directory OAuth' and provide the tenant ID, client ID, client secret, and audience/resource URI. This avoids the need for custom code or additional connectors.

Exam trap

The trap here is that candidates often overthink and choose a custom connector or Swagger-based option, not realizing the built-in HTTP connector already supports OAuth 2.0 client credentials with minimal setup.

How to eliminate wrong answers

Option B (HTTP + Swagger connector) is wrong because it is used when you have an OpenAPI (Swagger) definition to import, adding unnecessary overhead for a simple OAuth 2.0 call. Option C (Azure Functions connector) is wrong because it is designed to invoke Azure Functions, not to call external REST APIs with OAuth 2.0 client credentials. Option D (Custom connector) is wrong because it requires creating a custom API connector with a Swagger definition, which involves more configuration than the built-in HTTP connector's direct OAuth support.

Practice this question →

190

MCQeasy

A developer is building an app that uses Azure Cognitive Services Text Analytics. The app needs to detect the language of text input. Which Azure SDK method should be called?

A.DetectLanguage

B.ExtractKeyPhrases

C.AnalyzeSentiment

D.RecognizeEntities

AnswerA

The DetectLanguage operation within Azure AI Language (formerly Text Analytics) is specifically designed to identify the primary language of a given input text. It analyzes the linguistic patterns and vocabulary to return a standardized language code, such as 'en' for English or 'es' for Spanish, along with a confidence score. This functionality is crucial for applications that need to process multilingual content or route text to language-specific models for further analysis.

Why this answer

The correct method is `DetectLanguage` because the Azure Cognitive Services Text Analytics API provides a dedicated operation for identifying the language of input text. This method returns the detected language along with a confidence score, making it the appropriate choice for the requirement of detecting language from text input.

Exam trap

The trap here is that candidates may confuse the purpose of Text Analytics methods, mistakenly selecting `ExtractKeyPhrases` or `AnalyzeSentiment` because they assume language detection is part of those operations, rather than recognizing it as a separate, dedicated API method.

How to eliminate wrong answers

Option B (ExtractKeyPhrases) is wrong because it is used to extract key phrases from text, not to detect the language. Option C (AnalyzeSentiment) is wrong because it analyzes the sentiment (positive, negative, neutral) of text, not the language. Option D (RecognizeEntities) is wrong because it identifies and categorizes entities (e.g., people, places, organizations) in text, not the language.

Practice this question →

191

MCQmedium

You manage an API in Azure API Management. The API response varies depending on the caller's subscription key. You need to cache responses per subscription key to reduce backend load. Which policy configuration should you use?

A.Set cache key to include the subscription key

B.Use a global cache with no variation

C.Disable caching and rely on the backend

D.Use rate limiting policy

AnswerA

When API responses vary based on the caller's identity, such as a subscription, including the subscription key (e.g., using @(context.Subscription.Id)) in the cache key ensures that each unique subscriber receives their specific cached data. This policy prevents data leakage between subscriptions while still leveraging Azure API Management's caching capabilities to reduce backend load and improve response times for individual subscribers. It effectively creates isolated cache entries per subscription, providing personalized caching.

Why this answer

Azure API Management's caching policy allows you to customize the cache key using the `@(context.Subscription.Id)` expression. By setting the cache key to include the subscription key, each caller's responses are cached separately based on their unique subscription, ensuring that variations in the API response per subscription key are preserved while reducing backend load.

Exam trap

The trap here is that candidates might confuse caching policies with rate limiting or assume that a single global cache is sufficient, overlooking the need to differentiate cache entries per caller identity when the API response varies by subscription key.

How to eliminate wrong answers

Option B is wrong because using a global cache with no variation would cache a single response for all callers, ignoring the fact that the API response varies per subscription key, leading to incorrect responses for most callers. Option C is wrong because disabling caching and relying on the backend would not reduce backend load, which is the primary requirement; it would force every request to hit the backend, defeating the purpose of caching. Option D is wrong because rate limiting policy controls the number of requests a caller can make, not the caching of responses; it does not address the need to cache responses per subscription key.

Practice this question →

192

Multi-Selecthard

Which THREE features of Azure API Management help enforce security policies for APIs? (Choose three.)

Select 3 answers

A.rate-limit policy

B.xml-to-json policy

C.cache-lookup policy

D.validate-jwt policy

E.IP filtering policy

AnswersA, D, E

The `rate-limit` policy is a critical security feature in Azure API Management designed to prevent API abuse, Denial of Service (DoS) attacks, and brute-force attempts. It enforces a maximum number of API calls a client or subscription can make within a specified time window, ensuring fair usage and protecting backend services from being overwhelmed by excessive requests. By controlling the request volume, this policy helps maintain API availability and stability, which are fundamental aspects of overall API security.

Why this answer

The rate-limit policy (A) is correct because it enforces security by throttling API calls to prevent abuse and denial-of-service attacks, limiting the number of requests within a specified time window per subscription or key. This protects backend services from being overwhelmed by excessive traffic, a core security requirement for API management.

Exam trap

The trap here is that candidates may confuse transformation or caching policies (like xml-to-json or cache-lookup) with security policies, but Azure API Management clearly categorizes security policies as those that control access, authenticate, or throttle traffic, not those that modify data or improve performance.

Practice this question →

193

MCQhard

You are building a solution that processes orders from multiple regions. Orders must be processed in the order they are received, but processing can take up to 5 minutes. You need to ensure exactly-once processing and minimize latency. Which Azure service and configuration should you use?

A.Azure Service Bus Queue with sessions enabled

B.Azure Event Hubs with consumer groups

C.Azure Service Bus Queue with duplicate detection enabled

D.Azure Queue Storage with poison messages

AnswerA

Azure Service Bus Queues with sessions enabled provide a robust mechanism for processing related messages in a guaranteed FIFO order. Sessions group messages by a SessionId, ensuring that all messages belonging to a specific session are delivered to a single receiver and processed sequentially. This capability is crucial for scenarios like order processing, where the sequence of operations for a single order must be maintained, and it facilitates achieving effective exactly-once processing within that session context.

Why this answer

Azure Service Bus Queue with sessions enabled ensures FIFO (first-in-first-out) ordering and exactly-once processing by grouping related messages into sessions. Sessions guarantee that messages within a session are processed in order, and the lock mechanism prevents duplicate processing even if processing takes up to 5 minutes. This minimizes latency by avoiding the overhead of duplicate detection or consumer group coordination.

Exam trap

The trap here is that candidates often confuse 'duplicate detection' with 'ordering,' but duplicate detection only prevents duplicate message IDs within a time window and does not guarantee FIFO order, while sessions are required for ordered processing.

How to eliminate wrong answers

Option B is wrong because Azure Event Hubs with consumer groups is designed for high-throughput event ingestion and does not guarantee FIFO ordering or exactly-once processing; it supports at-least-once delivery and requires checkpointing for ordering. Option C is wrong because Azure Service Bus Queue with duplicate detection enabled prevents duplicate messages based on a time window but does not enforce message ordering, so messages could be processed out of order. Option D is wrong because Azure Queue Storage with poison messages does not provide FIFO ordering or exactly-once processing; it offers at-least-once delivery and requires manual handling of poison messages, which can lead to duplicates and reordering.

Practice this question →

194

MCQeasy

Fabrikam Inc. has an Azure Function app that processes image uploads. Each time a blob is added to a container in Azure Blob Storage, the function is triggered. The function resizes the image and stores the result in another container. Currently, the function uses an Azure Storage account connection string stored in application settings. The security team requires that no connection strings or access keys be stored in application settings. The function must use managed identity to access the storage account. The storage account is in the same subscription. Which action should the team take?

A.Generate a SAS token for the storage account and store it in Key Vault. Retrieve the SAS token at runtime and use it to create the BlobServiceClient.

B.Create a user-assigned managed identity, assign it to the Function app, and grant it 'Storage Blob Data Contributor' role. Store the client ID in app settings. Use ManagedIdentityCredential with the client ID in code.

C.Keep the connection string in app settings but encrypt it using Azure Key Vault. Use Key Vault references to retrieve it.

D.Enable system-assigned managed identity on the Function app. Assign the 'Storage Blob Data Contributor' role to the managed identity on the storage account. Remove the connection string from application settings. Update the code to use DefaultAzureCredential to authenticate to Blob Storage.

AnswerD

This option correctly implements the recommended secure pattern for Azure services. Enabling a system-assigned managed identity provides the Function app with an automatically managed identity in Azure Active Directory, eliminating the need for any secrets or connection strings. Assigning the 'Storage Blob Data Contributor' role via RBAC grants only the necessary permissions to the storage account. Finally, `DefaultAzureCredential` in the code automatically detects and uses this managed identity for authentication, ensuring a robust, secret-less, and least-privilege access model.

Why this answer

It uses a system-assigned managed identity, which is automatically tied to the Function app's lifecycle, and assigns the 'Storage Blob Data Contributor' role to that identity on the storage account. This eliminates the need for any connection strings or access keys in application settings. The code then uses DefaultAzureCredential, which automatically discovers and uses the managed identity when running in Azure, providing secure, passwordless authentication to Azure Blob Storage.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing user-assigned managed identities or Key Vault integrations, when the simplest and most secure approach for a single-resource scenario is to use a system-assigned managed identity with DefaultAzureCredential, which requires zero stored secrets or identifiers in application settings.

How to eliminate wrong answers

Option A is wrong because generating a SAS token and storing it in Key Vault still requires managing a secret (the SAS token) and does not eliminate the need for a connection string or access key; it merely moves the secret to Key Vault, violating the requirement to not store any connection strings or access keys. Option B is wrong because while a user-assigned managed identity can work, it requires storing the client ID in app settings and explicitly passing it to ManagedIdentityCredential, which adds unnecessary complexity and still stores an identifier in settings; the simpler and more secure approach is to use a system-assigned managed identity with DefaultAzureCredential, which requires no stored identifiers. Option C is wrong because it keeps the connection string in app settings (even if encrypted via Key Vault references), which still stores a connection string or access key, directly violating the security team's requirement that no connection strings or access keys be stored in application settings.

Practice this question →

195

MCQmedium

You are developing a solution that needs to consume an external SOAP web service. Which approach should you use to integrate it into a modern .NET Core application?

A.Use gRPC client to call the service.

B.Use HttpClient to send raw HTTP requests with SOAP envelope.

C.Use the WCF Client (System.ServiceModel) to generate a proxy and call the SOAP service.

D.Use Azure Logic Apps with a SOAP connector.

AnswerC

The WCF (Windows Communication Foundation) client libraries, part of `System.ServiceModel`, are the standard and most robust way to consume SOAP-based web services in .NET. By using tools like `dotnet-svcutil` to generate a proxy class from the service's WSDL (Web Services Description Language), developers gain a strongly-typed interface. This proxy handles the intricate details of SOAP message construction, serialization, deserialization, and transport automatically, significantly simplifying interaction with the service and reducing development effort.

Why this answer

System.ServiceModel (WCF Client) provides built-in support for SOAP protocols, including WS-* standards, message security, and automatic proxy generation from WSDL. In modern .NET Core (and .NET 5+), the WCF client libraries are available via the System.ServiceModel.Http NuGet package, making it the most appropriate and feature-complete way to consume a SOAP service in a .NET Core application.

Exam trap

The trap here is that candidates assume HttpClient is sufficient for SOAP because it can send XML, but they overlook the complexity of SOAP standards (WS-Addressing, security, MTOM) that the WCF client handles automatically, making raw HTTP requests a fragile and non-production-ready approach.

How to eliminate wrong answers

Option A is wrong because gRPC is a binary, HTTP/2-based RPC framework that does not support SOAP envelopes or XML-based messaging; it is designed for high-performance, contract-first communication using Protocol Buffers, not for interoperating with legacy SOAP services. Option B is wrong because while HttpClient can technically send raw HTTP requests with a SOAP envelope, this approach requires manually constructing XML, handling WS-Addressing headers, managing security tokens, and parsing responses—essentially reimplementing the entire SOAP stack, which is error-prone and not recommended for production use. Option D is wrong because Azure Logic Apps with a SOAP connector is an integration platform-as-a-service (iPaaS) solution that runs outside the application process, adding network latency, cost, and operational complexity; it is not a code-level integration approach for a .NET Core application.

Practice this question →

196

MCQhard

A company uses Azure Event Hubs to ingest telemetry data from IoT devices. The data is processed by a stream analytics job that outputs to Azure Data Lake Storage Gen2. The developer needs to ensure that the stream analytics job can authenticate to Event Hubs without storing connection strings in code. Which authentication method should the developer use?

A.Use a connection string with the Event Hubs namespace

B.Use a client certificate

C.Use a Shared Access Signature (SAS) token

D.Use Managed Identity

AnswerD

Managed Identity for Azure resources provides an automatically managed identity in Azure Active Directory (Azure AD) for Azure services. This eliminates the need for developers to manage credentials, as Azure handles the authentication process securely behind the scenes. The service instance authenticates with Azure AD, which then grants access to other Azure resources like Event Hubs based on assigned roles, significantly enhancing security and simplifying credential management.

Why this answer

Managed Identity allows the Azure Stream Analytics job to authenticate to Event Hubs without storing any credentials in code or configuration. By enabling a system-assigned or user-assigned managed identity on the Stream Analytics job, it can securely obtain an Azure AD token to access the Event Hubs namespace. This eliminates the need for connection strings or SAS tokens, aligning with the requirement to avoid storing secrets.

Exam trap

The trap here is that candidates often confuse SAS tokens with managed identities, thinking SAS tokens are 'secret-free' because they are generated at runtime, but they still require the SAS key to be stored or generated from a stored key, whereas managed identities eliminate all secret storage entirely.

How to eliminate wrong answers

Option A is wrong because using a connection string with the Event Hubs namespace would require storing the connection string in code or configuration, violating the requirement to avoid storing secrets. Option B is wrong because client certificates are not a supported authentication method for Azure Stream Analytics to connect to Event Hubs; they are typically used for HTTPS or TLS mutual authentication, not for Azure service-to-service authentication. Option C is wrong because a Shared Access Signature (SAS) token still requires generating and storing the token or its signing key, which does not eliminate the need to manage secrets in code.

Practice this question →

197

MCQeasy

You need to call a third-party REST API from your Azure Function app. The API requires an API key in the header. Where should you store the API key to keep it secure?

A.Environment variable in the hosting plan

B.Azure Key Vault

C.Connection string in the Function app

D.App settings in the Function app configuration

AnswerB

Azure Key Vault is the recommended and most secure solution for storing secrets like API keys, connection strings, and certificates. It provides hardware security module (HSM)-backed protection, fine-grained access control through Azure RBAC or Key Vault access policies, and comprehensive audit logging, ensuring secrets are encrypted at rest and in transit, and only authorized identities can retrieve them. Azure Functions can integrate with Key Vault using managed identities, eliminating the need to store any secrets directly in the function app configuration.

Why this answer

Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like API keys, with access control via Azure AD and automatic rotation capabilities. The Function app can securely retrieve the key at runtime using a managed identity, avoiding hardcoding or exposing the secret in configuration files or environment variables.

Exam trap

The trap here is that candidates often confuse 'app settings' or 'environment variables' as secure storage, but Azure explicitly recommends Key Vault for secrets, and the exam tests this distinction by making the other options appear convenient but insecure.

How to eliminate wrong answers

Option A is wrong because environment variables in the hosting plan are not encrypted at rest and can be exposed through portal access or logs, failing to meet security best practices. Option C is wrong because connection strings are designed for database connections, not API keys, and they are stored in plaintext in the Function app configuration unless encrypted by Key Vault references. Option D is wrong because app settings in the Function app configuration are stored as plaintext in the Azure portal and can be viewed by anyone with contributor access, lacking the encryption and access control provided by Key Vault.

Practice this question →

198

MCQmedium

Refer to the exhibit. You are configuring Azure Monitor autoscale for a virtual machine scale set using the above JSON metric configuration. The autoscale rule is supposed to scale out when average memory usage exceeds 80%. However, autoscale is not triggering even when memory usage is consistently above 90%. What is the most likely cause?

A.The aggregation interval is too long; it should be set to 1 minute.

B.The metric name is incorrect; it should be 'Percentage Memory'.

C.The aggregation type should be 'Maximum' instead of 'Average'.

D.The autoscale rule condition is not configured to use this metric.

AnswerD

The exhibit might demonstrate the successful definition or collection of a custom metric, but this alone does not automatically link it to an autoscale action. For Azure Autoscale to react to any metric, whether platform or custom, a specific autoscale rule must be explicitly configured within an autoscale setting. This rule must reference the exact metric name, its aggregation type, time grain, operator, and a threshold to define the conditions under which scaling actions should occur.

Why this answer

The exhibit shows a metric configuration, but the autoscale rule itself must explicitly reference that metric in its condition. Without a rule condition that uses this metric, autoscale will not evaluate it, regardless of how the metric is configured. The JSON snippet only defines the metric source, not the scaling rule logic.

Exam trap

The trap here is that candidates assume defining a metric in the configuration automatically creates a scaling rule, but Azure requires an explicit rule condition to link the metric to a scale action.

How to eliminate wrong answers

Option A is wrong because the aggregation interval (e.g., 5 minutes) is not inherently too long; autoscale uses the configured duration to evaluate the metric, and a longer interval can still trigger if the threshold is exceeded consistently. Option B is wrong because the metric name 'Memory Percentage' is correct for Azure Monitor; 'Percentage Memory' is not a valid metric name. Option C is wrong because changing the aggregation type to 'Maximum' would make the rule more sensitive to spikes, not fix the issue of the rule not triggering at all; the problem is that the rule is not configured to use this metric.

Practice this question →

199

MCQhard

Your Azure Function app processes messages from an Azure Service Bus queue. The function is triggered by Service Bus messages. Occasionally, the function throws an unhandled exception after the message is processed but before the function completes. What happens to the message?

A.The message is moved to the dead-letter queue.

B.The message is abandoned and becomes available for other consumers after the lock duration expires.

C.The message is completed automatically despite the exception.

D.The message is automatically removed from the queue.

AnswerB

When an Azure Function processing a Service Bus message in PeekLock mode throws an unhandled exception, the underlying Service Bus message client implicitly calls `Abandon()` on the message. This action releases the lock on the message, making it available for other consumers to process once the message's `LockDuration` expires. The message's `DeliveryCount` is incremented, indicating it has been attempted and failed, thus preparing it for a retry.

Why this answer

In Azure Functions with a Service Bus trigger, the function runtime manages the lock on the message. If an unhandled exception occurs after the message has been processed but before the function returns, the runtime interprets this as a failure to complete the message. As a result, the message is abandoned, meaning the lock is released, and the message becomes available for redelivery to other consumers after the lock duration expires.

This behavior ensures that messages are not lost but can be retried.

Exam trap

The trap here is that candidates assume an exception after processing still results in the message being completed or dead-lettered immediately, but Azure Functions' Service Bus trigger abandons the message for retry, not dead-lettering it on the first failure.

How to eliminate wrong answers

Option A is wrong because messages are moved to the dead-letter queue only after exceeding the maximum delivery count or due to specific system errors (e.g., deserialization failure), not from a single unhandled exception after processing. Option C is wrong because the function runtime does not automatically complete a message if an exception occurs; completion only happens on successful execution. Option D is wrong because messages are never automatically removed from the queue on failure; they are either abandoned for retry or dead-lettered after retries are exhausted.

Practice this question →

200

MCQeasy

You need to expose an on-premises API securely to external partners without opening firewall ports. Which Azure service should you use?

A.Azure Traffic Manager

B.Azure API Management

C.Azure Application Gateway

D.Azure Front Door

AnswerB

Azure API Management is specifically designed to securely expose, publish, and manage APIs, including those hosted on-premises, to external consumers. It acts as a facade, providing a centralized gateway for all API traffic, enabling features like authentication, authorization, rate limiting, caching, request/response transformation, and a developer portal. Its ability to integrate with on-premises networks via VPN or ExpressRoute makes it the ideal solution for securely routing external requests to internal APIs.

Why this answer

Azure API Management is the correct choice because it acts as a secure gateway for exposing on-premises APIs to external partners without opening firewall ports. It can connect to on-premises backends via a VPN or Azure ExpressRoute, and it handles authentication, throttling, and transformation at the gateway layer, keeping the internal network isolated.

Exam trap

The trap here is that candidates often confuse Azure API Management with Azure Application Gateway or Azure Front Door, thinking that any reverse proxy or load balancer can expose APIs securely, but they miss that API Management is the only service that provides full API lifecycle management, including developer portals, policies, and subscription keys, without requiring direct network access to the backend.

How to eliminate wrong answers

Option A is wrong because Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming traffic across endpoints based on routing methods (e.g., performance, priority), but it does not provide API-level security, authentication, or the ability to expose on-premises APIs without opening firewall ports. Option C is wrong because Azure Application Gateway is a layer-7 load balancer with web application firewall (WAF) capabilities, but it requires the backend to be directly reachable from the gateway, meaning firewall ports must be opened or a VPN must be configured; it does not natively abstract API management features like subscription keys or policies. Option D is wrong because Azure Front Door is a global HTTP/HTTPS load balancer and content delivery network (CDN) that accelerates and secures web applications at the edge, but it does not provide API management capabilities such as rate limiting, transformation, or developer portal integration, and it still requires network connectivity to the backend.

Practice this question →

201

MCQeasy

Your company uses Azure API Management (APIM) to expose several APIs. One of the backend APIs requires an API key that is stored in Azure Key Vault. You need to configure APIM to retrieve the API key from Key Vault and pass it to the backend in a header without exposing the key in policy definitions. Which APIM feature should you use?

A.Use a policy expression with the context.Variables to store the key.

B.Store the API key directly in the backend settings of the API.

C.Use a named value that references the Key Vault secret, and reference that named value in a set-header policy.

D.Use the authentication-managed-identity policy to authenticate to Key Vault and retrieve the secret.

AnswerC

This is the correct and recommended approach for securely managing secrets in Azure API Management. Named values can be configured to reference a secret stored in Azure Key Vault. APIM, using its managed identity, securely retrieves the secret at runtime and injects its value into the `set-header` policy without ever exposing the secret in the APIM configuration or policy definitions.

Why this answer

Named values in Azure API Management can be configured to reference secrets stored in Azure Key Vault. When a named value is linked to a Key Vault secret, APIM automatically retrieves the secret value at runtime and can inject it into policies (e.g., a set-header policy) without the secret ever appearing in plaintext in the policy definition. This approach ensures the API key is securely managed and not exposed in source control or policy code.

Exam trap

The trap here is that candidates often confuse the authentication-managed-identity policy (used for backend authentication) with the named value Key Vault integration (used for secret retrieval), leading them to select option D even though it does not directly retrieve secrets from Key Vault.

How to eliminate wrong answers

Option A is wrong because context.Variables in a policy expression are used to store temporary values within a policy scope, but they cannot directly retrieve secrets from Key Vault; the secret would still need to be fetched via a named value or managed identity, making this approach incomplete and insecure if the key is hardcoded. Option B is wrong because storing the API key directly in the backend settings of the API would expose the key in plaintext within the APIM configuration, violating the requirement to avoid exposing the key in policy definitions and not leveraging Key Vault for secure storage. Option D is wrong because the authentication-managed-identity policy is used to authenticate APIM to a backend service (e.g., to call another Azure resource), not to retrieve secrets from Key Vault; retrieving a secret from Key Vault requires a named value with a Key Vault reference or a custom policy using the send-request policy with managed identity, but the authentication-managed-identity policy alone does not fetch secrets.

Practice this question →

202

MCQeasy

Your company wants to send email notifications to users via a third-party email service (SendGrid) from an Azure Logic App. What is the recommended way to securely store the SendGrid API key?

A.Store the API key in Azure Key Vault and use a managed identity to retrieve it

B.Store the API key in an App Setting of the Logic App

C.Hardcode the API key in the Logic App workflow definition

D.Store the API key in an environment variable on the integration service environment

AnswerA

Key Vault provides secure storage with access policies and auditing.

Why this answer

Azure Key Vault securely stores secrets and can be accessed by Logic Apps via managed identity, providing the most secure and recommended approach. Option B is wrong because app settings are less secure and can be exposed in configuration files or logs. Option C is wrong because hardcoding secrets in workflow definitions is insecure and violates best practices.

Option D is wrong because environment variables are not specifically designed for secret management and lack the security controls of Key Vault.

Practice this question →

203

MCQhard

Adventure Works is developing a payment processing system on Azure. The system uses an Azure Service Bus queue to decouple the frontend from the backend. The frontend sends a message to the queue. A backend service, running as an Azure WebJob, processes the message and calls a third-party payment gateway via HTTPS. The backend must authenticate to the payment gateway using a client certificate stored in Azure Key Vault. The WebJob must be able to access the certificate without storing any secrets in configuration. The WebJob runs in an App Service plan with system-assigned managed identity enabled. Which approach should the team use to retrieve the certificate and authenticate to the payment gateway?

A.In the WebJob code, use SecretClient from Azure.Security.KeyVault.Secrets to retrieve the certificate as a secret. Parse the secret value to X509Certificate2. Use the certificate in HttpClientHandler to call the payment gateway.

B.Store the certificate as a .pfx file in a blob container with a SAS token. Download the blob using the SAS token and load the certificate.

C.Create a service principal with a client secret, store the secret in Key Vault. Use ClientSecretCredential to authenticate to Key Vault and retrieve the certificate.

D.Store the certificate thumbprint in application settings. Use the Azure App Service certificate store to load the certificate by thumbprint.

AnswerA

Correct: uses managed identity to retrieve certificate from Key Vault.

Why this answer

The WebJob can use its system-assigned managed identity to authenticate to Azure Key Vault without storing any secrets. The SecretClient from Azure.Security.KeyVault.Secrets retrieves the certificate as a secret, which can be parsed into an X509Certificate2 object. This certificate is then used in an HttpClientHandler to authenticate to the payment gateway via HTTPS, fulfilling all requirements securely.

Exam trap

The trap here is that candidates may think storing a certificate thumbprint in application settings is acceptable, but that still requires the certificate to be present in the App Service certificate store, which bypasses Key Vault and introduces a secret management issue.

How to eliminate wrong answers

Option B is wrong because storing a certificate as a .pfx file in a blob container with a SAS token requires managing the SAS token, which is a secret that would need to be stored in configuration, violating the requirement of not storing any secrets. Option C is wrong because creating a service principal with a client secret introduces an additional secret that must be stored, contradicting the goal of using managed identity to avoid secrets. Option D is wrong because storing the certificate thumbprint in application settings and using the Azure App Service certificate store requires the certificate to be uploaded to the App Service, which does not leverage Key Vault and may not meet the requirement of retrieving the certificate from Key Vault without storing secrets.

Practice this question →

204

MCQmedium

Your company uses Azure Logic Apps to automate a business process. The process needs to call an external REST API that requires an API key passed in the Authorization header. You need to store the API key securely and reference it in the Logic App. Which approach should you use?

A.Store the API key in the Logic App's definition as a constant

B.Use an Azure Key Vault secret and a managed identity

C.Hardcode the API key in a parameter file

D.Use an Azure Storage account table to store the key

AnswerB

Utilizing an Azure Key Vault secret in conjunction with a managed identity is the most secure and recommended approach for handling API keys. Azure Key Vault provides a centralized, secure store for secrets, backed by FIPS 140-2 Level 2 validated hardware security modules (HSMs), offering encryption, versioning, and granular access policies. A managed identity allows the Logic App to authenticate to Key Vault using Azure Active Directory without needing any hardcoded credentials, adhering to the principle of least privilege and simplifying secret rotation.

Why this answer

Azure Key Vault securely stores secrets like API keys, and using a managed identity allows the Logic App to authenticate to Key Vault without embedding credentials in code or configuration. This follows the principle of least privilege and eliminates the need to manage secrets in connection strings or parameter files.

Exam trap

The trap here is that candidates often choose Option A or C because they think storing the key in the Logic App definition or a parameter file is 'secure enough' for development, but the exam emphasizes that any plaintext storage in code or configuration is a security violation, and the only correct approach is to use a dedicated secrets store like Key Vault with managed identity.

How to eliminate wrong answers

Option A is wrong because storing the API key as a constant in the Logic App's definition exposes the key in plaintext within the workflow JSON, which can be viewed by anyone with read access to the Logic App and violates security best practices. Option C is wrong because hardcoding the API key in a parameter file still stores the key in plaintext within the deployment or configuration files, which can be leaked through source control or logs. Option D is wrong because using an Azure Storage account table to store the key does not provide encryption at rest by default (unless client-side encryption is implemented) and requires managing access keys for the storage account, introducing additional security risks.

Practice this question →

205

MCQmedium

You are building an event-driven application that needs to publish messages to multiple independent subscribers. Each subscriber must be able to filter messages based on custom properties, and each subscriber must receive all messages that match its filter, even if other subscribers have different filters. The solution must guarantee message delivery. Which Azure messaging service should you use?

A.Azure Queue Storage

B.Azure Service Bus Topics and Subscriptions

C.Azure Service Bus Queues

D.Azure Event Hubs

AnswerB

Azure Service Bus Topics and Subscriptions are purpose-built for implementing the publish/subscribe messaging pattern, making them ideal for event-driven architectures requiring message filtering. A publisher sends messages to a topic, and multiple independent subscriptions can be configured on that topic. Each subscription can apply SQL-like or correlation filters to receive only a subset of messages, ensuring that consumers only process events relevant to them. This enables robust fan-out capabilities with tailored message delivery.

Why this answer

Azure Service Bus Topics and Subscriptions are designed for publish-subscribe messaging where multiple independent subscribers each receive a copy of every message that matches their filter criteria. The topic allows publishing messages with custom properties, and each subscription can define a SQL-like filter (using the `SqlFilter` class) to select only relevant messages. This ensures that all subscribers receive all messages matching their filter, with guaranteed delivery via the broker's persistent storage and at-least-once delivery semantics.

Exam trap

The trap here is that candidates confuse Azure Service Bus Queues (point-to-point) with Topics (publish-subscribe), or assume Event Hubs can handle per-subscriber filtering, but Event Hubs lacks broker-side filtering and guarantees each event is consumed by only one consumer per consumer group, not by multiple independent subscribers with custom filters.

How to eliminate wrong answers

Option A is wrong because Azure Queue Storage provides a simple FIFO queue for point-to-point messaging; it does not support multiple independent subscribers or message filtering based on custom properties — each message is consumed by a single consumer. Option C is wrong because Azure Service Bus Queues also implement a point-to-point pattern where each message is delivered to only one consumer; they lack the publish-subscribe capability and per-subscriber filtering that topics and subscriptions provide. Option D is wrong because Azure Event Hubs is optimized for high-throughput event ingestion from multiple producers, not for guaranteed delivery to multiple independent subscribers with custom property filtering — it uses consumer groups for load balancing, not per-subscriber filters, and does not offer the same broker-level filtering or at-least-once delivery guarantees for each subscriber.

Practice this question →

206

Drag & Dropmedium

Arrange the steps to deploy a containerized application to Azure Container Instances (ACI) from Azure Container Registry (ACR) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First create ACR, push image, create container group, configure settings, then start.

Practice this question →

207

MCQeasy

You are building an Azure Logic App that must send an email notification when a new file is added to a SharePoint Online document library. Which connector and trigger should you use?

A.Use the SharePoint connector with the 'When a file is created' trigger

B.Use the Office 365 Outlook connector with the 'When a new email arrives' trigger

C.Use the Azure Blob Storage connector with the 'When a blob is added or modified' trigger

D.Use the HTTP connector with a manual trigger and poll SharePoint's REST API

AnswerA

The SharePoint connector is purpose-built for seamless integration with SharePoint Online, offering a robust set of actions and triggers. The 'When a file is created' trigger specifically listens for new file additions within a designated SharePoint site and document library. This event-driven trigger automatically initiates the Logic App workflow upon detection, eliminating the need for custom code or manual polling, making it the most direct and efficient solution for monitoring file creation in SharePoint.

Why this answer

The SharePoint connector's 'When a file is created' trigger is the correct choice because it directly monitors a SharePoint Online document library for new file additions and initiates the Logic App workflow automatically. This trigger uses SharePoint's webhook capabilities to receive real-time notifications, eliminating the need for polling or manual intervention.

Exam trap

The trap here is that candidates may confuse the SharePoint connector with other storage connectors (like Azure Blob Storage) or mistakenly think a polling-based HTTP approach is simpler, overlooking the native event-driven trigger that is purpose-built for this exact scenario.

How to eliminate wrong answers

Option B is wrong because the Office 365 Outlook connector's 'When a new email arrives' trigger monitors an email inbox, not a SharePoint document library, and would require an email to be sent for each file addition, which is not the requirement. Option C is wrong because the Azure Blob Storage connector's 'When a blob is added or modified' trigger is designed for Azure Blob Storage containers, not SharePoint Online document libraries, and cannot directly detect file changes in SharePoint. Option D is wrong because using the HTTP connector with a manual trigger and polling SharePoint's REST API introduces unnecessary complexity, latency, and resource consumption compared to the native event-driven trigger, and it lacks the built-in authentication and optimization of the SharePoint connector.

Practice this question →

208

MCQmedium

Contoso Ltd. is migrating a legacy on-premises application to Azure. The application processes customer orders and sends confirmation emails. The new solution must use Azure Functions with an HTTP trigger to receive orders, store order data in Azure Cosmos DB, and send emails via SendGrid. Security requirements: All connections must use managed identities where possible. No secrets should be stored in code or configuration files. Cosmos DB and SendGrid API keys must be retrieved at runtime from Azure Key Vault. The Azure Function app must be able to access Key Vault without storing any connection strings or secrets in application settings. The development team plans to use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Which approach should the team use to authenticate to Key Vault?

A.Upload a client certificate to the Function app's certificate store. Use ClientCertificateCredential to authenticate to Key Vault.

B.Use Key Vault references in application settings. Store the Key Vault URI in app settings and let the Functions runtime resolve secrets.

C.Enable system-assigned managed identity on the Function app. Grant the identity 'Get' and 'List' permissions on Key Vault secrets. Use DefaultAzureCredential in code to authenticate to Key Vault.

D.Create a user-assigned managed identity, assign it to the Function app, and store its client ID in application settings. Grant the identity permissions to Key Vault. Use ClientSecretCredential with the client ID and a secret.

AnswerC

Enabling a system-assigned managed identity on the Function app provides an Azure Active Directory identity that the application can use to authenticate to other Azure services, such as Key Vault, without storing any credentials in code or configuration. Granting this identity 'Get' and 'List' permissions on Key Vault secrets ensures it has the necessary access. The `DefaultAzureCredential` in code then automatically detects and utilizes this managed identity, offering a robust, secret-free authentication mechanism.

Why this answer

It uses a system-assigned managed identity, which eliminates the need to store any secrets or connection strings. The DefaultAzureCredential class automatically attempts authentication via managed identity when running in Azure, and the code retrieves secrets from Key Vault using the Azure.Identity and Azure.Security.KeyVault.Secrets libraries. Granting 'Get' and 'List' permissions on Key Vault secrets allows the function to read the Cosmos DB and SendGrid API keys at runtime, meeting all security requirements.

Exam trap

The trap here is that candidates often confuse Key Vault references (Option B) as a valid secretless approach, but they still require storing the Key Vault URI in app settings, and the question explicitly prohibits storing any connection strings or secrets in application settings, making managed identity with DefaultAzureCredential the only fully compliant solution.

How to eliminate wrong answers

Option A is wrong because uploading a client certificate and using ClientCertificateCredential requires managing and storing a certificate, which introduces a secret that must be securely stored and rotated, violating the requirement that no secrets be stored in code or configuration files. Option B is wrong because Key Vault references in application settings still require the Key Vault URI to be stored in app settings, and the resolution happens at runtime via the Functions runtime, but the question explicitly requires that the Function app access Key Vault without storing any connection strings or secrets in application settings; additionally, Key Vault references do not use the Azure.Identity and Azure.Security.KeyVault.Secrets libraries as planned. Option D is wrong because storing the user-assigned managed identity's client ID in application settings is a form of secret storage, and using ClientSecretCredential requires a client secret, which must be stored somewhere, violating the no-secrets requirement.

Practice this question →

209

MCQhard

A company has an Azure Function app that processes messages from an Azure Storage queue. The function fails intermittently with timeout exceptions when the queue has many messages. What is the best approach to handle this?

A.Upgrade to a Premium plan

B.Decrease the batch size to reduce processing time per batch

C.Scale out the function app to multiple instances

D.Increase the batch size in the function's host.json

AnswerD

Increasing the batch size in the function's `host.json` configuration for queue or event hub triggers means each function invocation will process a larger number of messages. This significantly reduces the total number of function invocations required to process a given volume of messages. By minimizing the overhead associated with frequent cold starts, connection establishments, and other per-invocation costs, this approach can dramatically improve overall throughput and reduce the likelihood of timeouts that stem from cumulative overhead or hitting rate limits due to too many small, rapid calls.

Why this answer

Increasing the batch size in host.json allows the function to retrieve more messages per invocation, reducing the number of polling cycles and improving throughput. This directly addresses timeout exceptions under high queue load by processing messages more efficiently within the function's execution time limit.

Exam trap

The trap here is that candidates often assume scaling out (Option C) is the universal solution for any load issue, but the real bottleneck is the per-invocation polling overhead, which is fixed by adjusting batch size rather than adding instances.

How to eliminate wrong answers

Option A is wrong because upgrading to a Premium plan increases resources and scaling capabilities but does not directly resolve timeout exceptions caused by excessive polling overhead; it is an expensive overcorrection. Option B is wrong because decreasing the batch size reduces the number of messages processed per invocation, which increases the number of polling cycles and can worsen timeout issues under high load. Option C is wrong because scaling out to multiple instances distributes the load but does not fix the per-instance timeout problem caused by inefficient batch processing; it may still result in timeouts if each instance's batch size remains small.

Practice this question →

210

MCQeasy

You are developing an ASP.NET Core application that needs to access Azure Key Vault to retrieve secrets. You have enabled a managed identity for the App Service. Which Azure SDK class should you use to authenticate to Key Vault?

A.DefaultAzureCredential

B.ClientSecretCredential

C.ManagedIdentityCredential

D.InteractiveBrowserCredential

AnswerA

DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism, automatically attempting various credential types in a specific order. For an ASP.NET Core application deployed to Azure, it will seamlessly leverage the assigned Managed Identity without requiring any code changes or explicit configuration. During local development, it can fall back to credentials from Visual Studio, Azure CLI, or environment variables, offering unparalleled flexibility across different environments.

Why this answer

DefaultAzureCredential is the recommended approach because it provides a chained authentication mechanism that attempts multiple credential types in order, including ManagedIdentityCredential, EnvironmentCredential, and others. When running in an Azure App Service with a managed identity enabled, DefaultAzureCredential will automatically use the managed identity to authenticate to Key Vault, making it the most flexible and future-proof choice for this scenario.

Exam trap

The trap here is that candidates see 'managed identity' and immediately choose ManagedIdentityCredential, forgetting that DefaultAzureCredential is the recommended and more robust choice that automatically includes managed identity support.

How to eliminate wrong answers

Option B (ClientSecretCredential) is wrong because it requires explicitly providing a client secret (password) for a service principal, which defeats the purpose of using a managed identity and introduces secret management overhead. Option C (ManagedIdentityCredential) is wrong because while it would work in this specific scenario, it is not the best practice; DefaultAzureCredential is preferred as it falls back to other credential types (e.g., environment variables, Visual Studio credentials) if the managed identity is unavailable, providing better portability and resilience. Option D (InteractiveBrowserCredential) is wrong because it requires user interaction via a browser to authenticate, which is unsuitable for a server-side App Service that runs unattended.

Practice this question →

211

MCQmedium

A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?

A.ACR Tasks

B.ACR admin keys

C.Managed Identity

D.Service principal with password

AnswerC

Managed Identities provide an Azure Active Directory identity for Azure services, eliminating the need for developers to manage credentials. By assigning a system-assigned or user-assigned managed identity to the AKS cluster and granting it the `AcrPull` role on the Azure Container Registry, AKS can securely authenticate to ACR using Azure AD tokens. This method adheres to the principle of least privilege and significantly enhances security by removing the need to store, rotate, or expose any secrets.

Why this answer

Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Azure AD automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.

Exam trap

The trap here is that candidates often confuse ACR admin keys (which are simple to enable) with a secure solution, but the question explicitly requires 'without storing credentials,' making managed identity the only option that avoids any secret storage.

How to eliminate wrong answers

Option A is wrong because ACR Tasks is a build and image management feature for automating container image creation and patching, not an authentication method for pulling images during AKS deployments. Option B is wrong because ACR admin keys are static, shared credentials that must be stored in Kubernetes secrets or DevOps variables, violating the requirement to avoid storing credentials. Option D is wrong because a service principal with password requires storing the password in Azure DevOps or a Kubernetes secret, which contradicts the 'without storing credentials' requirement.

Practice this question →

212

MCQmedium

A retail system uses Azure Service Bus to process orders. Each order has multiple messages (e.g., payment, shipping, confirmation) that must be processed in sequence. You need to guarantee that all messages belonging to the same order are handled by the same consumer in order. Which Service Bus feature should you use?

A.Sessions

B.Scheduled messages

C.Dead-letter queue

D.Auto-forwarding

AnswerA

Azure Service Bus sessions are specifically designed to ensure strict FIFO (First-In, First-Out) ordering for messages belonging to the same logical group, identified by a unique session ID. When a consumer accepts a session, it exclusively locks that session, guaranteeing that all subsequent messages for that session ID are delivered to and processed by only that specific consumer. This mechanism is crucial for stateful processing where the order of operations within a transaction or user interaction must be preserved, making it the correct choice for maintaining order per group.

Why this answer

Sessions in Azure Service Bus enable ordered, first-in-first-out (FIFO) processing of related messages. By setting the SessionId property to the order ID, all messages for that order are grouped into a session, ensuring a single consumer processes them sequentially. This guarantees that payment, shipping, and confirmation messages for the same order are handled in order and by the same consumer.

Exam trap

The trap here is that candidates may confuse Sessions with Scheduled messages or Auto-forwarding, mistakenly thinking that delaying delivery or forwarding messages can achieve ordered processing, but only Sessions provide the required consumer affinity and FIFO guarantee for grouped messages.

How to eliminate wrong answers

Option B (Scheduled messages) is wrong because it only delays message delivery to a future time and does not provide any ordering or grouping guarantees for related messages. Option C (Dead-letter queue) is wrong because it is a sub-queue for storing messages that cannot be processed normally (e.g., due to exceeding MaxDeliveryCount), not for ensuring ordered processing of grouped messages. Option D (Auto-forwarding) is wrong because it automatically forwards messages from one queue or subscription to another based on a rule, but it does not enforce FIFO ordering or consumer affinity for related messages.

Practice this question →

213

MCQmedium

You are designing a microservices architecture where each service needs to publish events to multiple subscribers. You choose Azure Event Grid. However, one of the subscribers is a third-party service that requires HTTPS endpoint and custom headers in the event delivery. How should you configure Event Grid?

A.Use Event Grid's 'Advanced Filters' to add custom headers to events.

B.Use Event Grid domains to route events to the third-party service.

C.Set custom headers in the event subscription's 'Delivery Properties' configuration.

D.Configure a dead-letter destination to handle delivery failures.

AnswerC

The 'Delivery Properties' configuration within an Azure Event Grid event subscription is the precise mechanism for specifying custom HTTP headers. This feature allows users to define key-value pairs that Event Grid will include in the HTTP POST request when delivering an event to the subscriber's endpoint. These custom headers are crucial for scenarios like authentication (e.g., API keys), routing information, or providing context that the receiving service can utilize upon event ingestion.

Why this answer

Azure Event Grid allows you to specify custom HTTP headers in the 'Delivery Properties' section of an event subscription. This feature lets you add static or dynamic headers (e.g., authentication tokens or correlation IDs) that are included in the HTTPS POST request to the subscriber's endpoint. It directly addresses the requirement for custom headers without needing any additional infrastructure.

Exam trap

The trap here is that candidates often confuse 'Advanced Filters' (which filter events) with 'Delivery Properties' (which modify the delivery request), leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because 'Advanced Filters' are used to filter which events are delivered based on event data fields (e.g., event type, subject), not to add custom headers to the delivery request. Option B is wrong because Event Grid domains are a logical grouping mechanism for managing multiple topics and subscriptions, but they do not provide a way to add custom headers to individual event deliveries. Option D is wrong because a dead-letter destination handles undelivered events (e.g., after retries are exhausted) by storing them in Blob Storage or Event Hubs; it does not modify the delivery request with custom headers.

Practice this question →

214

MCQeasy

A developer needs to call a third-party REST API from an Azure Function app. The API requires OAuth2 client credentials flow. Which approach should they use to securely store and retrieve the client secret?

A.Store in application settings as environment variable

B.Store in Azure App Configuration

C.Store in Azure Key Vault

D.Use Managed Identity

AnswerC

Azure Key Vault is the correct service for securely storing and managing client secrets. It provides access policies, auditing, and integration with Azure Functions via managed identity or direct access.

Why this answer

Azure Key Vault is the secure store for secrets like client secrets. Option A is wrong because environment variables are not secure. Option B is wrong because App Configuration is for configuration.

Option D is wrong because Managed Identity does not store secrets; it provides identity.

Practice this question →

215

MCQhard

You are designing a solution that reads messages from an Azure Service Bus queue and processes them using an Azure Function. The function must process messages in order and ensure no duplicate processing. Which configuration should you use?

A.Use auto-forwarding to a dead-letter queue on failure

B.Partition the queue and use multiple functions to process each partition in order

C.Enable sessions on the queue and use peek-lock mode with automatic complete on success

D.Use receive and delete mode to ensure each message is processed only once

AnswerC

Enabling sessions on the queue and using peek-lock mode with automatic complete on success is the correct approach. Service Bus sessions ensure that all messages belonging to a specific session ID are processed sequentially by a single receiver, guaranteeing order for related messages. Peek-lock mode ensures reliable delivery by holding the message in the queue until it's explicitly completed or abandoned, preventing message loss if the processing function fails. Automatic completion, often handled by the Azure Functions runtime, ensures the message is removed only after successful processing, contributing to exactly-once semantics.

Why this answer

Enabling sessions on a Service Bus queue guarantees message ordering within a session, and using peek-lock mode with automatic complete ensures exactly-once processing by locking the message during processing and only completing it upon success. This combination prevents duplicate processing and maintains order, which is essential for sequential message handling in Azure Functions.

Exam trap

The trap here is that candidates often confuse partitioning (which provides ordering within a partition but not globally) with sessions (which provide strict FIFO ordering across all messages with the same session ID), leading them to incorrectly choose option B.

How to eliminate wrong answers

Option A is wrong because auto-forwarding to a dead-letter queue on failure handles poison messages but does not enforce ordering or prevent duplicate processing; it is a redirection mechanism, not a sequencing or deduplication solution. Option B is wrong because partitioning a queue distributes messages across multiple partitions, and while each partition maintains order, using multiple functions to process partitions in parallel breaks global message ordering, as messages across partitions are not sequenced. Option D is wrong because receive and delete mode removes the message from the queue immediately upon retrieval, which can lead to message loss if processing fails, and it does not guarantee exactly-once processing; it is at-most-once delivery, not suitable for ensuring no duplicates.

Practice this question →

216

MCQhard

You have an Azure Function app that processes messages from a Service Bus queue. The function uses the Service Bus trigger. You notice that under high load, some messages are processed multiple times. What is the most likely cause?

A.The queue is partitioned

B.The lock duration is too short for message processing time

C.The batch size is too large

D.The maxDeliveryCount is set too high

AnswerB

When an Azure Function processes a message from a Service Bus or Storage Queue, it acquires a lock on that message for a specified duration. If the function's execution time, including any retries or external service calls, exceeds this configured lock duration, the lock expires before the message is successfully completed. Consequently, the message is automatically released back into the queue, becoming available for another function instance (or even the same one) to pick up and process again, leading to duplicate processing.

Why this answer

The Service Bus trigger uses a lock mechanism to ensure that a message is processed exclusively by one function instance. If the lock duration is shorter than the time required to process the message, the lock expires before processing completes. This allows another consumer instance to acquire the lock and process the same message, leading to duplicate processing.

Exam trap

The trap here is that candidates often confuse message duplication with retry logic or delivery count, not realizing that the lock duration directly controls exclusive access and is the primary cause of duplicate processing under high load.

How to eliminate wrong answers

Option A is wrong because partitioning a queue improves throughput and ordering but does not cause duplicate processing; it actually helps maintain order within partitions. Option C is wrong because batch size controls how many messages are fetched at once, not the likelihood of duplicate processing; a larger batch may increase concurrency but does not cause individual messages to be processed multiple times. Option D is wrong because maxDeliveryCount determines how many times a message can be delivered before being dead-lettered; setting it too high would allow more retries but not cause duplicate processing within a single delivery attempt.

Practice this question →

217

MCQmedium

You are developing a .NET Core web application that needs to send an email notification when a user registers. You decide to use Azure Communication Services Email. Which authentication method should you use to securely connect from your application to Azure Communication Services?

A.Use an Azure AD service principal with client secret.

B.Use an endpoint and an access key from Azure Communication Services.

C.Use a connection string from the Azure portal.

D.Use a managed identity for Azure resources.

AnswerB

This option correctly identifies the standard authentication method for a .NET Core web application to interact with Azure Communication Services for data-plane operations, such as sending emails. The endpoint specifies the unique service URL for the Communication Services resource, while the access key provides cryptographic proof of identity. Together, these credentials grant the application full administrative access to perform operations on the resource, making it the primary and most direct way to authenticate when a managed identity is not applicable or available.

Why this answer

Azure Communication Services Email requires authentication via an endpoint URL and an access key, which are provisioned in the ACS resource. This is the primary method for programmatic access, as the access key is used to sign HTTP requests (via HMAC-SHA256) to the ACS Email API. Option B correctly identifies this combination as the secure authentication mechanism.

Exam trap

The trap here is that candidates often confuse Azure Communication Services with other Azure services (like Storage or Event Hubs) that support connection strings or managed identities, and incorrectly assume those authentication methods apply to ACS Email.

How to eliminate wrong answers

Option A is wrong because Azure AD service principal with client secret is not supported for authenticating to Azure Communication Services Email; ACS uses its own key-based authentication, not Azure AD tokens. Option C is wrong because while a connection string (which includes endpoint and access key) is used for some Azure services (e.g., Azure Storage), Azure Communication Services does not expose a connection string for the Email SDK; the SDK expects separate endpoint and key parameters. Option D is wrong because managed identity is not currently supported for authenticating to Azure Communication Services Email; ACS does not integrate with Azure AD for this specific service, so managed identity cannot be used.

Practice this question →

218

Multi-Selecthard

Which TWO are best practices when using Azure Service Bus for high-throughput messaging?

Select 2 answers

A.Enable duplicate detection for all queues

B.Use sessions to guarantee ordering

C.Enable batching of messages when sending

D.Use partitioned queues or topics

E.Send messages larger than 256 KB to reduce the number of messages

AnswersC, D

Enabling batching of messages when sending is a crucial best practice for optimizing Azure Service Bus performance. By grouping multiple messages into a single network operation, batching significantly reduces the number of round trips between the client application and the Service Bus namespace. This reduction in network overhead minimizes latency, improves overall message throughput, and can also lead to cost savings by consolidating billing operations, making it highly efficient for high-volume message ingestion.

Why this answer

Enabling batching allows the client to accumulate multiple messages into a single AMQP or SBMP frame, reducing the number of network round trips and improving throughput. This is particularly effective in high-throughput scenarios where the overhead of individual sends becomes a bottleneck.

Exam trap

The trap here is that candidates often confuse 'sessions' (which guarantee ordering but reduce throughput) with 'batching' (which improves throughput without ordering guarantees), or they mistakenly think duplicate detection is a harmless default rather than a performance-impacting feature.

Practice this question →

219

MCQmedium

Refer to the exhibit. A developer deploys this ARM template to create a web app with a connection string to Azure Cosmos DB. The deployment succeeds but the web app cannot connect to Cosmos DB. What is the most likely cause?

A.The connection string should use a secret reference to Azure Key Vault

B.The listKeys function is used incorrectly

C.The web app name parameter is missing

D.The listKeys function requires a different API version

AnswerA

Best practice is to use Key Vault references, but the immediate issue is that the connection string is incomplete; it needs the full connection string format.

Why this answer

The ARM template exposes the Cosmos DB connection string with the master key in plaintext, which is insecure. The connection string should be stored as a secret in Azure Key Vault and referenced using a secret reference in the ARM template. Option B is incorrect because the listKeys function is used correctly to retrieve the keys.

Option C is incorrect because the web app name parameter is present and used. Option D is incorrect because the API version is appropriate for the deployment.

Practice this question →

220

MCQmedium

You are developing a solution that processes large files uploaded by users to Azure Blob Storage. Each file must be validated for malware using Microsoft Defender for Cloud Apps before being moved to a different container for further processing. The validation can take several minutes. What is the most cost-effective and scalable approach?

A.Use Azure Event Grid to trigger an Azure Function on blob creation, which validates the file and moves it after scan.

B.Use the Azure SDK to poll for new blobs from within a continuously running background service.

C.Use an Azure VM running a scheduled task to poll for new blobs and perform validation.

D.Use Azure Logic Apps with a recurrence trigger to check for new blobs and call the Microsoft Defender API.

AnswerA

This is the most efficient and scalable solution. Azure Event Grid provides near real-time, push-based event notifications for blob creation, eliminating the need for continuous polling. An Azure Function, triggered by Event Grid, executes only when a new blob is detected, leveraging a serverless, consumption-based model that is highly cost-effective and automatically scales to handle fluctuating loads without managing infrastructure.

Why this answer

Azure Event Grid provides a serverless, event-driven architecture that triggers an Azure Function immediately when a blob is created. This eliminates the need for polling or idle compute resources, making it the most cost-effective and scalable approach for processing large files that require time-consuming malware validation.

Exam trap

The trap here is that candidates often assume polling-based solutions (like Logic Apps or background services) are simpler or more reliable, but the exam emphasizes event-driven architectures as the most cost-effective and scalable pattern for blob processing in Azure.

How to eliminate wrong answers

Option B is wrong because continuously running a background service that polls Azure Blob Storage wastes compute resources and incurs ongoing costs, even when no new blobs are uploaded, and does not scale efficiently with high volumes. Option C is wrong because using an Azure VM with a scheduled task introduces unnecessary overhead, requires manual scaling, and incurs costs for the VM even when idle, making it neither cost-effective nor scalable. Option D is wrong because Azure Logic Apps with a recurrence trigger polls for new blobs on a fixed schedule, which introduces latency and inefficiency compared to the event-driven model, and is less cost-effective for high-frequency or variable workloads.

Practice this question →

221

MCQmedium

A developer exposes several backend APIs through Azure API Management. Clients must be throttled by subscription to protect the backend. What should be configured?

A.Blob soft delete

B.Application Insights sampling

C.Private DNS zone only

D.API Management rate-limit or quota policy

AnswerD

APIM policies can enforce rate limits and quotas per subscription or caller.

Why this answer

Azure API Management provides built-in rate-limit and quota policies that allow you to throttle client requests based on subscription keys. These policies enforce limits per subscription scope, protecting backend services from excessive traffic by rejecting requests that exceed the defined rate (e.g., requests per second) or quota (e.g., total calls per month). This directly addresses the requirement to throttle clients by subscription.

Exam trap

The trap here is that candidates may confuse telemetry or storage features (like Application Insights sampling or Blob soft delete) with API throttling mechanisms, overlooking that API Management's rate-limit and quota policies are the correct and direct solution for subscription-based throttling.

How to eliminate wrong answers

Option A is wrong because Blob soft delete is an Azure Storage feature that protects blob data from accidental deletion by retaining deleted blobs for a specified retention period; it has no role in API throttling or subscription-based rate limiting. Option B is wrong because Application Insights sampling is a telemetry feature that reduces data ingestion volume by selecting a percentage of events to analyze; it does not enforce any request throttling or access control on API calls. Option C is wrong because a Private DNS zone only is used for custom domain name resolution within a virtual network, not for implementing API rate limits or subscription-based throttling.

Practice this question →

222

MCQeasy

You are building a solution that needs to send millions of events per second to Azure for processing. Which Azure service should you use to ingest the events?

A.Azure Service Bus

B.Azure Event Hubs

C.Azure IoT Hub

D.Azure Notification Hubs

AnswerB

Azure Event Hubs is purpose-built as a highly scalable big data streaming platform capable of ingesting millions of events per second from diverse sources. It excels at capturing, retaining, and processing massive streams of data, acting as the front door for event pipelines and enabling real-time analytics and batch processing. Its partitioned consumer group model allows multiple applications to process the same event stream concurrently and independently.

Why this answer

Azure Event Hubs is the correct choice because it is a big data streaming platform and event ingestion service designed to handle millions of events per second with low latency. It supports high-throughput data ingestion from sources like telemetry, logs, and clickstreams, making it ideal for this scenario.

Exam trap

The trap here is that candidates often confuse Azure Event Hubs with Azure Service Bus, assuming both are message brokers, but Event Hubs is optimized for high-throughput event ingestion while Service Bus is for reliable, ordered message delivery with features like sessions and transactions.

How to eliminate wrong answers

Option A is wrong because Azure Service Bus is a message broker for enterprise messaging with features like queues and topics, optimized for reliable, ordered delivery of individual messages, not for ingesting millions of events per second. Option C is wrong because Azure IoT Hub is a managed service for bidirectional communication with IoT devices, including device management and security features, but its event ingestion throughput is lower and it is not designed for general-purpose high-volume event streaming. Option D is wrong because Azure Notification Hubs is a push notification engine for sending notifications to mobile devices, not for ingesting or processing event streams.

Practice this question →

223

MCQhard

Your company has an on-premises Windows service that exposes a custom TCP endpoint. You are building an Azure Logic App that needs to send data to this endpoint. Due to network security policies, you cannot open inbound ports in the firewall. You need to establish a secure bidirectional connection without configuring a VPN. Which Azure service should you use?

A.Azure API Management with on-premises gateway

B.Azure Relay Hybrid Connections

C.Azure Application Gateway with private link

D.Azure ExpressRoute

AnswerB

Azure Relay Hybrid Connections is the correct solution because it enables secure, bidirectional communication over any TCP-based protocol without requiring inbound firewall ports to be opened on the on-premises network. The on-premises Windows service establishes an outbound connection to the Azure Relay endpoint, allowing Azure services to then connect to the Relay and tunnel traffic back to the on-premises service. This "outbound-only" model is ideal for scenarios with strict on-premises network security policies.

Why this answer

Azure Relay Hybrid Connections enable secure bidirectional communication between on-premises services and cloud applications without opening inbound firewall ports. The on-premises service initiates an outbound connection to the Azure Relay over port 443 (HTTPS), and the Logic App sends data through the relay, which forwards it over the already-established outbound tunnel. This satisfies the requirement for a secure, bidirectional connection without VPN or inbound port exposure.

Exam trap

The trap here is that candidates often confuse Azure Relay with Azure API Management or Application Gateway, assuming they can handle arbitrary TCP traffic, but only Hybrid Connections provide the outbound-initiated tunnel required when inbound ports are blocked.

How to eliminate wrong answers

Option A is wrong because Azure API Management with on-premises gateway is designed for exposing and managing APIs, not for establishing a bidirectional TCP tunnel; it still requires inbound connectivity or a VPN for the gateway to reach the on-premises service. Option C is wrong because Azure Application Gateway with private link provides inbound HTTPS load balancing and private connectivity to Azure services, but it does not create an outbound-initiated tunnel to an on-premises TCP endpoint without opening inbound ports. Option D is wrong because Azure ExpressRoute establishes a dedicated private network connection between on-premises and Azure, which requires BGP routing and often firewall configuration, violating the 'no VPN' and 'no inbound ports' constraints.

Practice this question →

224

MCQmedium

An application uses Azure Redis Cache to improve performance. The team notices that cache misses are high and the cache is not effectively reducing database load. What should they do to improve cache hit ratio?

A.Increase the cache size

B.Increase the time-to-live (TTL) for cached items

C.Implement cache-aside pattern with manual invalidation

D.Change the eviction policy to allkeys-lfu

AnswerB

Increasing the Time-To-Live (TTL) for cached items directly improves the cache hit ratio by ensuring data remains in the cache for a longer duration. When an item's TTL is extended, it reduces the likelihood of that item expiring and being removed from the cache, thereby preventing subsequent requests for the same data from resulting in a cache miss and a slower fetch from the origin data store. This directly addresses the problem of items being removed prematurely.

Why this answer

High cache misses often indicate that cached data is expiring too quickly, forcing the application to fetch data from the database. Increasing the time-to-live (TTL) for cached items keeps frequently accessed data in the cache longer, directly improving the cache hit ratio. This is the most straightforward fix when the cache is underutilized due to premature eviction, not because of capacity or policy issues.

Exam trap

The trap here is that candidates confuse cache misses caused by expiration (TTL too short) with cache misses caused by memory pressure (evictions), leading them to incorrectly choose increasing cache size or changing eviction policy instead of adjusting TTL.

How to eliminate wrong answers

Option A is wrong because increasing cache size addresses capacity constraints (e.g., evictions due to memory pressure), but the problem is high cache misses, not evictions; a larger cache won't help if items expire too soon. Option C is wrong because cache-aside with manual invalidation is already a common pattern; implementing it doesn't inherently improve hit ratio—it only ensures data consistency, and manual invalidation could actually increase misses if not done carefully. Option D is wrong because changing the eviction policy to allkeys-lfu (Least Frequently Used) only affects which keys are removed when memory is full; it does not extend how long items stay in cache, so it won't reduce misses caused by short TTLs.

Practice this question →

225

MCQeasy

Your web app hosted on Azure App Service needs to consume an external SaaS API that requires an API key. The key must be stored securely and rotated without redeploying the app. What is the best approach?

A.Store the API key in Azure SQL Database and query it at startup.

B.Store the API key in Azure Key Vault and use a managed identity to retrieve it.

C.Store the API key in a configuration file in the application code.

D.Store the API key in an App Service application setting.

AnswerB

While using Azure Key Vault for secure storage and managed identities for retrieval is an excellent security practise, this option fails because a managed identity authenticates the web app to *Azure resources*, such as Key Vault itself, using Microsoft Entra ID. It does not provide a mechanism to directly authenticate or pass an API key to an *external* SaaS API. This approach is tempting and would be correct if the external SaaS API supported Microsoft Entra ID authentication, allowing the managed identity to obtain a token for direct access, or if the requirement was solely for the app to securely *access* the key for its own internal use.

Why this answer

Azure Key Vault is specifically designed for securely storing and managing secrets, keys, and certificates. Using a Managed Identity for the App Service allows it to authenticate to Key Vault without needing any secrets (like connection strings or client IDs/secrets) stored within the App Service itself, adhering to the principle of least privilege. Secrets in Key Vault can be rotated independently, and the application can be designed to retrieve the latest version without redeployment, satisfying all requirements.

This approach provides the highest level of security, auditability, and adherence to Azure best practices for secret management.

Exam trap

The trap is choosing App Service application settings (Option D) because they are simpler and can technically store secrets. However, Azure Key Vault with Managed Identity (Option B) is the recommended best practice for secure secret management in Azure, offering a dedicated, more robust, and auditable solution that aligns with enterprise security standards and the development principles tested in the AZ-204 exam. While App Service settings provide basic security, Key Vault is the superior choice for 'best approach' when dealing with sensitive API keys.

How to eliminate wrong answers

Option A is wrong because querying an Azure SQL Database at startup introduces unnecessary latency, complexity, and potential security exposure from connection strings, and it does not leverage Azure's built-in secure storage for secrets. Option B is wrong because while Azure Key Vault with managed identity is a highly secure approach, it is overkill for a single API key and requires additional code and configuration (e.g., using Key Vault references or SDK calls), whereas App Service application settings provide a simpler solution that still meets the requirements. Option C is wrong because storing the API key in a configuration file in the application code exposes the key in source control and prevents rotation without redeploying the app, violating both security and rotation requirements.

Practice this question →