AZ-204 Real Exam Questions
588 questions available · Page 1 of 59
Updated Exam DumpsVerified AnswersPass Guarantee
HOTSPOT
You plan to implement an Azure function named Function1 that will use the timer trigger.
You plan to use a TimeSpan value to set the schedule of function execution.
You need to select the hosting model and the schedule expression assignment method.
Which hosting model and schedule expression assignment method should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You develop and deploy an Azure Logic app that calls an Azure Function app. The Azure Function app includes an OpenAPI (Swagger) definition and uses an Azure Blob storage account. All resources are secured by using Azure Active Directory (Azure AD).
The Azure Logic app must securely access the Azure Blob storage account. Azure AD resources must remain if the Azure Logic app is deleted.
You need to secure the Azure Logic app.
What should you do?
Correct answer: A
To give a managed identity access to an Azure resource, you need to add a role to the target resource for that identity.
Note: To easily authenticate access to other resources that are protected by Azure Active Directory (Azure AD) without having to sign in and provide credentials or secrets, your logic app can use a managed identity (formerly known as Managed Service Identity or MSI). Azure manages this identity for you and helps secure your credentials because you don't have to provide or rotate secrets.
If you set up your logic app to use the system-assigned identity or a manually created, user-assigned identity, the function in your logic app can also use that same identity for authentication.
References:
https://docs.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity
https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates-for-clients
Background
Overview
You are a developer for Contoso, Ltd. The company has a social networking website that is developed as a Single Page Application (SPA). The main web application for the social networking website loads user uploaded content from blob storage.
You are developing a solution to monitor uploaded data for inappropriate content. The following process occurs when users upload content by using the SPA:
1. Messages are sent to ContentUploadService.
2. Content is processed by ContentAnalysisService.
3. After processing is complete, the content is posted to the social network or a rejection message is posted in its place.
The ContentAnalysisService is deployed with Azure Container Instances from a private Azure Container Registry named contosoimages.
The solution will use eight CPU cores.
Azure Active Directory
Contoso, Ltd. uses Azure Active Directory (Azure AD) for both internal and guest accounts.
Requirements
ContentAnalysisService
The company's data science group built ContentAnalysisService which accepts user generated content as a string and returns a probable value for inappropriate content. Any values over a specific threshold must be reviewed by an employee of Contoso, Ltd.
You must create an Azure Function named CheckUserContent to perform the content checks.
Costs
You must minimize costs for all Azure services.
Manual review
To review content, the user must authenticate to the website portion of the ContentAnalysisService using their Azure AD credentials. The website is built using React and all pages and API endpoints require authentication. In order to review content a user must be part of a ContentReviewer role. All completed reviews must include the reviewer's email address for auditing purposes.
High availability
All services must run in multiple regions. The failure of any service in a region must not impact overall application availability.
Monitoring
An alert must be raised if the ContentUploadService uses more than 80 percent of available CPU cores.
Security
You have the following security requirements:
1. Any web service accessible over the Internet must be protected from cross site scripting attacks.
2. All websites and services must use SSL from a valid root certificate authority.
3. Azure Storage access keys must only be stored in memory and must be available only to the service.
4. All Internal services must only be accessible from internal Virtual Networks (VNets).
5. All parts of the system must support inbound and outbound traffic restrictions.
6. All service calls must be authenticated by using Azure AD.
User agreements
When a user submits content, they must agree to a user agreement. The agreement allows employees of Contoso, Ltd. to review content, store cookies on user devices, and track user's IP addresses.
Information regarding agreements is used by multiple divisions within Contoso, Ltd.
User responses must not be lost and must be available to all parties regardless of individual service uptime. The volume of agreements is expected to be in the millions per hour.
Validation testing
When a new version of the ContentAnalysisService is available the previous seven days of content must be processed with the new version to verify that the new version does not significantly deviate from the old version.
Issues
Users of the ContentUploadService report that they occasionally see HTTP 502 responses on specific pages.
Code
ContentUploadService
DRAG DROP
You need to add YAML markup at line CS17 to ensure that the ContentUploadService can access Azure Storage access keys.
How should you complete the YAML markup? To answer, drag the appropriate YAML segments to the correct locations. Each YAML segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Box 1: volumeMounts
Example:
volumeMounts:
- mountPath: /mnt/secrets
name: secretvolume1
volumes:
- name: secretvolume1
secret:
mysecret1: TXkgZmlyc3Qgc2VjcmV0IEZPTwo=
Box 2: volumes
Box 3: secret
References:
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-volume-secret
HOTSPOT
You develop a news and blog content app for Windows devices.
A notification must arrive on a user's device when there is a new article available for them to view.
You need to implement push notifications.
How should you complete the code segment? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Box 1: NotificationHubClient
Box 2: NotificationHubClient
Box 3: CreateClientFromConnectionString
// Initialize the Notification Hub
NotificationHubClient hub = NotificationHubClient.CreateClientFromConnectionString(listenConnString,
hubName);
Box 4: SendWindowsNativeNotificationAsync
Send the push notification.
var result = await hub.SendWindowsNativeNotificationAsync(windowsToastPayload);
References:
https://docs.microsoft.com/en-us/azure/notification-hubs/notification-hubs-push-notification-registration-management
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/app-service-mobile/app-service-mobile-windows-store-dotnet-get-started-push.md
Background
Current Environment
Fourth Coffee is a global coffeehouse chain and coffee company recognized as one of the world's most influential coffee brands. The company is renowned for its specialty coffee beverages, including a wide range of espresso-based dnnks, teas, and other beverages.
Fourth Coffee operates thousands of stores worldwide.
The company is developing cloud-native applications hosted in Azure.
Corporate website
The company hosts a public website located at http://www.fourthcoffee.com/. The website is used to place orders as well as view and update inventory items.
Inventory items
In addition to its core coffee offerings, Fourth Coffee recently expanded its menu to include inventory items such as lunch items, snacks, and merchandise. Corporate team members constantly update inventory.
Users can customize items. Corporate team members configure inventory items and associated images on the website.
Orders
Associates in the store serve customized beverages and items to customers. Orders are placed on the website for pickup.
The application components process data as follows:
1. Azure Traffic Manager routes a user order request to the corporate website hosted in Azure App
Service.
2. Azure Content Delivery Network serves static images and content to the user.
3. The user signs in to the application through a Microsoft Entra ID for customers tenant.
4. Users search for items and place an order on the website as item images are pulled from Azure Blob
Storage
5. Item customizations are placed in an Azure Service Bus queue message.
6. Azure Functions processes item customizations and saves the customized items to Azure Cosmos DB.
7. The website saves order details to Azure SQL Database.
8. SQL Database query results are cached in Azure Cache for Redis to improve performance.
The application consists of the following Azure services:
Requirements
The application components must meet the following requirements:
1. Azure Cosmos DB development must use a native API that receives the latest updates and stores data in a document format.
2. Costs must be minimized for all Azure services.
3. Developers must test Azure Blob Storage integrations locally before deployment to Azure Testing must support the latest versions of the Azure Storage APIs.
Corporate website
1. User authentication and authorization must allow one-time passcode sign-in methods and social identity providers (Google or Facebook).
2. Static web content must be stored closest to end users to reduce network latency.
Inventory items
1. Customized items read from Azure Cosmos DB must maximize throughput while ensuring data is
accurate for the current user on the website.
2. Processing of inventory item updates must automatically scale and enable updates across an entire
Azure Cosmos DB container.
3. Inventory items must be processed in the order they were placed in the queue.
4. Inventory item images must be stored as JPEG files in their native format to include exchangeable image file format (data) stored with the blob data upon upload of the image file.
5. The Inventory Items API must securely access the Azure Cosmos DB data.
Orders
Orders must receive inventory item changes automatically after inventory items are updated or saved.
Issues
1. Developers are storing the Azure Cosmos DB credentials in an insecure clear text manner within the Inventory Items API code.
2. Production Azure Cache for Redis maintenance has negatively affected application performance.
HOTSPOT
You need to save customized items to Azure Cosmos DB.
Which Azure Cosmos DB configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Requirements. Data
You identify the following requirements for data management and manipulation:
1. Order data is stored as nonrelational JSON and must be queried using SQL.
2. Changes to the Order data must reflect immediately across all partitions. All reads to the Order data must fetch the most recent writes.
Requirements. Security
You have the following security requirements:
1. Users of Coho Winery applications must be able to provide access to documents, resources, and applications to external partners.
2. External partners must use their own credentials and authenticate with their organization's identity management solution.
3. External partner logins must be audited monthly for application use by a user account administrator to maintain company compliance.
4. Storage of e-commerce application settings must be maintained in Azure Key Vault.
5. E-commerce application sign-ins must be secured by using Azure App Service authentication and Azure Active Directory (AAD).
6. Conditional access policies must be applied at the application level to protect company content.
7. The LabelMaker application must be secured by using an AAD account that has full access to all
namespaces of the Azure Kubernetes Service (AKS) cluster.
Requirements. LabelMaker app
Azure Monitor Container Health must be used to monitor the performance of workloads that are deployed to Kubernetes environments and hosted on Azure Kubernetes Service (AKS).
You must use Azure Container Registry to publish images that support the AKS deployment.
Architecture
Issues
Calls to the Printer API App fail periodically due to printer communication timeouts.
Printer communication timeouts occur after 10 seconds. The label printer must only receive up to 5
attempts within one minute.
The order workflow fails to run upon initial deployment to Azure.
Order.json
Relevant portions of the app files are shown below. Line numbers are included for reference only.
This JSON file contains a representation of the data for an order that includes a single item.
DRAG DROP
You need to deploy a new version of the LabelMaker application to ACR.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Step 1: Build a new application image by using dockerfile
Step 2: Create an alias if the image with the fully qualified path to the registry Before you can push the image to a private registry, you've to ensure a proper image name. This can be achieved using the docker tag command. For demonstration purpose, we'll use Docker's hello world image, rename it and push it to ACR.
# pulls hello-world from the public docker hub
$ docker pull hello-world
# tag the image in order to be able to push it to a private registry
$ docker tag hello-word <REGISTRY_NAME>/hello-world
# push the image
$ docker push <REGISTRY_NAME>/hello-world
Step 3: Log in to the registry and push image
In order to push images to the newly created ACR instance, you need to login to ACR form the Docker CLI.
Once logged in, you can push any existing docker image to your ACR instance.
Scenario:
Coho Winery plans to move the application to Azure and continue to support label creation.
LabelMaker app
Azure Monitor Container Health must be used to monitor the performance of workloads that are deployed to Kubernetes environments and hosted on Azure Kubernetes Service (AKS).
You must use Azure Container Registry to publish images that support the AKS deployment.
References:
https://thorsten-hans.com/how-to-use-a-private-azure-container-registry-with-kubernetes-9b86e67b93b6
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-quick-task
Background
City Power & Light company provides electrical infrastructure monitoring solutions for homes and businesses. The company is migrating solutions to Azure.
Current environment
Architecture overview
The company has a public website located at http://www.cpandl.com/. The site is a single-page web application that runs in Azure App Service on Linux. The website uses files stored in Azure Storage and cached in Azure Content Delivery Network (CDN) to serve static content.
API Management and Azure Function App functions are used to process and store data in Azure Database for PostgreSQL. API Management is used to broker communications to the Azure Function app functions for Logic app integration. Logic apps are used to orchestrate the data processing while Service Bus and
Event Grid handle messaging and events.
The solution uses Application Insights, Azure Monitor, and Azure Key Vault.
Architecture diagram
The company has several applications and services that support their business. The company plans to implement serverless computing where possible. The overall architecture is shown below.
User authentication
The following steps detail the user authentication process:
1. The user selects Sign in in the website.
2. The browser redirects the user to the Azure Active Directory (Azure AD) sign in page.
3. The user signs in.
4. Azure AD redirects the user's session back to the web application. The URL includes an access token.
5. The web application calls an API and includes the access token in the authentication header. The application ID is sent as the audience ('aud') claim in the access token.
6. The back-end API validates the access token.
Requirements
Corporate website
1. Communications and content must be secured by using SSL.
2. Communications must use HTTPS.
3. Data must be replicated to a secondary region and three availability zones.
4. Data storage costs must be minimized.
Azure Database for PostgreSQL
The database connection string is stored in Azure Key Vault with the following attributes:
1. Azure Key Vault name: cpandlkeyvault
2. Secret name: PostgreSQLConn
3. Id: 80df3e46ffcd4f1cb187f79905e9a1e8
The connection information is updated frequently. The application must always use the latest information to connect to the database.
Azure Service Bus and Azure Event Grid
1. Azure Event Grid must use Azure Service Bus for queue-based load leveling.
2. Events in Azure Event Grid must be routed directly to Service Bus queues for use in buffering.
3. Events from Azure Service Bus and other Azure services must continue to be routed to Azure Event
Grid for processing.
Security
1. All SSL certificates and credentials must be stored in Azure Key Vault.
2. File access must restrict access by IP, protocol, and Azure AD rights.
3. All user accounts and processes must receive only those privileges which are essential to perform their intended function.
Compliance
Auditing of the file updates and transfers must be enabled to comply with General Data Protection Regulation (GDPR). The file updates must be read-only, stored in the order in which they occurred, include only create, update, delete, and copy operations, and be retained for compliance reasons.
Issues
Corporate website
While testing the site, the following error message displays: CryptographicException: The system cannot find the file specified.
Function app
You perform local testing for the RequestUserApproval function. The following error message displays: 'Timeout value of 00:10:00 exceeded by function: RequestUserApproval'
The same error message displays when you test the function in an Azure development environment when you run the following Kusto query: FunctionAppLogs
| where FunctionName = = "RequestUserApproval"
Logic app
You test the Logic app in a development environment. The following error message displays:
'400 Bad Request'
Troubleshooting of the error shows an HttpTrigger action to call the RequestUserApproval function.
Code
Corporate website
Security.cs:
Function app
RequestUserApproval.cs:
You need to ensure that all messages from Azure Event Grid are processed.
What should you use?
Correct answer: B
As a solution architect/developer, you should consider using Service Bus queues when: Your solution needs to receive messages without having to poll the queue. With Service Bus, you can achieve it by using a long-polling receive operation using the TCP-based protocols that Service Bus supports.
References:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-azure-andservice-bus-queues-compared-contrasted
You deploy an API to API Management
You must secure all operations on the API by using a client certificate.
You need to secure access to the backend service of the API by using client certificates.
Which two security features can you use?
Correct answers: B, C
A company uses an Azure Blob Storage for archiving.
The company requires that data in the Blob Storage is only in the archive tier.
You need to ensure data copied to the Blob Storage is moved to the archive tier.
What should you do?
Correct answer: B
HOTSPOT
You develop and deploy the following staticwebapp.config.json file to the app_location value specified in the workflow file of an Azure Static Web app:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Box 1: No
Unauthenticated users are challenged to authenticate with Azure Active Directory.
Note:
401
Unauthorized
Request to restricted pages while unauthenticated.
Note: Restricting access to entire application
It's common to require authentication for every route in an application. To enable this, add a rule that matches all routes and include the built-in authenticated role in the allowedRoles array.
The following example configuration blocks anonymous access and redirects all unauthenticated users to the Azure Active Directory login page.
{
"routes": [
{
"route": "/*",
"allowedRoles": ["authenticated"]
}
],
"responseOverrides": {
"401": {
"statusCode": 302,
"redirect": "/.auth/login/aad"
}
}
}
Box 2: No
It depends on the file extension of the file. 404 response codes is only generated for png, jpg and gif files.
Note: Fallback routes
Single Page Applications often rely on client-side routing. These client-side routing rules update the browser's window location without making requests back to the server. If you refresh the page, or navigate directly to URLs generated by client-side routing rules, a server-side fallback route is required to serve the appropriate HTML page (which is generally the index.html for your client-side app).
You can define a fallback rule by adding a navigationFallback section. The following example returns / index.html for all static file requests that do not match a deployed file.
{
"navigationFallback": {
"rewrite": "/index.html"
}
}
You can control which requests return the fallback file by defining a filter. In the following example, requests for certain routes in the /images folder and all files in the /css folder are excluded from returning the fallback file.
{
"navigationFallback": {
"rewrite": "/index.html",
"exclude": ["/images/*.{png,jpg,gif}", "/css/*"]
}
}
The example file structure below, the following outcomes are possible with this rule.
Requests to...
/images/unknown.png
Return File not found error
With status: 404
/images/icon.svg
Returns the /index.html file - since the svg file extension is not listed in the /images/*.{png,jpg,gif} filter
With status: 200
Box 3: Yes
Only the route and methods (if specified) properties are used to determine whether a rule matches a request.
Routes are secured by adding one or more role names into a rule's allowedRoles array.
For instance, to restrict a route to only authenticated users, add the built-in authenticated role to the allowedRoles array.
{
"route": "/profile*",
"allowedRoles": ["authenticated"]
}
Box 4: No
Unauthenticated users are challanged to authenticate with Azure Active Directory.
See box 1 above.
References:
https://learn.microsoft.com/en-us/azure/static-web-apps/configuration