AZ-204: Developing Solutions for Microsoft Azure — Questions and Answers

Question 1: What is the significance of a code of conduct for AZ-204 professionals?

It limits professional freedom
It is merely symbolic
It applies only to new practitioners
It establishes expected behaviors and ethical standards that protect the public and profession (Correct answer)

Correct answer: It establishes expected behaviors and ethical standards that protect the public and profession

This is fundamental to AZ-204 - Microsoft Azure Developer Associate practice. It establishes expected behaviors and ethical standards that protect the public and profession represents the professional standard for professional standards in the AZ-204 certification framework.

Question 2: Which Azure Storage feature allows you to grant time-limited, scoped access to a blob without exposing the account key?

Shared Access Signature (SAS) (Correct answer)
Azure RBAC role assignment
Access key rotation
Firewall rules

Correct answer: Shared Access Signature (SAS)

A Shared Access Signature (SAS) generates a URI with embedded credentials and permissions valid for a specific duration without exposing the account key.

Question 3: What Azure AD object represents an application's identity and is used to authenticate against Azure AD to obtain tokens?

Managed identity
Enterprise application
Service principal (Correct answer)
User principal

Correct answer: Service principal

A service principal is the local representation of an Azure AD application registration within a tenant, used for authentication and authorization.

Question 4: How should an AZ-204 professional respond to a compliance violation?

Report it promptly, investigate the root cause, and implement corrective actions (Correct answer)
Wait for an external audit to find it
Blame the regulatory framework
Conceal it if minor

Correct answer: Report it promptly, investigate the root cause, and implement corrective actions

This is fundamental to AZ-204 - Microsoft Azure Developer Associate practice. Report it promptly, investigate the root cause, and implement corrective actions represents the professional standard for regulatory in the AZ-204 certification framework.

Question 5: Which Microsoft Authentication Library (MSAL) method acquires a token silently from cache before making a network request?

AcquireTokenByUsernamePassword
AcquireTokenInteractive
AcquireTokenForClient
AcquireTokenSilent (Correct answer)

Correct answer: AcquireTokenSilent

AcquireTokenSilent attempts to retrieve a valid token from the MSAL token cache without user interaction or a new network call.

Question 6: A Logic App workflow must trigger whenever a new blob is added to an Azure Storage container. Which trigger type should the developer use?

Recurrence - Schedule
HTTP Request - When an HTTP request is received
Azure Blob Storage - When a blob is added or modified (V2) (Correct answer)
Event Grid - When a resource event occurs

Correct answer: Azure Blob Storage - When a blob is added or modified (V2)

The Azure Blob Storage connector's polling trigger fires when new or modified blobs are detected in the specified container.

Question 7: Your Azure app stores EU citizen health data. Which Azure service helps you demonstrate GDPR Article 30 record-of-processing compliance?

Microsoft Defender for Cloud
Microsoft Purview Data Map (Correct answer)
Azure Monitor Logs
Azure Policy compliance reports

Correct answer: Microsoft Purview Data Map

Microsoft Purview Data Map catalogs and classifies data assets, supporting GDPR Article 30 records-of-processing requirements.

Question 8: You are building a multi-tenant SaaS application on Azure. Each tenant's data must be completely isolated at the database level. Which Azure Cosmos DB feature best supports this?

Use a single container with row-level security policies
Use multiple databases within one Cosmos DB account, one per tenant (Correct answer)
Use a single container with a partition key set to TenantId
Create a separate Cosmos DB account per tenant

Correct answer: Use multiple databases within one Cosmos DB account, one per tenant

Multiple databases within one Cosmos DB account provide logical isolation per tenant while sharing the account's infrastructure, balancing isolation with cost efficiency.

Question 9: Which Azure service enables you to centrally manage, rotate, and audit access to secrets across multiple applications and environments?

Azure Defender for Cloud
Azure Policy
Azure App Configuration
Azure Key Vault (Correct answer)

Correct answer: Azure Key Vault

Azure Key Vault provides centralized secret management with access logging, automated rotation, and RBAC-based access control.

Question 10: What Azure SQL Database feature automatically tunes query performance by applying and reverting index recommendations?

Automatic Tuning (Correct answer)
Query Store
Intelligent Query Processing
Database Advisor

Correct answer: Automatic Tuning

Azure SQL Database Automatic Tuning monitors query performance and automatically creates, validates, and drops indexes to improve performance.

Question 11: You are in charge of creating a website. The website will be hosted in Azure. After the website is launched, you anticipate a huge number of traffic. You must keep the website accessible and responsive while keeping costs low. You must launch the webpage. So, what are your options?

Use the Standard service tier to deploy the website to an App Service. When the CPU demand is high, configure the App Service strategy to automatically scale. (Correct answer)
Set up a virtual computer to host the website. When the CPU load is high, use a Scale Set to increase the virtual machine instance count.
Use the Shared service layer to deploy the website to an App Service. When the CPU demand is high, configure the App Service strategy to automatically scale.
Set up a virtual computer to host the website. When the CPU demand is high, configure the virtual machine to automatically scale.

Correct answer: Use the Standard service tier to deploy the website to an App Service. When the CPU demand is high, configure the App Service strategy to automatically scale.

Explanation: WAWS (Windows Azure Web Sites) comes in three flavors: Standard, Free, and Shared. Even for sites with only one instance, Standard mode has an enterprise-grade SLA (Service Level Agreement) of 99.9% monthly. Standard mode differs from the other ways to purchase Windows Azure Web Sites in that it runs on dedicated instances.

Question 12: What is the partition key in Azure Cosmos DB primarily used for?

Setting TTL on documents
Sorting documents alphabetically
Distributing data across physical partitions for scalability (Correct answer)
Encrypting stored data

Correct answer: Distributing data across physical partitions for scalability

The partition key determines how Cosmos DB distributes data and requests across physical partitions to achieve horizontal scalability.

Question 13: A developer wants to reduce the blast radius if an Azure Function's storage account key is compromised. Which practice achieves this?

Rotate the account key every 180 days manually
Enable soft-delete on the storage account
Store the account key in an environment variable with a prefix of SECRET_
Use SAS tokens with narrow permissions and short expiry instead of account keys (Correct answer)

Correct answer: Use SAS tokens with narrow permissions and short expiry instead of account keys

SAS tokens scoped to specific operations and containers with short expiry windows drastically limit what an attacker can do if a token is leaked.

Question 14: What Azure Key Vault feature enables automatic renewal of TLS certificates from supported certificate authorities?

Certificate import
Secret versioning
Key rotation policy
Certificate auto-renewal (lifecycle action) (Correct answer)

Correct answer: Certificate auto-renewal (lifecycle action)

Key Vault certificates support lifecycle auto-renewal actions that automatically request a new certificate from DigiCert or GlobalSign before expiry.

Question 15: Your organization must comply with FedRAMP Moderate. Which Azure environment is pre-authorized for FedRAMP Moderate workloads?

Azure Government cloud (Correct answer)
Azure China 21Vianet
Azure Commercial East US region
Azure Stack Hub on-premises

Correct answer: Azure Government cloud

Azure Government is specifically designed and pre-authorized for U.S. government workloads requiring FedRAMP compliance.

Question 16: Which Azure messaging service supports the AMQP protocol and provides enterprise-grade guaranteed message delivery with queues and topics?

Azure Event Grid
Azure Queue Storage
Azure Event Hubs
Azure Service Bus (Correct answer)

Correct answer: Azure Service Bus

Azure Service Bus supports AMQP 1.0 and provides enterprise messaging with queues and topics/subscriptions for guaranteed, ordered delivery.

Question 17: A developer needs to call an external payment API from Azure Functions with retry logic. The external API returns 429 (Too Many Requests) with a Retry-After header. What is the correct retry behavior?

Forward the 429 to the caller and let the client handle retries
Parse the Retry-After header value and delay the next attempt by exactly that duration (Correct answer)
Immediately retry up to 3 times then throw an exception
Apply exponential backoff starting at 1 second regardless of the header

Correct answer: Parse the Retry-After header value and delay the next attempt by exactly that duration

Respecting the Retry-After header is required by HTTP standards and prevents further rate-limiting; ignoring it and retrying sooner will cause continued 429 responses.

Question 18: Which Azure Cosmos DB API is the best choice for migrating an existing MongoDB application with minimal code changes?

API for MongoDB (Correct answer)
SQL (Core) API
Cassandra API
Gremlin API

Correct answer: API for MongoDB

The Azure Cosmos DB for MongoDB API offers wire-protocol compatibility with MongoDB drivers, so existing applications work with minimal modification.

Question 19: What is the primary competency framework for AZ-204 - Microsoft Azure Developer Associate professionals?

Employer-specific requirements only
Structured competency standards defined by the certifying body (Correct answer)
Ad-hoc skill development
Self-assessed capabilities only

Correct answer: Structured competency standards defined by the certifying body

This is fundamental to AZ-204 - Microsoft Azure Developer Associate practice. Structured competency standards defined by the certifying body represents the professional standard for professional standards in the AZ-204 certification framework.

Question 20: You create an application that lets users upload photographs and movies to Azure storage. The media is uploaded to a blob storage account named Account1 via a storage REST API call. Container1 and Container2 are two blob storage containers that you have. Video uploading is done on a sporadic basis. When a new movie is uploaded, you must copy specified blobs from Container1 to Container2. What are your options?

The blob should be downloaded to a virtual computer and then uploaded to Container2.
Using the Blob Service REST API's Put Blob operation, copy blobs to Container2.
Use the Start-AzureStorageBlobCopy cmdlet to create an Event Grid topic. (Correct answer)
To copy blobs to Container2, use AzCopy with the Snapshot switch.

Correct answer: Use the Start-AzureStorageBlobCopy cmdlet to create an Event Grid topic.

Explanation: The Start-AzureStorageBlobCopy cmdlet starts to copy a blob. Example 1: Copy a named blob C:PS>Start-AzureStorageBlobCopy -SrcBlob "ContosoPlanning2015" -DestContainer "ContosoArchives" -SrcContainer "ContosoUploads" This command starts the copy operation of the blob named ContosoPlanning2015 from the container named ContosoUploads to the container named ContosoArchives

Question 21: Which role in Azure RBAC provides read-only access to Azure Key Vault secrets?

Key Vault Secrets Officer
Key Vault Secrets User (Correct answer)
Key Vault Reader
Key Vault Contributor

Correct answer: Key Vault Secrets User

The Key Vault Secrets User role grants read access (get, list) to secrets in Azure Key Vault using Azure RBAC permission model.

Question 22: A developer enables duplicate detection on a Service Bus queue with a window of 10 minutes. A message with the same MessageId is sent twice within that window. What happens?

The second message replaces the first in the queue
Both messages are delivered and the consumer must deduplicate
The second message is silently discarded by the broker (Correct answer)
The queue enters a dead-letter state

Correct answer: The second message is silently discarded by the broker

When duplicate detection is enabled, Service Bus tracks MessageIds in a time window and silently drops any message with a duplicate ID received during that window.

Question 23: What connection string format is required to connect to Azure Cosmos DB using the SQL (Core) API from a .NET application?

Server=accountName.documents.azure.com;Database=dbName;
AccountEndpoint=https://accountName.documents.azure.com:443/;AccountKey=key; (Correct answer)
Data Source=accountName.documents.azure.com;Initial Catalog=dbName;
Host=accountName.documents.azure.com;Port=443;

Correct answer: AccountEndpoint=https://accountName.documents.azure.com:443/;AccountKey=key;

The Cosmos DB SDK for .NET requires an `AccountEndpoint` URI and `AccountKey` (or token) to initialize the CosmosClient.

Question 24: A critical Service Bus namespace must survive a regional outage. Which feature should be configured to replicate metadata to a secondary namespace and allow manual failover?

Geo-disaster recovery pairing (Correct answer)
Availability Zones with zone redundancy
Geo-replication (active replication)
Premium tier with auto-scaling

Correct answer: Geo-disaster recovery pairing

Service Bus Geo-disaster recovery pairs a primary and secondary namespace, replicating entity metadata so you can initiate a manual failover during a regional outage.

Question 25: What is the default maximum size for a single Azure Blob Storage block blob?

500 GB
5 TB
200 GB
4.75 TB (Correct answer)

Correct answer: 4.75 TB

A block blob can be up to 4.75 TB in size, composed of up to 50,000 blocks each up to 100 MB.

Question 26: In Azure Cosmos DB, what is the unit used to measure provisioned throughput?

Data Throughput Units (DTUs)
IO Operations per Second (IOPS)
Request Units (RUs) (Correct answer)
Compute Units (CUs)

Correct answer: Request Units (RUs)

Cosmos DB uses Request Units per second (RU/s) to represent the throughput provisioned for a database or container.

Question 27: What header must a client include when calling an Azure AD-protected API to prove it has a valid access token?

X-MS-Token: {token}
X-Auth-Token: Bearer {token}
Authorization: Bearer {token} (Correct answer)
Access-Token: {token}

Correct answer: Authorization: Bearer {token}

APIs protected by Azure AD expect the access token in the HTTP `Authorization` header using the `Bearer` scheme.

Question 28: An Azure Function triggered by an HTTP request must call an external API and return the result. The external API sometimes takes 5+ minutes to respond. What should you do?

Switch the trigger to a Timer trigger that runs every minute
Increase the function timeout in host.json to 10 minutes
Use a Service Bus queue to decouple the request and poll for completion
Implement the Durable Functions async HTTP API pattern with status polling (Correct answer)

Correct answer: Implement the Durable Functions async HTTP API pattern with status polling

The Durable Functions async HTTP API pattern lets the caller receive a 202 Accepted with a status URL to poll, avoiding HTTP timeout limits on long-running operations.

Question 29: An Event Grid subscription is failing to deliver events to an endpoint. What is the default maximum retry period before Event Grid stops attempting delivery?

24 hours (Correct answer)
6 hours
12 hours
48 hours

Correct answer: 24 hours

Event Grid retries event delivery for up to 24 hours using an exponential backoff policy before dropping or dead-lettering the event.

Question 30: Which Azure Container Registry SKU supports geo-replication?

Free
Basic
Standard
Premium (Correct answer)

Correct answer: Premium

Only the Premium SKU of Azure Container Registry supports geo-replication across multiple Azure regions.

AZ-204: Developing Solutions for Microsoft Azure

The AZ-204 exam validates skills in designing, building, testing, and maintaining cloud applications and services on Microsoft Azure. It covers compute solutions, Azure storage, security, monitoring, and connecting to Azure and third-party services.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds