Risk Assessment & Management Flashcards
7 cards from real AZ-204 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Management flashcards as text
Your application must stay available during an Azure regional outage. Which combination of services provides active-active geographic redundancy for an API backed by Azure SQL?
Answer: Azure Traffic Manager + Azure SQL active geo-replication
Traffic Manager routes DNS traffic to the healthy region while Azure SQL active geo-replication keeps a writable secondary ready for failover, enabling active-active resilience.
A developer wants to reduce the blast radius if an Azure Function's storage account key is compromised. Which practice achieves this?
Answer: Use SAS tokens with narrow permissions and short expiry instead of account keys
SAS tokens scoped to specific operations and containers with short expiry windows drastically limit what an attacker can do if a token is leaked.
When implementing circuit breaker logic for calls to an external payment API from Azure Functions, what state transition correctly describes the circuit breaker pattern?
Answer: Closed → Open → Half-Open → Closed
The circuit breaker starts Closed (requests flow), trips to Open (requests blocked) on failures, then moves to Half-Open (probe requests) to test recovery before returning to Closed.
You need to assess the risk of Azure AD token theft in a Single Page Application. Which OAuth 2.0 flow and storage strategy reduces this risk most effectively?
Answer: Authorization Code flow with PKCE and session cookies via BFF pattern
The Authorization Code flow with PKCE eliminates the need to expose tokens to JavaScript, and the Backend-for-Frontend pattern stores tokens server-side, mitigating XSS-based token theft.
An AZ-204 exam scenario asks: your app writes to Azure Queue Storage and you want to detect messages that fail processing repeatedly. Which built-in mechanism enables this?
Answer: The dequeue count property increases each time; move to a poison queue after a threshold
Azure Queue Storage exposes a DequeueCount property per message; application code should move messages exceeding a threshold count to a separate poison-message queue for investigation.
Which Azure role assignment correctly follows the principle of least privilege for an application that only needs to read secrets from a Key Vault?
Answer: Key Vault Secrets User on the Key Vault
Key Vault Secrets User grants only get and list permissions on secrets, which is the minimum required for an application to read secrets without any management rights.
Your Azure App Service deployment uses deployment slots. Which risk does a swap operation mitigate compared to deploying directly to production?
Answer: Provides a zero-downtime rollback path by swapping slots back
If a production issue is detected after a slot swap, developers can immediately swap back to restore the previous version without a full redeployment, minimizing downtime risk.