AZ-204 Case Studies & Practical Application 2 — Questions and Answers
Question 1: A startup's Azure Function processes uploaded images by resizing them and storing results in Blob Storage. During peak hours, the function times out after 5 minutes before completing. What is the BEST solution?
- Switch to Durable Functions with a fan-out/fan-in pattern to parallelize image processing (Correct answer)
- Increase the function timeout to 10 minutes in host.json
- Move the function to a Premium plan to get more CPU
- Use Azure Logic Apps instead of Azure Functions
Correct answer: Switch to Durable Functions with a fan-out/fan-in pattern to parallelize image processing
Durable Functions with fan-out/fan-in allows parallel processing of multiple images, reducing total execution time rather than just extending the timeout.
Question 2: A company stores customer records in Azure Cosmos DB with a partition key of /country. Analytics queries frequently filter by /productCategory across all countries. Performance is poor. What should the developer recommend?
- Create a new container with /productCategory as the partition key for analytics (Correct answer)
- Add a composite index on country and productCategory
- Enable automatic indexing on the productCategory field
- Increase the RU/s provisioned on the existing container
Correct answer: Create a new container with /productCategory as the partition key for analytics
Cross-partition queries are expensive; creating a dedicated container with /productCategory as the partition key allows efficient fan-in queries for analytics workloads.
Question 3: A developer needs to deploy a containerized web app that automatically scales to zero when idle to minimize costs, but must start within 30 seconds on first request. Which Azure service fits best?
- Azure Container Apps with scale-to-zero enabled (Correct answer)
- Azure Kubernetes Service with KEDA
- Azure App Service on Free tier
- Azure Container Instances with always-on restart policy
Correct answer: Azure Container Apps with scale-to-zero enabled
Azure Container Apps supports scale-to-zero natively and is designed for containerized microservices with fast cold starts, unlike ACI which lacks automatic HTTP-triggered scaling.
Question 4: An e-commerce app uses Azure Service Bus to process orders. Occasionally, a malformed order message causes the consumer to throw an exception repeatedly. After how many delivery attempts does Service Bus move the message to the Dead Letter Queue by default?
- 10 (Correct answer)
- 5
- 3
- 20
Correct answer: 10
Azure Service Bus moves a message to the Dead Letter Queue after 10 failed delivery attempts by default (MaxDeliveryCount = 10).
Question 5: A developer must cache API responses in Azure API Management for GET requests but only when the response status is 200. Which APIM policy should be used?
- cache-store with a condition checking context.Response.StatusCode (Correct answer)
- cache-lookup with a vary-by-header policy
- set-header to add Cache-Control: max-age
- rate-limit-by-key to throttle non-200 responses
Correct answer: cache-store with a condition checking context.Response.StatusCode
The cache-store policy supports a condition attribute, allowing you to cache only successful 200 responses by checking context.Response.StatusCode.
Question 6: A microservice on Azure App Service needs to read a secret from Azure Key Vault without storing credentials in code or config files. What is the correct approach?
- Enable a system-assigned managed identity on the App Service and grant it Key Vault Secrets User role (Correct answer)
- Store the Key Vault access key in an App Service application setting
- Use a service principal with a certificate stored in the app's wwwroot folder
- Enable VNet integration so the app can access Key Vault privately
Correct answer: Enable a system-assigned managed identity on the App Service and grant it Key Vault Secrets User role
A system-assigned managed identity eliminates credential management; granting it the Key Vault Secrets User role is the recommended zero-secret pattern.
Question 7: A developer has a Blob Storage container with public access disabled. Users must download files for exactly 1 hour without requiring an Azure account. What should the developer generate?
- A Shared Access Signature (SAS) token with 1-hour expiry on the specific blob (Correct answer)
- A temporary storage account access key rotated every hour
- A public URL by temporarily enabling anonymous read on the container
- An Azure AD B2C token with 1-hour lifetime
Correct answer: A Shared Access Signature (SAS) token with 1-hour expiry on the specific blob
A SAS token grants time-limited, scoped access to a blob without exposing the storage account key or requiring user authentication.
AZ-204 Case Studies & Practical Application 2
A startup's Azure Function processes uploaded images by resizing them and storing results in Blob Storage.
During peak hours, the function times out after 5 minutes before completing.
What is the BEST solution?