AZ-204 Professional Standards & Competencies 2 — Questions and Answers
Question 1: An Azure developer must ensure their web app meets the AZ-204 requirement for secure secret management. Which approach is the recommended best practice?
- Store secrets in appsettings.json committed to source control
- Use Azure Key Vault references in App Service configuration (Correct answer)
- Hard-code secrets in environment variables inside Dockerfile
- Pass secrets as query string parameters to API calls
Correct answer: Use Azure Key Vault references in App Service configuration
Azure Key Vault references allow App Service to fetch secrets at runtime without exposing them in code or config files.
Question 2: A developer is implementing a CI/CD pipeline for an Azure Function app. Which professional standard ensures infrastructure changes are auditable and repeatable?
- Manual deployment via Azure Portal only
- Infrastructure as Code using Bicep or ARM templates (Correct answer)
- SSH into the server and copy files manually
- Use FTP to upload function code directly
Correct answer: Infrastructure as Code using Bicep or ARM templates
Infrastructure as Code tools like Bicep or ARM templates version-control infrastructure definitions, making deployments auditable and repeatable.
Question 3: When publishing an Azure SDK-based application, a developer wants to follow the principle of least privilege. What should they assign to the app's managed identity?
- Owner role on the subscription
- Contributor role on the resource group
- Only the specific RBAC roles needed for required operations (Correct answer)
- Global Administrator role in Azure AD
Correct answer: Only the specific RBAC roles needed for required operations
Least privilege means granting only the permissions required for the application to function, minimizing the blast radius of a compromise.
Question 4: A team is adopting blue-green deployments for their Azure App Service. What is the primary professional competency this addresses?
- Cost optimization by shutting down unused slots
- Zero-downtime releases and safe rollback capability (Correct answer)
- Automatic scaling based on CPU metrics
- Reduced storage costs through slot sharing
Correct answer: Zero-downtime releases and safe rollback capability
Blue-green deployments use staging slots to enable traffic swapping, allowing zero-downtime releases with instant rollback if issues arise.
Question 5: An AZ-204 candidate is reviewing logging standards for a distributed Azure application. Which service provides centralized correlation of logs across multiple services?
- Azure Blob Storage with custom log files
- Azure Application Insights with distributed tracing (Correct answer)
- Windows Event Viewer on each VM
- Azure SQL Database log tables
Correct answer: Azure Application Insights with distributed tracing
Application Insights supports distributed tracing with operation IDs that correlate telemetry across microservices and components.
Question 6: A developer needs to ensure their Azure-hosted API complies with GDPR. Which Azure feature helps enforce data residency requirements?
- Azure Traffic Manager with performance routing
- Azure Policy with allowed locations definitions (Correct answer)
- Azure CDN geo-filtering rules
- Azure DDoS Protection Standard
Correct answer: Azure Policy with allowed locations definitions
Azure Policy can enforce that resources are only deployed to approved geographic regions, supporting data residency and compliance requirements.
Question 7: When handling exceptions in an Azure Service Bus consumer, what professional practice prevents message loss while allowing problematic messages to be investigated?
- Swallow all exceptions silently and continue processing
- Delete the message immediately on any exception
- Allow the message to exceed max delivery count so it moves to the dead-letter queue (Correct answer)
- Disable the consumer and restart manually
Correct answer: Allow the message to exceed max delivery count so it moves to the dead-letter queue
Letting a message exceed its max delivery count moves it to the dead-letter queue, preserving it for investigation without blocking other messages.
AZ-204 Professional Standards & Competencies 2
An Azure developer must ensure their web app meets the AZ-204 requirement for secure secret management.
Which approach is the recommended best practice?