AZ-204 Professional Standards & Competencies 5 — Questions and Answers
Question 1: A developer must protect an Azure Web API using OAuth 2.0. Which Azure service should they integrate to validate bearer tokens on incoming requests?
- Azure Blob Storage shared access signatures
- Azure Active Directory with JWT bearer token validation middleware (Correct answer)
- Azure Table Storage entity queries
- Azure DNS zone delegation
Correct answer: Azure Active Directory with JWT bearer token validation middleware
Integrating Azure AD JWT bearer token validation middleware ensures only requests with valid tokens issued by the configured authority are accepted.
Question 2: When writing unit tests for Azure Functions, which professional practice isolates the function logic from Azure SDK dependencies?
- Deploying to Azure and running integration tests only
- Mocking Azure service clients and injecting them via dependency injection (Correct answer)
- Disabling all outbound calls during test execution
- Testing only through the Azure Portal Test console
Correct answer: Mocking Azure service clients and injecting them via dependency injection
Mocking Azure SDK clients and injecting them via DI allows unit tests to run without real Azure resources, improving speed and reliability.
Question 3: An Azure developer is implementing feature flags for a progressive rollout. Which Azure service provides dynamic feature flag management without redeployment?
- Azure Key Vault with versioned secrets
- Azure App Configuration with feature management (Correct answer)
- Azure DevOps pipeline variables
- Azure Storage Table with a flags column
Correct answer: Azure App Configuration with feature management
Azure App Configuration's feature management capability allows feature flags to be toggled at runtime without requiring a new deployment.
Question 4: A developer needs to comply with SOC 2 controls by ensuring all data at rest in Azure Storage is encrypted. What is the correct professional action?
- Manually encrypt files before uploading using a custom algorithm
- Verify that Azure Storage Service Encryption is enabled, which is on by default (Correct answer)
- Use a third-party encryption tool after writing to storage
- Store data in an unencrypted format and hash the filenames
Correct answer: Verify that Azure Storage Service Encryption is enabled, which is on by default
Azure Storage Service Encryption encrypts all data at rest by default using AES-256, satisfying compliance requirements without additional configuration.
Question 5: A developer is following secure coding practices for an Azure-deployed web application. Which OWASP mitigation prevents SQL injection in Cosmos DB queries?
- Concatenating user input directly into the query string
- Using parameterized queries with SqlQuerySpec in the Cosmos DB SDK (Correct answer)
- Encoding query results as Base64 before returning them
- Restricting HTTP verbs to GET-only for all endpoints
Correct answer: Using parameterized queries with SqlQuerySpec in the Cosmos DB SDK
Using SqlQuerySpec with named parameters prevents injection by separating query logic from user-supplied values in Cosmos DB SQL API queries.
Question 6: An Azure developer wants to adopt shift-left security by scanning for secrets in source code. Which tool integrates natively with Azure DevOps for this purpose?
- Azure Advisor recommendations
- Microsoft Security DevOps extension with secret scanning in pipelines (Correct answer)
- Azure Cost Management budget alerts
- Azure Monitor alert rules on repository size
Correct answer: Microsoft Security DevOps extension with secret scanning in pipelines
The Microsoft Security DevOps extension integrates secret scanning and static analysis tools directly into Azure DevOps pipelines during the build phase.
Question 7: A developer must implement structured logging in an Azure Function to enable efficient log querying in Application Insights. Which approach is correct?
- Use Console.WriteLine with unformatted plain text messages
- Use ILogger with message templates and structured property placeholders (Correct answer)
- Write logs to a local text file on the function host
- Send logs via HTTP POST to a custom webhook
Correct answer: Use ILogger with message templates and structured property placeholders
ILogger with message templates emits structured telemetry with named properties, enabling powerful filtering and analytics in Application Insights.
AZ-204 Professional Standards & Competencies 5
A developer must protect an Azure Web API using OAuth 2.0.
Which Azure service should they integrate to validate bearer tokens on incoming requests?