AZ-204 Risk Assessment & Management 2 — Questions and Answers
Question 1: Your Azure Function processes financial transactions and you need to detect anomalous spending patterns in near real-time. Which Azure service best supports this risk detection scenario?
- Azure Stream Analytics with anomaly detection (Correct answer)
- Azure Batch
- Azure Logic Apps with HTTP triggers
- Azure Service Bus dead-letter queue
Correct answer: Azure Stream Analytics with anomaly detection
Azure Stream Analytics has built-in ML-based anomaly detection operators (AnomalyDetection_SpikeAndDip, AnomalyDetection_ChangePoint) ideal for real-time risk pattern analysis.
Question 2: When using Azure Key Vault references in App Service, what happens if the Key Vault secret is deleted or access is revoked?
- App Service silently uses a cached value for 24 hours
- App Service fails to start and returns a 500 error on all requests
- App Service logs a warning but continues with the last known value indefinitely
- App Service throws a startup exception and the app becomes unavailable (Correct answer)
Correct answer: App Service throws a startup exception and the app becomes unavailable
If Key Vault access fails during application startup or secret refresh, App Service throws an exception and the application becomes unavailable, surfacing the access risk immediately.
Question 3: You are implementing retry logic in an Azure SDK client for Cosmos DB. Which transient fault should NOT be retried automatically?
- 429 TooManyRequests
- 503 ServiceUnavailable
- 408 RequestTimeout
- 403 Forbidden (Correct answer)
Correct answer: 403 Forbidden
A 403 Forbidden indicates an authorization failure (wrong key or missing permission), which is a permanent error that retrying will not resolve.
Question 4: Your application uses Azure Service Bus. To mitigate the risk of poison messages causing infinite processing loops, which feature should you configure?
- Session-enabled queues
- Dead-letter queue with MaxDeliveryCount (Correct answer)
- Message deferral
- Duplicate detection window
Correct answer: Dead-letter queue with MaxDeliveryCount
Setting MaxDeliveryCount on a Service Bus queue causes messages that exceed the delivery limit to be moved to the dead-letter queue, preventing infinite retry loops.
Question 5: In Azure API Management, which policy can you use to protect a backend API from being overwhelmed by a sudden spike in requests (rate-based risk)?
- validate-jwt
- rate-limit-by-key (Correct answer)
- check-header
- rewrite-uri
Correct answer: rate-limit-by-key
The rate-limit-by-key policy in APIM throttles requests based on a configurable key (e.g., subscription, IP), protecting the backend from traffic spikes.
Question 6: A developer stores a connection string directly in Azure App Service application settings. What is the primary security risk and recommended mitigation?
- Connection strings in App Settings are unencrypted; use TLS instead
- Connection strings in App Settings are visible in deployment logs; use environment variables
- Connection strings in App Settings can be read by anyone with Contributor role; use Key Vault references (Correct answer)
- Connection strings in App Settings expire; use managed identity refresh tokens
Correct answer: Connection strings in App Settings can be read by anyone with Contributor role; use Key Vault references
Anyone with Contributor or Owner role on the App Service can view application settings; Key Vault references combined with managed identity remove the secret from plain-sight access.
Question 7: Which Azure Monitor feature allows you to define an alert that fires when the number of failed dependency calls from your application exceeds a threshold, enabling proactive risk response?
- Activity Log Alert
- Metric Alert on dependencies/failed (Correct answer)
- Service Health Alert
- Diagnostic Setting export
Correct answer: Metric Alert on dependencies/failed
Application Insights emits the dependencies/failed metric, and a Metric Alert on that signal triggers when failed dependency call counts breach the configured threshold.
AZ-204 Risk Assessment & Management 2
Your Azure Function processes financial transactions and you need to detect anomalous spending patterns in near real-time.
Which Azure service best supports this risk detection scenario?