AZ-204 Risk Assessment & Management 3 — Questions and Answers
Question 1: You need to ensure that a Cosmos DB container's throughput is never overwhelmed by a single tenant in a multi-tenant app. Which approach best isolates this risk?
- Use a shared database with autoscale RU/s and per-tenant partition keys
- Create a dedicated container per tenant with provisioned RU/s (Correct answer)
- Use serverless Cosmos DB with no RU limit
- Enable geo-replication to distribute load
Correct answer: Create a dedicated container per tenant with provisioned RU/s
Dedicated containers per tenant with provisioned RU/s provide hard isolation so one tenant's traffic cannot consume another tenant's throughput budget.
Question 2: Your Azure Function uses a Blob trigger to process uploaded files. To avoid data loss risk if the function fails mid-processing, which pattern should you implement?
- Use a Timer trigger instead of Blob trigger
- Write a poison-message handler using the Azure Function's retry policy with a Blob lease (Correct answer)
- Delete the blob immediately after reading it
- Switch to an HTTP trigger for synchronous processing
Correct answer: Write a poison-message handler using the Azure Function's retry policy with a Blob lease
Configuring an explicit retry policy and using blob leases prevents duplicate processing while ensuring failed messages are retried, protecting against data loss on transient failures.
Question 3: When assessing risk for an Azure application that uses managed identity to access Azure SQL, which scenario represents a residual risk that managed identity does NOT eliminate?
- Credential rotation burden
- SQL injection in application query logic (Correct answer)
- Key expiration causing outages
- Password leakage from configuration files
Correct answer: SQL injection in application query logic
Managed identity removes credential management risk but does not protect against SQL injection, which is an application-layer vulnerability in how queries are constructed.
Question 4: Your team must demonstrate to auditors that all changes to Azure resource configurations are logged. Which service provides an immutable audit trail of management-plane operations?
- Azure Monitor Metrics
- Azure Activity Log (Correct answer)
- Azure Diagnostic Logs
- Azure Application Insights
Correct answer: Azure Activity Log
The Azure Activity Log captures all control-plane (management-plane) operations such as resource creation, deletion, and modification with user identity and timestamps.
Question 5: A security review flags that your App Service can be accessed over plain HTTP. What is the lowest-effort mitigation to enforce HTTPS-only access?
- Add a custom domain with a certificate
- Enable the HTTPS Only toggle in App Service TLS/SSL settings (Correct answer)
- Deploy an Azure Front Door instance
- Configure an NSG to block port 80
Correct answer: Enable the HTTPS Only toggle in App Service TLS/SSL settings
The HTTPS Only setting in App Service automatically redirects all HTTP requests to HTTPS with a single toggle, requiring no infrastructure changes.
Question 6: You are using Azure Event Hubs to ingest IoT telemetry. To mitigate the risk of data loss when a consumer application is down, which feature should you configure?
- Increase partition count to 64
- Enable Capture to write events to Azure Blob Storage (Correct answer)
- Use Event Hubs Basic tier
- Enable geo-disaster recovery pairing
Correct answer: Enable Capture to write events to Azure Blob Storage
Event Hubs Capture automatically writes ingested events to Azure Blob or Data Lake Storage, ensuring no data is lost even if downstream consumers are offline.
Question 7: Which Azure Security Center (Defender for Cloud) capability directly helps developers identify misconfigured Azure resources that introduce security risk at the code/IaC stage?
- Just-in-time VM access
- DevSecOps integration with IaC scanning (Correct answer)
- Adaptive application controls
- Regulatory compliance dashboard
Correct answer: DevSecOps integration with IaC scanning
Defender for Cloud's DevSecOps integration scans Infrastructure-as-Code templates in CI/CD pipelines, surfacing misconfigurations before they reach production.
AZ-204 Risk Assessment & Management 3
You need to ensure that a Cosmos DB container's throughput is never overwhelmed by a single tenant in a multi-tenant app.
Which approach best isolates this risk?