AZ-204 Risk Assessment & Management 3

Question 1

You need to ensure that a Cosmos DB container's throughput is never overwhelmed by a single tenant in a multi-tenant app. Which approach best isolates this risk?

Accepted Answer

Create a dedicated container per tenant with provisioned RU/s

Answer

Dedicated containers per tenant with provisioned RU/s provide hard isolation so one tenant's traffic cannot consume another tenant's throughput budget.

Question 2

Your Azure Function uses a Blob trigger to process uploaded files. To avoid data loss risk if the function fails mid-processing, which pattern should you implement?

Accepted Answer

Write a poison-message handler using the Azure Function's retry policy with a Blob lease

Answer

Configuring an explicit retry policy and using blob leases prevents duplicate processing while ensuring failed messages are retried, protecting against data loss on transient failures.

Question 3

When assessing risk for an Azure application that uses managed identity to access Azure SQL, which scenario represents a residual risk that managed identity does NOT eliminate?

Accepted Answer

SQL injection in application query logic

Answer

Managed identity removes credential management risk but does not protect against SQL injection, which is an application-layer vulnerability in how queries are constructed.

Question 4

Your team must demonstrate to auditors that all changes to Azure resource configurations are logged. Which service provides an immutable audit trail of management-plane operations?

Accepted Answer

Azure Activity Log

Answer

The Azure Activity Log captures all control-plane (management-plane) operations such as resource creation, deletion, and modification with user identity and timestamps.

Question 5

A security review flags that your App Service can be accessed over plain HTTP. What is the lowest-effort mitigation to enforce HTTPS-only access?

Accepted Answer

Enable the HTTPS Only toggle in App Service TLS/SSL settings

Answer

The HTTPS Only setting in App Service automatically redirects all HTTP requests to HTTPS with a single toggle, requiring no infrastructure changes.

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 Risk Assessment & Management 3