AZ-204 Risk Assessment & Management 4 — Questions and Answers
Question 1: Your application must stay available during an Azure regional outage. Which combination of services provides active-active geographic redundancy for an API backed by Azure SQL?
- Azure Traffic Manager + Azure SQL active geo-replication (Correct answer)
- Azure CDN + Azure SQL read replicas
- Azure Application Gateway + Azure SQL long-term backup retention
- Azure Load Balancer + Azure SQL zone redundancy
Correct answer: Azure Traffic Manager + Azure SQL active geo-replication
Traffic Manager routes DNS traffic to the healthy region while Azure SQL active geo-replication keeps a writable secondary ready for failover, enabling active-active resilience.
Question 2: A developer wants to reduce the blast radius if an Azure Function's storage account key is compromised. Which practice achieves this?
- Use SAS tokens with narrow permissions and short expiry instead of account keys (Correct answer)
- Store the account key in an environment variable with a prefix of SECRET_
- Rotate the account key every 180 days manually
- Enable soft-delete on the storage account
Correct answer: Use SAS tokens with narrow permissions and short expiry instead of account keys
SAS tokens scoped to specific operations and containers with short expiry windows drastically limit what an attacker can do if a token is leaked.
Question 3: When implementing circuit breaker logic for calls to an external payment API from Azure Functions, what state transition correctly describes the circuit breaker pattern?
- Closed → Open → Half-Open → Closed (Correct answer)
- Open → Closed → Half-Open → Open
- Half-Open → Closed → Open → Half-Open
- Closed → Half-Open → Open → Closed
Correct answer: Closed → Open → Half-Open → Closed
The circuit breaker starts Closed (requests flow), trips to Open (requests blocked) on failures, then moves to Half-Open (probe requests) to test recovery before returning to Closed.
Question 4: You need to assess the risk of Azure AD token theft in a Single Page Application. Which OAuth 2.0 flow and storage strategy reduces this risk most effectively?
- Implicit flow with localStorage token storage
- Authorization Code flow with PKCE and session cookies via BFF pattern (Correct answer)
- Client Credentials flow with a hard-coded client secret
- Device Code flow with localStorage token storage
Correct answer: Authorization Code flow with PKCE and session cookies via BFF pattern
The Authorization Code flow with PKCE eliminates the need to expose tokens to JavaScript, and the Backend-for-Frontend pattern stores tokens server-side, mitigating XSS-based token theft.
Question 5: An AZ-204 exam scenario asks: your app writes to Azure Queue Storage and you want to detect messages that fail processing repeatedly. Which built-in mechanism enables this?
- Message TTL expiration removes them automatically
- The dequeue count property increases each time; move to a poison queue after a threshold (Correct answer)
- Enable geo-redundancy on the storage account
- Use Azure Monitor alerts on queue depth
Correct answer: The dequeue count property increases each time; move to a poison queue after a threshold
Azure Queue Storage exposes a DequeueCount property per message; application code should move messages exceeding a threshold count to a separate poison-message queue for investigation.
Question 6: Which Azure role assignment correctly follows the principle of least privilege for an application that only needs to read secrets from a Key Vault?
- Key Vault Administrator on the Key Vault
- Key Vault Secrets User on the Key Vault (Correct answer)
- Owner on the resource group containing the Key Vault
- Key Vault Contributor on the Key Vault
Correct answer: Key Vault Secrets User on the Key Vault
Key Vault Secrets User grants only get and list permissions on secrets, which is the minimum required for an application to read secrets without any management rights.
Question 7: Your Azure App Service deployment uses deployment slots. Which risk does a swap operation mitigate compared to deploying directly to production?
- Eliminates the need for unit tests before release
- Provides a zero-downtime rollback path by swapping slots back (Correct answer)
- Automatically scales the production slot during deployment
- Removes the requirement for a staging environment
Correct answer: Provides a zero-downtime rollback path by swapping slots back
If a production issue is detected after a slot swap, developers can immediately swap back to restore the previous version without a full redeployment, minimizing downtime risk.
AZ-204 Risk Assessment & Management 4
Your application must stay available during an Azure regional outage.
Which combination of services provides active-active geographic redundancy for an API backed by Azure SQL?