AZ-204 Risk Assessment & Management 4

Question 1

Your application must stay available during an Azure regional outage. Which combination of services provides active-active geographic redundancy for an API backed by Azure SQL?

Accepted Answer

Azure Traffic Manager + Azure SQL active geo-replication

Answer

Traffic Manager routes DNS traffic to the healthy region while Azure SQL active geo-replication keeps a writable secondary ready for failover, enabling active-active resilience.

Question 2

A developer wants to reduce the blast radius if an Azure Function's storage account key is compromised. Which practice achieves this?

Accepted Answer

Use SAS tokens with narrow permissions and short expiry instead of account keys

Answer

SAS tokens scoped to specific operations and containers with short expiry windows drastically limit what an attacker can do if a token is leaked.

Question 3

When implementing circuit breaker logic for calls to an external payment API from Azure Functions, what state transition correctly describes the circuit breaker pattern?

Accepted Answer

Closed → Open → Half-Open → Closed

Answer

The circuit breaker starts Closed (requests flow), trips to Open (requests blocked) on failures, then moves to Half-Open (probe requests) to test recovery before returning to Closed.

Question 4

You need to assess the risk of Azure AD token theft in a Single Page Application. Which OAuth 2.0 flow and storage strategy reduces this risk most effectively?

Accepted Answer

Authorization Code flow with PKCE and session cookies via BFF pattern

Answer

The Authorization Code flow with PKCE eliminates the need to expose tokens to JavaScript, and the Backend-for-Frontend pattern stores tokens server-side, mitigating XSS-based token theft.

Question 5

An AZ-204 exam scenario asks: your app writes to Azure Queue Storage and you want to detect messages that fail processing repeatedly. Which built-in mechanism enables this?

Accepted Answer

The dequeue count property increases each time; move to a poison queue after a threshold

Answer

Azure Queue Storage exposes a DequeueCount property per message; application code should move messages exceeding a threshold count to a separate poison-message queue for investigation.

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 - Microsoft Azure Developer Associate Practice Test

AZ-204 Risk Assessment & Management 4