AZ-204 Technology & Digital Applications 4 — Questions and Answers
Question 1: A developer needs to read a secret from Azure Key Vault in a .NET application using DefaultAzureCredential. The app runs locally using a developer account and in production using a managed identity. What is the correct NuGet package to add?
- Azure.Security.KeyVault.Secrets and Azure.Identity (Correct answer)
- Microsoft.Azure.KeyVault and Microsoft.IdentityModel.Clients.ActiveDirectory
- Azure.Security.KeyVault.Secrets and Microsoft.Azure.Services.AppAuthentication
- Azure.KeyVault.Core and Azure.Core
Correct answer: Azure.Security.KeyVault.Secrets and Azure.Identity
Azure.Security.KeyVault.Secrets provides the SecretClient class, and Azure.Identity provides DefaultAzureCredential, which supports both local developer auth and managed identity in production.
Question 2: You need to monitor the performance of an Azure Function and receive an alert when the average execution duration exceeds 2 seconds over a 5-minute window. What should you configure?
- Create an Azure Monitor metric alert on the FunctionExecutionTimeMs metric (Correct answer)
- Enable Application Insights and create a log alert on the customMetrics table
- Set up a Live Metrics Stream threshold in Application Insights
- Create an availability test in Application Insights with a 2-second threshold
Correct answer: Create an Azure Monitor metric alert on the FunctionExecutionTimeMs metric
Azure Monitor provides a built-in FunctionExecutionTimeMs metric for Azure Functions, which supports metric alert rules with configurable aggregation windows.
Question 3: An Azure Service Bus topic has three subscriptions. A message published to the topic must be received by all three subscriptions. After processing, each subscription's copy of the message should be deleted independently. Is this the default behavior?
- No — only the first subscription to read the message receives it
- Yes — each subscription receives its own independent copy of every message (Correct answer)
- No — messages must be explicitly forwarded to each subscription using ForwardTo
- Yes — but only if the topic's EnablePartitioning property is set to true
Correct answer: Yes — each subscription receives its own independent copy of every message
Service Bus topics create an independent copy of each message for every subscription by default, enabling pub/sub fan-out where each subscriber processes at its own pace.
Question 4: You need to cache the results of an expensive database query in an Azure Function for 10 minutes. The function runs on a Consumption plan. What is the recommended approach?
- Use a static in-memory Dictionary in the function class
- Use Azure Cache for Redis with a 10-minute TTL (Correct answer)
- Use Azure Table Storage with a timestamp-based expiry check
- Store results in a local temp file with a file-modified timestamp check
Correct answer: Use Azure Cache for Redis with a 10-minute TTL
Azure Cache for Redis provides reliable, distributed caching with native TTL support; static in-memory caches are unreliable on Consumption plans because instances can be recycled at any time.
Question 5: You are deploying a containerized application to Azure Kubernetes Service (AKS). The app needs to read a connection string stored in Azure Key Vault. What is the most secure way to provide this?
- Mount the connection string as an environment variable in the pod spec
- Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount the secret as a volume (Correct answer)
- Store the connection string in a Kubernetes ConfigMap
- Embed the connection string in the container image at build time
Correct answer: Use the Azure Key Vault Provider for Secrets Store CSI Driver to mount the secret as a volume
The Secrets Store CSI Driver integrates AKS with Key Vault to mount secrets as volumes, leveraging workload identity with no credentials stored in the cluster or image.
Question 6: A developer uses Azure API Management to expose a backend API. Some API operations should only be accessible to users with the 'admin' role in their JWT token. How should you enforce this in APIM?
- Add a validate-jwt inbound policy that checks the roles claim (Correct answer)
- Configure OAuth 2.0 in the APIM Developer Portal subscription settings
- Use a product-level subscription key scoped to admin users
- Enable Azure AD authentication on the backend API itself
Correct answer: Add a validate-jwt inbound policy that checks the roles claim
The validate-jwt inbound policy in APIM can inspect JWT claims, including roles, and return a 403 if the required role is absent — enforcing authorization at the gateway layer.
Question 7: You need to implement idempotent message processing for an Azure Service Bus queue consumer. A message contains an 'OrderId'. What is the recommended approach?
- Enable duplicate detection on the Service Bus queue and set MessageId to OrderId
- Check the OrderId against a processed-orders store before executing business logic and skip if already processed (Correct answer)
- Use Service Bus sessions keyed by OrderId to serialize processing
- Set the message's TimeToLive to 0 after first processing
Correct answer: Check the OrderId against a processed-orders store before executing business logic and skip if already processed
Checking against a persistent processed-orders store and skipping already-processed messages is the standard idempotent consumer pattern, protecting against duplicate processing regardless of message delivery guarantees.
AZ-204 Technology & Digital Applications 4
A developer needs to read a secret from Azure Key Vault in a .NET application using DefaultAzureCredential.
The app runs locally using a developer account and in production using a managed identity.
What is the correct NuGet package to add?