Exam AZ-204: Developing Solutions for Microsoft Azure — Questions and Answers

Question 1: You intend to add a virtual machine running Ubuntu Server to your company's Azure subscription. You must implement a unique deployment that includes the addition of a specific trusted root certification authority (CA) Which of the following should you use to create the virtual machine?

The New-AzureRmVm cmdlet
The az vm create command.
The Create-AzVM cmdlet. (Correct answer)
The New-AzVM cmdlet.

Correct answer: The Create-AzVM cmdlet.

Deploying a VM with a unique configuration like a specific trusted root certification authority requires the scripting and granular control of PowerShell, using the New-AzVM cmdlet. The az CLI command and the deprecated New-AzureRmVm don't provide the same setup here. ⚠ The stored key ('Create-AzVM') is wrong — no such cmdlet exists; the correct cmdlet is New-AzVM.

Question 2: Which partition key choice would result in the BEST throughput distribution in a Cosmos DB container storing IoT sensor readings?

sensorType
readingDate
deviceId (Correct answer)
deviceRegion

Correct answer: deviceId

Using deviceId distributes data evenly across logical partitions since each device generates a unique stream of readings, avoiding hot partitions.

Question 3: What command initializes a new Azure Functions project using the Azure Functions Core Tools?

func create
func new
func start
func init (Correct answer)

Correct answer: func init

`func init` scaffolds a new Azure Functions project with the appropriate host configuration for the chosen runtime.

Question 4: The LabelMaker application security requirement must be met. Make a RoleBinding and assign it to the Azure AD account as a solution. Is the aim being met by the solution?

Yes
No (Correct answer)
Neither Yes or No

Correct answer: No

A `RoleBinding` in Kubernetes grants permissions to a subject (like an Azure AD account) within the cluster, defining what actions they can perform on Kubernetes resources. However, it does not address the broader application security requirements, such as how the Azure AD account authenticates to the cluster or how the application itself is secured beyond Kubernetes authorization. Therefore, simply creating a `RoleBinding` is an incomplete solution for overall application security involving an Azure AD account.

Question 5: What is required to enable WebSocket connections in an Azure App Service Web App?

Use Azure SignalR Service instead
Add an Application Gateway in front
Enable the WebSockets setting in App Service configuration (Correct answer)
Deploy on the Isolated plan only

Correct answer: Enable the WebSockets setting in App Service configuration

WebSocket support must be explicitly enabled in the App Service general settings under the Configuration blade.

Question 6: After moving the application to Azure, you must make sure to establish the backup solution. For this need, which of the following would you develop first?

Create a recovery plan
Create a backup policy
Create a recovery services vault (Correct answer)
Create an Azure Backup Server

Correct answer: Create a recovery services vault

To implement a backup solution for an application after it is moved to Azure, the first step would be to create a Recovery Services vault.

Question 7: Which Azure service lets you run containers without managing virtual machines or clusters?

Azure Container Instances (Correct answer)
Azure Kubernetes Service
Azure Batch
Azure Container Apps

Correct answer: Azure Container Instances

Azure Container Instances (ACI) runs containers on-demand in a serverless manner with no infrastructure management.

Question 8: What Azure Service Bus entity allows publish-subscribe messaging where multiple subscribers each receive a copy of the message?

Event stream
Topic with subscriptions (Correct answer)
Relay
Queue

Correct answer: Topic with subscriptions

Service Bus topics with subscriptions implement the pub/sub pattern: each subscription gets its own independent copy of every message published to the topic.

Question 9: In an Azure Function, what interface should the injected logger implement for structured logging?

EventLog
ILogger (Correct answer)
DiagnosticSource
TraceWriter

Correct answer: ILogger

Azure Functions supports `ILogger` (from Microsoft.Extensions.Logging) for structured, leveled log output that integrates with Application Insights.

Question 10: What is the purpose of the `local.settings.json` file in Azure Functions development?

Sets the runtime version for deployment
Stores connection strings and app settings for local development only (Correct answer)
Configures binding extensions
Defines production environment variables

Correct answer: Stores connection strings and app settings for local development only

`local.settings.json` holds app settings and connection strings used only during local development and should never be committed to source control.

Question 11: In Azure Durable Functions, which function type orchestrates the execution of other functions?

Activity function
Entity function
Client function
Orchestrator function (Correct answer)

Correct answer: Orchestrator function

Orchestrator functions define the workflow logic and coordinate calls to activity functions using async/await patterns.

Question 12: What is the purpose of the `extensions.csproj` file generated by `func extensions install`?

Defines the Functions runtime version
Manages NuGet packages for binding extensions in the non-.NET isolated model (Correct answer)
Stores function trigger metadata
Configures the deployment pipeline

Correct answer: Manages NuGet packages for binding extensions in the non-.NET isolated model

`extensions.csproj` lists the NuGet binding extension packages so the Functions host can load triggers like Service Bus or Event Grid.

Question 13: To pull a container image from Azure Container Registry into an App Service Web App, which identity type is recommended?

Service principal with client secret
Shared access signature
System-assigned managed identity (Correct answer)
API key stored in Key Vault

Correct answer: System-assigned managed identity

A system-assigned managed identity on the App Service eliminates stored credentials and grants ACR pull permissions via RBAC.

Question 14: Your company's Azure solution uses multi-factor authentication when users are not in the office. The use model has been set to the Per Authentication option. You are notified that these workers should also utilize Multi-Factor Authentication after purchasing a smaller firm and enrolling the new workforce in Azure Active Directory (Azure AD). To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You make a backup of the data from the current Multi-Factor Authentication provider and use it to construct a new Multi-Factor Authentication provider. Does the solution meet the goal?

No
Yes (Correct answer)

Correct answer: Yes

The usage model of an Azure MFA provider is fixed at creation and cannot be edited afterward, so the only way to switch from Per Authentication to Per Enabled User is to create a brand-new provider. Backing up the existing provider's data and using it to build the new provider achieves this, so the solution meets the goal.

Question 15: Your company's Azure solution uses multi-factor authentication when users are not in the office. The use model has been set to the Per Authentication option. You are notified that these workers should also utilize Multi-Factor Authentication after purchasing a smaller firm and enrolling the new workforce in Azure Active Directory (Azure AD). To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You make a backup of the data from the current Multi-Factor Authentication provider and use it to construct a new Multi-Factor Authentication provider. Does the solution meet the goal?

Yes
No (Correct answer)

Correct answer: No

You cannot change the usage model (for example from Per Authentication to Per Enabled User) on an existing MFA provider, and simply backing up data to build a new provider does not, by itself, transition the new workforce onto the required model — the answer is No because the described action doesn't accomplish the stated billing/enforcement change. The correct approach is to create a new provider configured with the desired usage model and link it to the directory.

Question 16: What Azure Functions feature allows you to inject dependencies like database clients using the built-in IoC container?

Extension bundles
Dependency injection via Startup class (Correct answer)
Function filters
Middleware pipeline

Correct answer: Dependency injection via Startup class

Azure Functions supports dependency injection by registering services in a `Startup` class that inherits `FunctionsStartup`, mirroring ASP.NET Core DI.

Question 17: Which Azure Functions trigger fires a function on a schedule defined by a CRON expression?

HTTP trigger
Event Grid trigger
Queue trigger
Timer trigger (Correct answer)

Correct answer: Timer trigger

The Timer trigger executes a function at intervals or on specific times defined by a NCRONTAB expression.

Question 18: What is the maximum size of a single document (item) in Azure Cosmos DB?

4 MB (Correct answer)
2 MB
16 MB
1 MB

Correct answer: 4 MB

Azure Cosmos DB supports individual item (document) sizes up to 2 MB.

Question 19: Which Azure Service Bus feature prevents duplicate messages from being processed within a configurable time window?

Dead-letter queue
Message sessions
Message deferral
Duplicate detection (Correct answer)

Correct answer: Duplicate detection

Duplicate detection uses a message ID history window to silently discard resubmitted messages with the same `MessageId` within the detection window.

Question 20: You work for your company as a developer. The workflows for an existing Logic App need to be changed. Which should you employ?

the Logic Apps Designer
the Logic App Code View
the API Connections
the Enterprise Integration Pack (EIP) (Correct answer)

Correct answer: the Enterprise Integration Pack (EIP)

The Enterprise Integration Pack (EIP) in Azure Logic Apps provides a suite of connectors and capabilities specifically designed for complex B2B and enterprise integration scenarios. If the changes to an existing Logic App workflow involve integrating with enterprise systems, handling EDI, AS2, X12, or XML messages, or performing advanced data transformations, then the components and features provided by the EIP would be employed to implement these specific workflow modifications.

Question 21: Both your Azure Active Directory (Azure AD) and Microsoft 365 tenants are called contoso.com. You want to offer access to a temporary Microsoft SharePoint document library named Library1 to three users: User1, User2, and User3. For the users, groups must be created. The solution must make sure that after 180 days, the groups are terminated automatically. Which two groups ought should you form? Each accurate response offers a whole resolution. NOTE: Each correct selection is worth one point.

a Microsoft 365 group that uses the Assigned membership type (Correct answer)
a Security group that uses the Assigned membership type
a Security group that uses the Dynamic User membership type
a Microsoft 365 group that uses the Dynamic User membership type (Correct answer)
a Security group that uses the Dynamic Device membership type

Correct answer: a Microsoft 365 group that uses the Assigned membership type

You can set an expiration policy only for Office 365 groups in Azure Active Directory (Azure AD) Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner. When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted. You can set up a rule for dynamic membership on security groups or Office 365 groups.

Question 22: What Azure AD consent type allows an administrator to grant permissions for all users in a tenant at once?

Application consent
Admin consent (Correct answer)
User consent
Delegated consent

Correct answer: Admin consent

Admin consent grants an application's requested permissions to all users in the tenant, bypassing per-user consent for sensitive or organization-wide scopes.

Question 23: Azure Active Directory (Azure AD) and Microsoft 365 tenants for your business go by contoso.com. The business uses multiple Azure Files shares. Each share of the corporation is allocated to a distinct division. All users have data in the department property in Azure AD. The departmental file sharing must be accessible to the users. Which two categories of groups ought you employ?

a security group that uses the assigned membership type
a security group that uses the dynamic membership type (Correct answer)
a distribution group that uses the dynamic membership type
a Microsoft 365 group that uses the dynamic membership type (Correct answer)
a Microsoft 365 group that uses the assigned membership type

Correct answer: a security group that uses the dynamic membership type

Access to the Azure Files shares is controlled with a security group (Microsoft 365 and distribution groups are for collaboration and email, not resource permissions), and dynamic membership automatically adds users based on a rule against their department property in Azure AD. Assigned membership would require manually maintaining each group, defeating the goal of automatic department-based access.

Question 24: Which Dockerfile instruction sets the default command executed when a container starts?

ENTRYPOINT
CMD (Correct answer)
RUN
EXPOSE

Correct answer: CMD

`CMD` provides the default command and arguments to run when the container starts, and can be overridden at runtime.

Question 25: Which method in the Azure Cosmos DB .NET SDK v3 is used to create or replace an item if it already exists?

UpsertItemAsync (Correct answer)
CreateItemAsync
ReplaceItemAsync
InsertItemAsync

Correct answer: UpsertItemAsync

UpsertItemAsync creates the item if it does not exist or replaces it if it does, making it idempotent for create-or-update scenarios.

Question 26: Which Durable Functions pattern is best suited for implementing a recurring job that runs forever without accumulating history?

Fan-out/fan-in
Function chaining
Eternal orchestration with continueAsNew (Correct answer)
Async HTTP API

Correct answer: Eternal orchestration with continueAsNew

`continueAsNew` replaces the current orchestration with a fresh instance, keeping history small for long-running eternal loops.

Question 27: What does the `az webapp log tail` command do?

Shows only error-level log entries
Rotates and archives current log files
Streams live application logs to the terminal (Correct answer)
Downloads the last 100 log entries to a file

Correct answer: Streams live application logs to the terminal

`az webapp log tail` streams the live log output from an App Service app directly to your terminal session.

Question 28: Which of the following is a correct way to read a single item by its ID in Azure Cosmos DB .NET SDK v3?

container.FetchItemAsync<T>(id, pk)
container.GetItemAsync<T>(id)
container.ReadItemAsync<T>(id, new PartitionKey(pk)) (Correct answer)
container.QueryItemsAsync<T>(id)

Correct answer: container.ReadItemAsync<T>(id, new PartitionKey(pk))

ReadItemAsync requires both the item ID and partition key value and is the most efficient single-item read (a point read costing 1 RU).

Question 29: Several Azure runbooks are included with your Azure subscription. The runbooks provide reports each night while they run. Authentication credentials are kept in the runbooks as variables. You must swap out the current authentication method with a more secure one. What ought you use?

An administrative unit
Azure Key Vault (Correct answer)
Azure Active Directory (Azure AD) Identity Protection
An access policy

Correct answer: Azure Key Vault

To replace the authentication solution for storing credentials in Azure runbooks with a more secure option, you should use Azure Key Vault.

Question 30: Windows Server 2016-powered Azure virtual machines (VMs) are a part of your company's Azure subscription. Every day, Azure Backup Instant Restore backs up one of the VMs. When the VM becomes infected with data encrypting ransomware, you decide to recover the VM's files. Which of the following is TRUE in this scenario?

You can only recover the files to the infected VM. (Correct answer)
You can only recover the files to a new VM.
You will not be able to recover the files.
You can recover the files to any VM within the company's subscription.

Correct answer: You can only recover the files to the infected VM.

With Azure Backup Instant Restore, file-level recovery mounts the recovery point as a drive and only lets you copy files back to the original (infected) VM — it does not support restoring individual files directly to a new or arbitrary VM. So the only valid option for file recovery here is restoring to the infected VM.

Question 31: In Azure Cosmos DB, what is a logical partition?

A geographic replica of the container in another Azure region
A read-only copy of the container for reporting purposes
A subset of items in a container that share the same partition key value (Correct answer)
A separate billing unit within a Cosmos DB account

Correct answer: A subset of items in a container that share the same partition key value

A logical partition is the set of all items in a container that have the same partition key value; Cosmos DB distributes logical partitions across physical partitions to scale throughput.

Question 32: When using Azure Container Apps, what component manages traffic splitting between revisions for A/B testing?

Application Gateway routing
Ingress traffic weights (Correct answer)
Deployment slots
Load balancer rules

Correct answer: Ingress traffic weights

Azure Container Apps ingress traffic weights allow you to split a percentage of traffic between named revisions for gradual rollouts.

Question 33: What is the maximum message size for Azure Service Bus in the Premium tier?

1 GB
1 MB
100 MB (Correct answer)
256 KB

Correct answer: 100 MB

The Premium tier of Azure Service Bus supports message sizes up to 100 MB, compared to 256 KB in the Standard tier.

Question 34: What is the maximum number of deployment slots available on the Premium App Service plan?

20 (Correct answer)
10
5
50

Correct answer: 20

The Premium App Service plan supports up to 20 deployment slots including the production slot.

Question 35: Azure Active Directory (Azure AD) is a service that your business subscribes to. You wish to establish a conditional access policy for Azure AD. When connecting to Azure AD from untrusted places, members of the Global Administrators group must utilize Multi-Factor Authentication and a device that is connected to Azure AD. Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy. Does the solution meet the goal?

No
Yes (Correct answer)

Correct answer: Yes

Requirements like enforcing Multi-Factor Authentication and requiring an Azure AD–joined/compliant device are configured under the GRANT controls of a Conditional Access policy. Since the solution modifies the grant control, it meets the goal, so the answer is Yes.

Question 36: In `host.json`, which setting controls the maximum number of concurrent function executions per instance?

functionTimeout
maxOutstandingRequests
maxConcurrentCalls (Correct answer)
maxConcurrentInstances

Correct answer: maxConcurrentCalls

`maxConcurrentCalls` in `host.json` under the `queues` or `serviceBus` extension limits how many function invocations run in parallel per host.

Question 37: Which Azure Cosmos DB API is designed for working with graph data and relationships?

Gremlin API (Correct answer)
Table API
Cassandra API
SQL API

Correct answer: Gremlin API

The Gremlin API (Graph API) supports the Apache TinkerPop Gremlin graph traversal language for modeling and querying graph data.

Question 38: Which setting in `host.json` configures the Application Insights instrumentation key for a Functions app?

APPLICATIONINSIGHTS_CONNECTION_STRING app setting (Correct answer)
host.json insights.key
APPINSIGHTS_INSTRUMENTATIONKEY in local.settings.json
logging.applicationInsights.samplingSettings

Correct answer: APPLICATIONINSIGHTS_CONNECTION_STRING app setting

Azure Functions connects to Application Insights via the `APPLICATIONINSIGHTS_CONNECTION_STRING` application setting (preferred over instrumentation key).

Question 39: What Azure Key Vault feature automatically renews certificates before they expire?

Key rotation policy
Certificate autorenew lifetime action (Correct answer)
Soft-delete retention
Secret versioning

Correct answer: Certificate autorenew lifetime action

Key Vault certificates support lifetime action policies that trigger automatic renewal a set number of days before expiry.

Question 40: Which Azure event service is best suited for high-throughput telemetry ingestion from IoT devices?

Azure Event Grid
Azure Notification Hubs
Azure Service Bus
Azure Event Hubs (Correct answer)

Correct answer: Azure Event Hubs

Azure Event Hubs is designed for high-throughput streaming of millions of events per second, making it ideal for telemetry and log ingestion.

Exam AZ-204: Developing Solutions for Microsoft Azure

This exam certifies candidates' expertise in designing, building, testing, and maintaining cloud applications and services on Microsoft Azure.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds