View Full Microsoft AZ-204 Exam Dumps and Practice Test Dumps

 

Q81. Which authentication method is recommended for an Azure application accessing Blob Storage without storing account keys in application configuration?

1) Storage account access keys
2) Managed identity with Microsoft Entra ID
3) Hard-coded connection string
4) Anonymous public access

Correct Answer: 2)

Explanation:

A managed identity with Microsoft Entra ID provides a secure way for an Azure application to access Blob Storage without requiring developers to store storage account keys or passwords in configuration files. Azure creates and manages the identity, while role-based access control determines which storage operations it can perform. This approach reduces the risk of credential exposure and simplifies credential rotation because the application does not manage secrets directly. Storage account keys and connection strings can provide broad access and therefore create greater security risks if exposed. Anonymous access should only be used when public data is intentionally required. Managed identities are generally preferred for Azure-hosted applications requiring secure resource access.

Q82. Which type of SAS allows a user to delegate access to Blob Storage using Microsoft Entra credentials rather than the storage account key?

1) Account SAS
2) Service SAS
3) User delegation SAS
4) Container access policy

Correct Answer: 3)

Explanation:

A user delegation SAS is designed to provide delegated access to Azure Blob Storage using Microsoft Entra security credentials instead of the storage account key. This improves security because the application does not need to distribute or manage the highly privileged storage account key. The SAS can specify permissions, resources, and an expiration period, allowing applications to grant temporary access to specific blobs or containers. Account SAS and service SAS can use storage account keys, while a stored access policy is used to manage permissions associated with certain SAS scenarios. User delegation SAS is particularly useful when applications need controlled, temporary access while following Microsoft Entra-based identity and authorization practices.

Q83. Which Azure Blob Storage feature allows an application to search for blobs based on custom key-value metadata without scanning all blob names?

1) Blob index tags
2) Blob snapshots
3) Soft delete
4) Storage lifecycle policies

Correct Answer: 1)

Explanation:

Blob index tags allow applications to assign searchable key-value tags directly to individual blobs. These tags can then be used to locate blobs based on business-related attributes, such as department, project, document type, or processing status. This is different from ordinary blob metadata, which is primarily descriptive and does not provide the same native indexing capability for searching across blobs. Snapshots provide point-in-time copies, soft delete helps recover deleted data, and lifecycle management automates data movement or deletion based on policies. Blob index tags are therefore appropriate when an application needs to efficiently discover specific blobs using custom searchable attributes.

Q84. Which Azure Blob Storage feature can be used to prevent multiple clients from modifying the same blob simultaneously?

1) Blob versioning
2) Blob lease
3) Blob index tags
4) Lifecycle management

Correct Answer: 2)

Explanation:

A blob lease provides a mechanism for controlling access to a blob when multiple clients may attempt to modify it concurrently. When a client acquires a lease, it obtains exclusive write access for the lease duration, assuming operations use the appropriate lease identifier. This can help applications implement concurrency control and prevent conflicting updates. Blob versioning keeps previous versions of blobs, while index tags support searchable classification. Lifecycle management automates storage actions based on rules and conditions. A lease is especially useful in distributed applications where several processes could otherwise attempt to update the same blob at the same time.

Q85. Which Azure Blob Storage capability records changes made to blobs and blob metadata for downstream processing?

1) Blob snapshots
2) Blob change feed
3) Soft delete
4) Archive tier

Correct Answer: 2)

Explanation:

The Azure Blob Storage change feed provides a persistent, ordered log of changes made to blobs and their metadata. Applications can consume this information to build workflows such as auditing, analytics, synchronization, or downstream processing. Instead of repeatedly scanning the entire storage account to determine what changed, an application can process recorded change events. Blob snapshots are point-in-time copies, while soft delete provides recovery capabilities for deleted data. The archive tier is designed for long-term, infrequently accessed data. Change feed is particularly useful for applications that need to reliably track storage modifications and react to changes over time.

Q86. Which Azure Blob Storage feature can enforce that data remains undeletable or unmodifiable for a specified retention period?

1) Blob soft delete
2) Immutable blob storage
3) Blob snapshots
4) Blob index tags

Correct Answer: 2)

Explanation:

Immutable blob storage enables data to be stored in a write-once, read-many configuration so that it cannot be modified or deleted during a defined retention period. This capability is useful when applications must preserve records for regulatory, compliance, auditing, or legal requirements. Time-based retention policies can specify how long data must remain protected, while legal holds can be used when retention needs to continue until a specific condition is resolved. Soft delete is intended primarily for recovery after deletion, and snapshots preserve previous versions rather than enforcing immutability. Immutable storage is therefore the appropriate choice when preventing unauthorized modification or deletion is a primary requirement.

Q87. A company wants multiple copies of Azure Storage data to remain available within the same Azure region if a single availability zone fails. Which redundancy option should it choose?

1) Locally redundant storage
2) Geo-redundant storage
3) Zone-redundant storage
4) Read-access geo-redundant storage

Correct Answer: 3)

Explanation:

Zone-redundant storage, or ZRS, synchronously replicates data across multiple availability zones within the same Azure region. This design helps protect applications from failures affecting an individual zone while keeping the data within the selected region. Locally redundant storage maintains multiple copies within a single physical location and does not provide the same zone-level protection. Geo-redundant options replicate data to a secondary region and are designed for regional disaster recovery. Therefore, ZRS is the appropriate choice when the requirement specifically states that storage data should remain available within one region even if an availability zone experiences an outage.

Q88. Which Azure Storage account setting helps ensure that clients connect to storage services only through encrypted HTTPS connections?

1) Secure transfer required
2) Public access enabled
3) Soft delete
4) Blob versioning

Correct Answer: 1)

Explanation:

The secure transfer required setting ensures that requests to Azure Storage are made through secure HTTPS connections rather than unencrypted HTTP. Encrypting data while it travels between an application and the storage service helps protect credentials, data, and requests from interception. This setting is a straightforward security control that should generally be enabled for production storage accounts. Public access settings determine whether resources can be accessed anonymously, while soft delete and versioning focus on data recovery and historical versions. Secure transfer required specifically addresses protection of data in transit between clients and Azure Storage services.

Q89. An application must access an Azure Storage account privately without exposing storage traffic to the public internet. Which solution is most appropriate?

1) Public blob access
2) Storage account access key
3) Azure Private Endpoint
4) Blob lifecycle management

Correct Answer: 3)

Explanation:

An Azure Private Endpoint provides a private IP address from a virtual network for accessing supported Azure services, including Storage accounts. This allows application traffic to travel through private network connectivity rather than relying on a publicly accessible endpoint. Private endpoints are useful when organizations require stronger network isolation or want to restrict access to storage resources from approved virtual networks. Access keys control authentication but do not make the network path private. Public blob access intentionally exposes data for anonymous access, and lifecycle management controls data retention and movement. Therefore, Private Endpoint is the best choice when private network access to Azure Storage is required.

Q90. Which Azure Cosmos DB feature controls how properties are automatically indexed for queries?

1) Consistency level
2) Indexing policy
3) Partition key
4) Time to Live

Correct Answer: 2)

Explanation:

The Cosmos DB indexing policy determines which document properties and paths are indexed and how indexing is performed. Proper indexing can improve query performance while reducing unnecessary storage and indexing costs. Cosmos DB provides automatic indexing by default, but developers can customize indexing behavior when application requirements justify it. The partition key determines how data is distributed across logical and physical partitions. Consistency controls how current returned data must be relative to writes, while Time to Live automatically removes items after a specified period. Therefore, the indexing policy is the feature developers use to control which document properties participate in Cosmos DB indexing.

Q91. Which operation is generally the most efficient way to retrieve a single Cosmos DB item when its partition key and item ID are known?

1) Cross-partition query
2) Full container scan
3) Point read
4) Aggregation query

Correct Answer: 3)

Explanation:

A Cosmos DB point read is highly efficient when both the item ID and partition key value are known. The service can directly locate the item within its logical partition instead of evaluating a query across multiple partitions. Point reads are therefore preferred when an application needs to retrieve individual items and already knows these identifying values. Cross-partition queries may consume more request units because they can require work across multiple partitions. Full scans and aggregation queries are generally unnecessary for a simple single-item lookup. Designing application access patterns around efficient point reads can significantly improve performance and help reduce request unit consumption.

Q92. A developer wants Cosmos DB items to be automatically deleted after a specified period. Which feature should be configured?

1) Change feed
2) Indexing policy
3) Time to Live
4) Partition key

Correct Answer: 3)

Explanation:

Cosmos DB Time to Live, commonly called TTL, allows developers to configure automatic expiration for items. When TTL is enabled, items can be automatically deleted after they have existed for the configured duration. This is useful for temporary records, session information, caches, logs, and other data that should not remain indefinitely. The expiration behavior is managed by Cosmos DB rather than requiring application code to periodically identify and delete expired documents. Change feed tracks modifications, indexing policy controls indexes, and partition keys determine data distribution. TTL is therefore the appropriate feature when an application requires automatic removal of items after a defined period.

Q93. Which Cosmos DB feature allows an application to process changes made to items in a container?

1) Change feed
2) Consistency level
3) Indexing policy
4) Stored procedure

Correct Answer: 1)

Explanation:

Cosmos DB change feed provides an ordered record of changes to items in a container, allowing applications to react to data modifications. It is commonly used for event-driven processing, synchronization, analytics pipelines, materialized views, and other downstream workflows. Instead of continuously scanning the entire container to detect changes, an application can consume the change feed and process newly changed items. Consistency levels control how reads observe writes, while indexing policies control query indexing. Stored procedures execute server-side transactional logic within a logical partition. Therefore, the change feed is the best choice when an application needs to react to item changes.

Q94. Which Cosmos DB capability allows multiple operations to execute transactionally within the same logical partition?

1) Global distribution
2) Transactional batch
3) Change feed
4) Automatic indexing

Correct Answer: 2)

Explanation:

Cosmos DB transactional batch allows multiple operations to be grouped into a single atomic transaction when all operations belong to the same logical partition. If the transaction succeeds, the operations are committed together; if it fails, the changes are not partially committed. This is useful when several related documents must remain consistent. Cosmos DB transactions are intentionally scoped around a logical partition because the partition key determines the transaction boundary. Global distribution handles replication across regions, change feed tracks item modifications, and automatic indexing supports query performance. Transactional batch is therefore appropriate when multiple operations must succeed or fail as one unit.

Q95. Which HTTP-based mechanism can an application use with Cosmos DB to prevent overwriting an item that was modified after it was read?

1) ETag-based optimistic concurrency
2) DNS caching
3) Blob lease
4) Storage lifecycle policy

Correct Answer: 1)

Explanation:

Cosmos DB uses ETags to support optimistic concurrency control. Each item has an ETag that changes when the item is modified. An application can read an item and retain its ETag, then include the expected ETag when attempting an update. If another process has changed the item in the meantime, the ETag will no longer match, allowing the application to detect the conflict rather than silently overwriting newer data. This approach is valuable in distributed applications where multiple clients may update the same records. Blob leases apply to Azure Blob Storage, while lifecycle policies manage storage data automatically.

Q96. Which authentication approach is recommended for an Azure application connecting to Azure SQL Database when the application is hosted on an Azure resource that supports managed identities?

1) Store the SQL administrator password in source code
2) Use a managed identity with Microsoft Entra authentication
3) Store the database password in a public configuration file
4) Use anonymous SQL access

Correct Answer: 2)

Explanation:

A managed identity combined with Microsoft Entra authentication allows an Azure-hosted application to authenticate to Azure SQL Database without storing a database password in application code or configuration. The managed identity can be granted the necessary database permissions, following the principle of least privilege. This reduces the risk associated with exposed credentials and simplifies credential management because Azure handles the identity lifecycle. Hard-coded passwords and publicly accessible configuration files create serious security risks. Anonymous SQL access is not an appropriate authentication strategy. Therefore, managed identity with Microsoft Entra authentication is generally the preferred secure approach for supported Azure-hosted applications.

Q97. A company has several Azure SQL databases with unpredictable usage patterns and wants to share compute resources between them. Which feature should it consider?

1) Azure SQL elastic pool
2) Azure Blob lifecycle policy
3) Cosmos DB change feed
4) Azure Storage queue

Correct Answer: 1)

Explanation:

Azure SQL elastic pools allow multiple databases to share a set of compute and storage resources. This can be especially useful when databases have variable or unpredictable utilization patterns because resources can be shared rather than assigning dedicated capacity to every database. Elastic pools can improve cost efficiency when individual databases experience different usage levels at different times. Blob lifecycle policies manage storage data movement and deletion, while Cosmos DB change feed tracks item changes. Azure Storage queues provide asynchronous messaging rather than database resource management. Therefore, an elastic pool is a strong option when multiple Azure SQL databases need shared, flexible compute capacity.

Q98. An Azure SQL Database must be accessible only from approved private network resources. Which networking option is most appropriate?

1) Public database access from every IP address
2) Azure Private Endpoint
3) Anonymous authentication
4) Blob service firewall

Correct Answer: 2)

Explanation:

Azure Private Endpoint provides private network connectivity to Azure SQL Database by assigning a private IP address within an Azure virtual network. This allows applications and services connected to the appropriate network to access the database without relying on its public endpoint. Network access can therefore be restricted according to the organization’s private networking architecture. Public access from unrestricted IP addresses does not provide the same level of isolation. Authentication controls who can connect but does not itself create private network connectivity. Blob-specific firewall settings are unrelated to Azure SQL Database. Private Endpoint is therefore the appropriate solution for private SQL connectivity.

Q99. A developer notices that a frequently executed Azure SQL query is performing poorly because the database must scan many rows. Which database feature can help improve lookup performance?

1) SQL index
2) Storage account SAS
3) Blob lease
4) Cosmos DB TTL

Correct Answer: 1)

Explanation:

A properly designed SQL index can improve query performance by allowing the database engine to locate required rows more efficiently instead of scanning a large portion of a table. Indexes are particularly valuable for columns frequently used in filtering, joining, or sorting operations. However, developers should design indexes carefully because excessive or poorly chosen indexes increase storage requirements and can add overhead to insert, update, and delete operations. A storage SAS controls delegated access to Azure Storage, a blob lease manages concurrent blob access, and Cosmos DB TTL controls item expiration. Therefore, an appropriate SQL index is the relevant performance optimization for this scenario.

Q100. An application accidentally deletes data from Azure SQL Database and needs to restore the database to a specific point before the deletion. Which capability should be used?

1) Blob versioning
2) Azure SQL point-in-time restore
3) Cosmos DB change feed
4) Azure Queue Storage

Correct Answer: 2)

Explanation:

Azure SQL Database automated backups support point-in-time restore, allowing a database to be restored to a previous point within the available retention period. This is useful when accidental deletion, corruption, or an application error affects database data and the organization needs to recover the database to a known earlier state. The restore operation creates a recovered database based on the selected recovery point. Blob versioning applies to Azure Storage blobs, while Cosmos DB change feed tracks item changes rather than restoring a relational database. Azure Queue Storage provides messaging capabilities. Point-in-time restore is therefore the appropriate recovery feature for Azure SQL Database.