View Full Microsoft AZ-204 Exam Dumps and Practice Test Dumps

 

Q381. Which Azure Functions trigger should you use when a function needs to execute whenever an HTTP request is sent to a specific endpoint?

1) Timer trigger
2) HTTP trigger
3) Blob trigger
4) Queue trigger

Correct Answer: 2)

Explanation:

The HTTP trigger is designed to execute an Azure Function when an HTTP request is received by its configured endpoint. It is commonly used for creating APIs, webhooks, lightweight services, and endpoints that need to respond to GET, POST, PUT, or other HTTP methods. Developers can define routes, authorization levels, and request-handling logic for the function. Timer triggers are intended for scheduled execution, while Blob and Queue triggers respond to changes in storage resources. Using an HTTP trigger allows external applications, browsers, services, or clients to directly invoke the function through an HTTP request.

Q382. Which Azure Functions authorization level requires a function key when a client invokes the function through HTTP?

1) Anonymous
2) Admin
3) Function
4) Public

Correct Answer: 3)

Explanation:

The Function authorization level requires callers to provide a valid function key when invoking an HTTP-triggered Azure Function. Function keys provide a simple mechanism for controlling access to individual functions without requiring a complete authentication platform. The Anonymous level does not require a function key, making it suitable for endpoints that intentionally allow unauthenticated access. Admin-level access uses the host master key and provides broader administrative privileges. In production applications, function keys can help restrict access, but developers should consider stronger authentication and authorization mechanisms when applications require identity-based security, role-based access, or more advanced access control.

Q383. An Azure Durable Functions orchestrator must produce the same result when its execution is replayed. Which coding practice should be followed?

1) Use deterministic operations inside the orchestrator
2) Generate random values directly inside the orchestrator
3) Read the current system time directly
4) Perform unrestricted network calls from the orchestrator

Correct Answer: 1)

Explanation:

Durable Functions orchestrators can replay their execution history to reconstruct workflow state, so orchestrator code must be deterministic. Developers should avoid operations that can return different values during replay, such as directly reading the current system time, generating random numbers, or making unpredictable external network calls. Instead, Durable Functions provides APIs such as durable timers and orchestration context functions that are designed to work correctly with replay behavior. Non-deterministic operations should generally be placed inside activity functions. Following deterministic coding practices ensures that the orchestrator produces consistent results and that workflow state remains reliable throughout long-running or restarted executions.

Q384. A Durable Functions workflow must pause for two hours without consuming compute resources and then continue. Which feature should be used?

1) Queue trigger
2) Durable timer
3) HTTP trigger
4) Blob trigger

Correct Answer: 2)

Explanation:

A Durable Functions durable timer is designed for workflows that need to wait until a specified time before continuing execution. The orchestration can schedule a timer for a future point, allowing the workflow to remain durable without continuously running application code during the waiting period. This is useful for scenarios such as delayed notifications, scheduled approvals, timeouts, reminders, and business processes that require waiting. Unlike a normal application thread that remains active while sleeping, a durable timer works with the Durable Functions orchestration framework and allows Azure to manage the workflow state efficiently until the scheduled time is reached.

Q385. An Azure Function requires VNet integration, longer execution times, and more predictable performance than the Consumption plan. Which hosting option is most appropriate?

1) Azure Functions Premium plan
2) Azure Storage Queue
3) Azure Container Instances
4) Azure Functions Consumption plan

Correct Answer: 1)

Explanation:

The Azure Functions Premium plan is appropriate when an application requires capabilities beyond the standard Consumption plan. Premium provides features such as pre-warmed instances, more predictable performance, longer execution durations, and virtual network integration. These capabilities are useful for enterprise applications that need to access resources within a private network or avoid cold-start delays. The Consumption plan is designed for event-driven workloads with automatic scaling and usage-based billing but has different networking and execution characteristics. Selecting Premium can therefore provide a better hosting environment when an Azure Functions application requires enhanced performance, networking capabilities, and greater control over execution behavior.

Q386. A web application hosted on Azure App Service needs authentication without implementing authentication code inside the application. Which feature should be used?

1) Azure Queue Storage
2) App Service Authentication and Authorization
3) Azure Blob lifecycle management
4) Azure Event Hubs

Correct Answer: 2)

Explanation:

App Service Authentication and Authorization, commonly known as Easy Auth, allows an application to integrate with supported identity providers without requiring developers to implement the complete authentication process inside application code. The App Service platform can handle authentication requests and establish the authenticated user context before requests reach the application. This can simplify integration with Microsoft identity services and other supported providers. Developers can configure authentication behavior through App Service settings and control whether unauthenticated requests are allowed, redirected, or rejected. This feature is particularly useful when a web application needs centralized identity handling while minimizing custom authentication implementation.

Q387. An App Service application should accept requests only from a defined set of corporate IP addresses. Which feature should be configured?

1) App Service access restrictions
2) Deployment slots
3) Application Insights
4) Autoscale rules

Correct Answer: 1)

Explanation:

App Service access restrictions allow administrators to control which network sources can access an application. Rules can be configured using IP addresses, virtual network sources, and other supported conditions. For example, an organization can permit requests from approved corporate public IP ranges while denying traffic from unauthorized sources. Access restrictions are evaluated before application-level processing, helping reduce unwanted exposure of the application. They are different from authentication because they control network-level access rather than establishing the identity of an individual user. This feature is useful for internal applications, administrative endpoints, staging environments, and workloads that should only be reachable from trusted networks.

Q388. An App Service administrator needs to protect application content and configuration by creating recoverable backups. Which feature should be used?

1) App Service Health Check
2) App Service backup and restore
3) Azure Front Door
4) Application Insights

Correct Answer: 2)

Explanation:

App Service backup and restore provides a way to create backups of supported application content and configuration so that the application can be recovered when necessary. Backups can be configured to use Azure Storage and can be scheduled according to application requirements. This capability is useful before major deployments, configuration changes, or other operations where recovery may be necessary. Health Check serves a different purpose by monitoring application availability, while Application Insights provides application telemetry and diagnostics. A proper backup strategy should also consider retention requirements, storage configuration, restore testing, and whether all required application data is included in the selected backup configuration.

Q389. An App Service application requires HTTPS using a custom domain. Which configuration is required to secure the custom domain with TLS?

1) Configure an SSL/TLS certificate binding for the custom domain
2) Enable a Queue trigger
3) Configure an Event Grid subscription
4) Create an Azure Table Storage entity

Correct Answer: 1)

Explanation:

An App Service custom domain can be secured with HTTPS by configuring an appropriate SSL/TLS certificate and binding it to the custom domain. The certificate allows encrypted communication between clients and the application and helps establish the identity of the website through the configured domain. App Service supports several certificate management approaches, including managed certificates and certificates uploaded or imported according to the application’s requirements. Simply configuring a custom domain does not automatically provide all the required certificate configuration. Developers should verify DNS settings, domain ownership, certificate validity, and HTTPS binding so that users can securely access the application.

Q390. A development team needs to grant a CI/CD process access to only one repository in Azure Container Registry rather than the entire registry. Which feature is most appropriate?

1) Registry-wide Administrator account
2) Repository-scoped access token
3) Anonymous access
4) Storage account key

Correct Answer: 2)

Explanation:

Azure Container Registry supports repository-scoped access tokens that can provide more granular permissions than registry-wide administrative credentials. This approach allows an organization to grant a CI/CD process access to only the repository or repositories required for its operation. Permissions can be designed around actions such as pulling or pushing images, reducing unnecessary privileges. A registry-wide administrator account provides broader access and should generally be avoided when a narrower permission model is possible. Repository-scoped access is especially useful for multi-team environments where different pipelines should manage separate repositories without receiving unnecessary permissions over unrelated container images.

Q391. An organization deploys container images to users in multiple geographic regions and wants registry content replicated closer to those regions. Which Azure Container Registry capability should be used?

1) ACR Tasks
2) ACR geo-replication
3) Kubernetes ConfigMap
4) App Service deployment slots

Correct Answer: 2)

Explanation:

Azure Container Registry geo-replication allows a container registry to maintain replicas of registry content across selected Azure regions. This can improve image pull performance for globally distributed deployments because container images can be retrieved from a geographically closer registry replica. It is particularly useful when applications run across multiple regions or when development and production environments are distributed geographically. ACR Tasks automates container image builds and related registry workflows, but it does not provide geographic replication. By using geo-replication, organizations can improve availability and reduce network latency when distributed compute platforms such as AKS need to retrieve container images.

Q392. A development team wants Azure Container Registry to automatically notify an external system whenever a container image is pushed. Which feature should be used?

1) ACR webhook
2) ACR geo-replication
3) Azure Storage lifecycle policy
4) Kubernetes Secret

Correct Answer: 1)

Explanation:

Azure Container Registry webhooks can send notifications when specified registry events occur, such as pushing or deleting an image. A webhook can notify an external endpoint so that another system can respond to the registry event. This can support automation scenarios such as triggering deployment workflows, updating external systems, or starting validation processes after an image is published. Geo-replication serves a different purpose by distributing registry content across regions. Kubernetes Secrets store sensitive configuration within Kubernetes environments, while lifecycle policies are used to manage storage objects. Webhooks are therefore appropriate when an external service needs to react to container registry events automatically.

Q393. An AKS cluster needs to add or remove nodes based on resource demand, while individual workloads should increase or decrease the number of pod replicas. Which combination should be used?

1) HPA for nodes and cluster autoscaler for pods
2) Cluster autoscaler for nodes and HPA for pods
3) ConfigMap for nodes and Secret for pods
4) Ingress for nodes and Service for pods

Correct Answer: 2)

Explanation:

The AKS cluster autoscaler and Kubernetes Horizontal Pod Autoscaler solve different scaling requirements. The cluster autoscaler adjusts the number of nodes in the Kubernetes cluster when additional capacity is required or when nodes become unnecessary. The Horizontal Pod Autoscaler, or HPA, adjusts the number of pod replicas for a workload based on configured metrics such as CPU or memory utilization. These mechanisms can work together: HPA increases pod replicas when application demand rises, and the cluster autoscaler can add nodes if the existing cluster lacks capacity to schedule those pods. This combination supports efficient scaling at both the workload and infrastructure levels.

Q394. A Kubernetes container may take several minutes to initialize before it is ready to run normally. Which probe is designed to determine whether the application has completed startup?

1) Startup probe
2) Readiness probe
3) Service probe
4) Ingress probe

Correct Answer: 1)

Explanation:

A Kubernetes startup probe determines whether a containerized application has successfully started. It is particularly useful for applications that require significant initialization time. While the startup probe is failing, Kubernetes can delay the normal liveness and readiness checks, preventing the application from being incorrectly restarted before it has completed initialization. A readiness probe instead determines whether a running container is ready to receive traffic. A liveness probe determines whether the container should be restarted because it is no longer functioning properly. Using a startup probe is therefore valuable for protecting slow-starting applications from premature health-check failures and unnecessary restarts.

Q395. A Kubernetes application requires guaranteed CPU and memory resources for scheduling purposes. Which configuration should be specified in the container definition?

1) Resource requests
2) Resource labels
3) Ingress rules
4) ConfigMap entries

Correct Answer: 1)

Explanation:

Kubernetes resource requests specify the amount of CPU and memory that a container requires for scheduling purposes. The Kubernetes scheduler uses these requests when determining which node has sufficient available capacity to place a pod. Resource limits serve a different purpose by defining the maximum amount of a resource that a container can consume. Properly configuring requests helps ensure that workloads are scheduled onto nodes with adequate capacity and makes resource management more predictable. Requests are especially important in production AKS environments where multiple workloads compete for cluster resources. They can also work with autoscaling mechanisms to support more reliable workload placement and scaling.

Q396. An AKS application must remain available during voluntary disruptions such as node maintenance. Which Kubernetes resource can limit the number of simultaneously disrupted pods?

1) ConfigMap
2) PersistentVolume
3) Pod Disruption Budget
4) Kubernetes Secret

Correct Answer: 3)

Explanation:

A Kubernetes Pod Disruption Budget, or PDB, helps maintain application availability during voluntary disruptions such as planned node maintenance or cluster operations. A PDB specifies constraints on how many replicas of an application can be unavailable at the same time. For example, an application can require a minimum number of available replicas while nodes are being drained. This helps prevent maintenance activities from removing too many application instances simultaneously. A PDB does not directly control unexpected failures, such as hardware crashes. ConfigMaps store configuration data, Secrets store sensitive information, and PersistentVolumes provide storage, so they do not provide the same availability protection during voluntary disruptions.

Q397. A deployment team wants to determine whether a Kubernetes Deployment has successfully completed its rollout. Which command is most appropriate?

1) kubectl get nodes
2) kubectl describe service
3) kubectl rollout status
4) kubectl get configmap

Correct Answer: 3)

Explanation:

The kubectl rollout status command is used to monitor the progress of a Kubernetes Deployment rollout. It can show whether the updated replicas have become available and whether the deployment has successfully completed. This is useful in CI/CD pipelines because automation can wait for the rollout to finish before continuing with subsequent deployment steps. Other kubectl commands can provide information about nodes, services, or configuration objects, but they do not directly provide rollout status for a Deployment. Developers can also use related rollout commands to inspect rollout history or perform a rollback when an updated application version causes problems.

Q398. An application stores frequently requested data in Azure Cache for Redis. A cached item should automatically disappear after 30 minutes if it is not refreshed. Which feature should be configured?

1) Redis key expiration
2) Kubernetes HPA
3) Azure SQL Query Store
4) ACR webhook

Correct Answer: 1)

Explanation:

Redis key expiration allows cached values to automatically expire after a specified period. Setting an expiration time, such as 30 minutes, helps prevent stale data from remaining in the cache indefinitely. This is particularly useful for temporary application data, session-related information, frequently changing results, and cache-aside implementations. When a key expires, the application can retrieve fresh data from the underlying data source and optionally place the updated value back into Redis. Azure Cache for Redis provides managed Redis capabilities, while HPA, Query Store, and ACR webhooks address Kubernetes scaling, SQL performance analysis, and container registry events respectively.

Q399. A developer wants to identify expensive queries and examine query execution performance over time in Azure SQL Database. Which feature should be used?

1) Azure Front Door
2) Azure SQL Query Store
3) Azure Queue Storage
4) Azure Event Grid

Correct Answer: 2)

Explanation:

Azure SQL Query Store collects query execution information and helps developers and database administrators analyze query performance over time. It can provide information about query execution statistics, plans, and performance changes, making it useful for identifying expensive or regressed queries. Query Store can help determine whether a query became slower after a change and can support performance troubleshooting and optimization activities. Azure Front Door handles global web traffic routing, Queue Storage provides messaging, and Event Grid distributes event notifications. For an Azure SQL Database workload where the primary requirement is understanding query performance and identifying problematic execution behavior, Query Store is the appropriate feature.

Q400. A web application needs temporary, limited access to Azure Blob Storage without exposing the storage account key. Which option should be used?

1) Storage account administrator credentials
2) Public anonymous access
3) User delegation SAS
4) Permanent access key

Correct Answer: 3)

Explanation:

A user delegation SAS provides time-limited and permission-scoped access to Azure Blob Storage without requiring the application to expose the storage account key. It is authorized through Microsoft Entra credentials and can specify restrictions such as the resources, permissions, and validity period of the token. This makes it useful when an application needs to allow a client to upload or download specific blobs temporarily. Compared with exposing a storage account key, a scoped SAS reduces the potential impact of credential compromise. Applications should still protect SAS tokens carefully, use short expiration periods where practical, and grant only the permissions required for the intended operation.