{"id":12840,"date":"2026-09-15T12:33:49","date_gmt":"2026-09-15T12:33:49","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=12840"},"modified":"2026-09-15T12:33:49","modified_gmt":"2026-09-15T12:33:49","slug":"microsoft-az-204-practice-test-questions-and-exam-dumps-part-19-q361-380","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-az-204-practice-test-questions-and-exam-dumps-part-19-q361-380\/","title":{"rendered":"Microsoft AZ-204 Practice Test Questions and Exam Dumps Part 19 Q361-380"},"content":{"rendered":"

View Full Microsoft AZ-204 Exam Dumps<\/a> and Practice Test Dumps<\/b><\/p>\n

 <\/p>\n

Q361. An Azure application needs to store application secrets such as database passwords and API keys securely. Which Azure service should be used?<\/b><\/p>\n

1)<\/b> Azure App Configuration<\/span>
\n<\/span>2)<\/b> Azure Key Vault<\/span>
\n<\/span>3)<\/b> Azure Queue Storage<\/span>
\n<\/span>4)<\/b> Azure Event Hubs<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Key Vault is designed to securely store and manage sensitive information such as secrets, encryption keys, and certificates. Applications can retrieve secrets from Key Vault at runtime instead of storing credentials directly in source code or configuration files. Access can be controlled through Microsoft Entra ID, Azure RBAC, and managed identities, reducing the need to manage long-lived credentials manually. Azure App Configuration is primarily intended for application settings and feature flags, while Queue Storage and Event Hubs support messaging and event-streaming scenarios. Key Vault is therefore the appropriate service for securely managing application secrets.<\/span><\/p>\n

Q362. A developer wants an Azure App Service application to retrieve secrets from Key Vault without storing a Key Vault credential in the application configuration. Which feature should be used?<\/b><\/p>\n

1)<\/b> Managed identity<\/span>
\n<\/span>2)<\/b> Deployment slot<\/span>
\n<\/span>3)<\/b> Autoscale<\/span>
\n<\/span>4)<\/b> Health Check<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A managed identity allows an App Service application to authenticate to Azure resources such as Key Vault without storing credentials in application code or configuration. The identity can be granted only the permissions required to retrieve specific secrets, supporting the principle of least privilege. This improves security because the application does not need to manage a client secret or other long-lived credential. Deployment slots support application deployment strategies, autoscale adjusts application capacity, and Health Check monitors application health. Managed identity is therefore the preferred authentication mechanism for secure App Service access to Key Vault.<\/span><\/p>\n

Q363. An application has configuration values that should be centrally managed and changed without rebuilding the application. Which Azure service is designed for this purpose?<\/b><\/p>\n

1)<\/b> Azure App Configuration<\/span>
\n<\/span>2)<\/b> Azure Container Registry<\/span>
\n<\/span>3)<\/b> Azure Event Hubs<\/span>
\n<\/span>4)<\/b> Azure Queue Storage<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure App Configuration provides a centralized store for application settings, feature flags, and other configuration data. It allows applications to retrieve configuration separately from application code, making it easier to manage settings across multiple environments and services. Configuration can be updated without rebuilding the application, depending on how the application implements configuration refresh. Azure Container Registry stores container images, Event Hubs handles high-throughput event ingestion, and Queue Storage provides asynchronous messaging. App Configuration is therefore the appropriate Azure service when centralized and dynamically manageable application configuration is required.<\/span><\/p>\n

Q364. A developer wants to enable or disable application functionality without redeploying the application. Which Azure App Configuration feature should be used?<\/b><\/p>\n

1)<\/b> Private Endpoint<\/span>
\n<\/span>2)<\/b> Feature flags<\/span>
\n<\/span>3)<\/b> Blob lifecycle management<\/span>
\n<\/span>4)<\/b> Service Bus sessions<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure App Configuration feature flags allow developers to control whether specific application functionality is enabled without requiring a new application deployment. Applications can evaluate feature flags during execution and change behavior according to the configured state and filters. This supports gradual feature releases, testing, controlled rollouts, and quick disabling of problematic functionality. Private Endpoints provide private network connectivity, Blob lifecycle management controls storage object transitions and deletion, and Service Bus sessions group related messages. Feature flags are therefore the appropriate App Configuration capability for controlling application features independently of deployments.<\/span><\/p>\n

Q365. A web application needs to distribute HTTP requests globally and route users to the most appropriate healthy backend. Which Azure service should be used?<\/b><\/p>\n

1)<\/b> Azure Queue Storage<\/span>
\n<\/span>2)<\/b> Azure Front Door<\/span>
\n<\/span>3)<\/b> Azure Table Storage<\/span>
\n<\/span>4)<\/b> Azure Key Vault<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Front Door provides global application delivery and HTTP\/HTTPS routing capabilities. It can route client requests to backend origins and use health probes to avoid sending traffic to unhealthy endpoints. Front Door is useful for globally distributed web applications that need improved availability, performance, and centralized traffic management. Queue Storage is designed for asynchronous messaging, Table Storage provides NoSQL data storage, and Key Vault manages secrets and cryptographic material. When an application requires global HTTP routing and intelligent traffic distribution across healthy backends, Azure Front Door is the appropriate service.<\/span><\/p>\n

Q366. An Azure Front Door deployment should stop routing requests to a backend when the backend fails its configured health checks. Which feature provides this capability?<\/b><\/p>\n

1)<\/b> Health probes<\/span>
\n<\/span>2)<\/b> Application settings<\/span>
\n<\/span>3)<\/b> Deployment slots<\/span>
\n<\/span>4)<\/b> Queue triggers<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Front Door health probes periodically check the health of configured backend origins. Front Door uses the results to determine whether an origin is available for traffic. When a backend fails health checks according to the configured health probe behavior, Front Door can avoid routing new requests to that unhealthy origin and instead use another healthy backend when available. Application settings configure application values, deployment slots provide separate App Service environments, and queue triggers are used by Azure Functions. Health probes are therefore essential when Front Door must make routing decisions based on backend availability.<\/span><\/p>\n

Q367. An application requires a globally distributed NoSQL database with automatic replication and multiple consistency options. Which Azure service is appropriate?<\/b><\/p>\n

1)<\/b> Azure SQL Database<\/span>
\n<\/span>2)<\/b> Azure Files<\/span>
\n<\/span>3)<\/b> Azure Cosmos DB<\/span>
\n<\/span>4)<\/b> Azure Queue Storage<\/span><\/p>\n

Correct Answer: 3)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Cosmos DB is a globally distributed NoSQL database service designed for applications that require scalable data storage and low-latency access across geographic regions. It supports multiple consistency models, allowing developers to select a balance between consistency, availability, and performance appropriate to their workload. Cosmos DB can also replicate data across regions and provide scalable throughput. Azure SQL Database is a relational database service, Azure Files provides managed file shares, and Queue Storage supports asynchronous messaging. For a globally distributed NoSQL workload with configurable consistency, Azure Cosmos DB is the appropriate choice.<\/span><\/p>\n

Q368. A Cosmos DB container stores customer documents. The application frequently retrieves documents using a unique customer ID and wants efficient point reads. Which information should be supplied for the most efficient lookup?<\/b><\/p>\n

1)<\/b> Only the document body<\/span>
\n<\/span>2)<\/b> Partition key value and item ID<\/span>
\n<\/span>3)<\/b> Database firewall rule<\/span>
\n<\/span>4)<\/b> Container TTL value<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Cosmos DB point read is most efficient when the application knows both the item’s unique ID and its partition key value. Supplying these values allows Cosmos DB to directly locate the item without performing a broader query across partitions. Point reads are generally more efficient than queries when the application already knows the exact item it needs. The document body is not sufficient for direct identification, while firewall configuration and TTL settings serve unrelated purposes. Developers should therefore design data access patterns so that frequently accessed items can be retrieved using their ID and partition key.<\/span><\/p>\n

Q369. A Cosmos DB application stores temporary session records that should automatically be removed after a specified period. Which feature should be configured?<\/b><\/p>\n

1)<\/b> Change feed<\/span>
\n<\/span>2)<\/b> Global distribution<\/span>
\n<\/span>3)<\/b> Time to Live (TTL)<\/span>
\n<\/span>4)<\/b> Strong consistency<\/span><\/p>\n

Correct Answer: 3)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cosmos DB Time to Live (TTL) allows items to be automatically deleted after a configured period. This is useful for temporary records such as session information, short-lived tokens, cached data, or event records that should not remain indefinitely. TTL can be configured at the container level and can also be controlled for individual items when appropriate. Change feed tracks changes for downstream processing, global distribution replicates data across regions, and consistency settings determine how reads observe writes. For automatic expiration of temporary Cosmos DB records, TTL is the appropriate feature.<\/span><\/p>\n

Q370. An application needs to react whenever documents are inserted or updated in a Cosmos DB container. Which feature should be used?<\/b><\/p>\n

1)<\/b> Change feed<\/span>
\n<\/span>2)<\/b> TTL<\/span>
\n<\/span>3)<\/b> Point-in-time restore<\/span>
\n<\/span>4)<\/b> Strong consistency<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Cosmos DB change feed provides an ordered record of changes to items in a container. Applications can consume these changes to trigger downstream processing, synchronize data, update search indexes, build event-driven workflows, or maintain derived data stores. The change feed is especially useful when an application needs to react to inserts and updates without repeatedly scanning the entire container. TTL automatically removes expired items, point-in-time restore addresses recovery scenarios, and consistency controls read behavior. Therefore, the Cosmos DB change feed is the appropriate feature for processing document changes.<\/span><\/p>\n

Q371. An Azure Storage account must remain available if an entire availability zone in the primary region becomes unavailable. Which redundancy option should be selected?<\/b><\/p>\n

1)<\/b> LRS<\/span>
\n<\/span>2)<\/b> ZRS<\/span>
\n<\/span>3)<\/b> GRS only<\/span>
\n<\/span>4)<\/b> Archive tier<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Zone-redundant storage (ZRS) replicates storage data synchronously across multiple availability zones within the primary Azure region. Because the data is distributed across separate zones, the storage service can remain available if one availability zone experiences an outage, depending on the specific service and configuration. Locally redundant storage keeps copies within a single availability zone or facility scope, while geo-redundant options additionally replicate data to another region. Archive is an access tier rather than a redundancy option. For protection against an availability-zone failure in the primary region, ZRS is the appropriate choice.<\/span><\/p>\n

Q372. A storage account should automatically move blobs that have not been accessed for a defined period to a lower-cost storage tier. Which Azure Storage capability should be configured?<\/b><\/p>\n

1)<\/b> Blob lifecycle management<\/span>
\n<\/span>2)<\/b> Blob lease<\/span>
\n<\/span>3)<\/b> Blob index tags<\/span>
\n<\/span>4)<\/b> Change feed<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Blob Storage lifecycle management allows rules to automatically transition blobs between access tiers or delete them according to conditions such as age, modification time, or access patterns where supported. This helps reduce storage costs by moving infrequently used data to more economical tiers while retaining it for future access. Blob leases are used for concurrency control, index tags help organize and query blob metadata, and change feed records blob changes. Lifecycle management is therefore the appropriate feature when blobs should automatically move to a lower-cost tier after meeting specified conditions.<\/span><\/p>\n

Q373. An application must prevent two workers from modifying the same Azure blob simultaneously. Which Blob Storage feature can provide temporary exclusive ownership?<\/b><\/p>\n

1)<\/b> Blob lease<\/span>
\n<\/span>2)<\/b> Lifecycle management<\/span>
\n<\/span>3)<\/b> Access tier<\/span>
\n<\/span>4)<\/b> Change feed<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

An Azure Blob Storage lease provides temporary exclusive access to a blob. An application can acquire a lease and use it as a coordination mechanism so that another worker cannot modify or delete the blob in conflicting ways while the lease is active, depending on the operation and lease conditions. This is useful for distributed applications where multiple workers may attempt to process the same object. Lifecycle management controls storage transitions, access tiers optimize storage cost and performance, and change feed tracks modifications. A blob lease is therefore appropriate for coordinating concurrent blob processing.<\/span><\/p>\n

Q374. An application needs to expose a containerized API through a stable network endpoint inside an AKS cluster. Which Kubernetes resource should be used?<\/b><\/p>\n

1)<\/b> Secret<\/span>
\n<\/span>2)<\/b> ConfigMap<\/span>
\n<\/span>3)<\/b> Service<\/span>
\n<\/span>4)<\/b> PersistentVolume<\/span><\/p>\n

Correct Answer: 3)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Kubernetes Service provides a stable network abstraction for accessing a group of Pods. Because Pod IP addresses can change when Pods are recreated or rescheduled, applications should generally communicate through a Service rather than relying directly on individual Pod addresses. A Service selects Pods using labels and provides a stable endpoint for clients inside or outside the cluster depending on its type. Secrets store sensitive data, ConfigMaps provide non-sensitive configuration, and PersistentVolumes provide storage. Therefore, a Kubernetes Service is the appropriate resource for exposing a stable network endpoint for an AKS workload.<\/span><\/p>\n

Q375. An AKS application needs configuration values such as an application mode and logging level, but the values are not sensitive. Which Kubernetes resource should store them?<\/b><\/p>\n

1)<\/b> Secret<\/span>
\n<\/span>2)<\/b> ConfigMap<\/span>
\n<\/span>3)<\/b> PersistentVolumeClaim<\/span>
\n<\/span>4)<\/b> Ingress<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Kubernetes ConfigMap is designed to store non-sensitive configuration data separately from container images. Applications can consume ConfigMap values through environment variables, command-line arguments, or mounted configuration files. This allows configuration to change without rebuilding the application image. Sensitive information such as passwords and tokens should instead be stored in Kubernetes Secrets. PersistentVolumeClaims request persistent storage, while Ingress manages HTTP and HTTPS routing. For values such as logging levels, application modes, and non-sensitive settings, ConfigMap is the appropriate Kubernetes resource.<\/span><\/p>\n

Q376. An AKS application requires persistent block storage that can be attached to a Pod and survive Pod recreation. Which Azure storage option is appropriate?<\/b><\/p>\n

1)<\/b> Azure Queue Storage<\/span>
\n<\/span>2)<\/b> Azure Managed Disk<\/span>
\n<\/span>3)<\/b> Azure Event Hubs<\/span>
\n<\/span>4)<\/b> Azure App Configuration<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

Azure Managed Disks can provide persistent block storage for AKS workloads through Kubernetes persistent storage mechanisms. The data remains available independently of the lifecycle of an individual Pod, allowing a replacement Pod to reconnect to persistent storage when the configuration and access mode support it. Queue Storage is designed for messages, Event Hubs provides event streaming, and App Configuration stores application configuration. Managed Disks are therefore appropriate when a workload requires persistent block-level storage rather than messaging, event streaming, or configuration management.<\/span><\/p>\n

Q377. A Kubernetes workload needs persistent storage and should request a specific amount of storage without directly managing the underlying disk resource. Which Kubernetes resource should be created?<\/b><\/p>\n

1)<\/b> PersistentVolumeClaim<\/span>
\n<\/span>2)<\/b> ConfigMap<\/span>
\n<\/span>3)<\/b> Service<\/span>
\n<\/span>4)<\/b> Ingress<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A PersistentVolumeClaim (PVC) allows a Kubernetes workload to request storage resources without directly managing the underlying PersistentVolume. The PVC can specify requirements such as storage capacity and access mode, and Kubernetes can bind it to a suitable PersistentVolume or dynamically provision storage when a compatible storage class is configured. ConfigMaps store non-sensitive configuration, Services provide networking, and Ingress handles HTTP routing. PVCs provide an abstraction between applications and storage infrastructure, making them the appropriate resource when a workload needs to request persistent storage.<\/span><\/p>\n

Q378. A Kubernetes deployment must maintain a specified number of running replicas and replace Pods when the application version changes. Which resource should manage this desired state?<\/b><\/p>\n

1)<\/b> Secret<\/span>
\n<\/span>2)<\/b> Deployment<\/span>
\n<\/span>3)<\/b> ConfigMap<\/span>
\n<\/span>4)<\/b> Service<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Kubernetes Deployment manages the desired state of a set of Pods and ReplicaSets. It can maintain a specified number of replicas and support controlled application updates when a new container image or configuration is deployed. Deployments can perform rolling updates so that existing Pods are gradually replaced by Pods running the new version. Secrets store sensitive information, ConfigMaps store ordinary configuration, and Services provide network access to Pods. Therefore, a Deployment is the appropriate Kubernetes resource for maintaining replicas and managing application version updates.<\/span><\/p>\n

Q379. An AKS deployment should gradually replace old Pods with new Pods during an application update to minimize downtime. Which deployment strategy should be used?<\/b><\/p>\n

1)<\/b> Rolling update<\/span>
\n<\/span>2)<\/b> Immediate deletion<\/span>
\n<\/span>3)<\/b> Manual database restore<\/span>
\n<\/span>4)<\/b> Queue-based deployment<\/span><\/p>\n

Correct Answer: 1)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

A Kubernetes rolling update gradually replaces existing Pods with new Pods running the updated application version. This allows part of the workload to remain available while the new version is introduced, reducing downtime and providing a controlled deployment process. Kubernetes Deployments support rolling updates through their update strategy and parameters that control how many Pods can be unavailable or created during the rollout. The strategy can also be monitored and rolled back when necessary. The other options do not represent standard Kubernetes application deployment strategies. Rolling updates are therefore appropriate for minimizing service disruption.<\/span><\/p>\n

Q380. An AKS administrator wants to automatically increase or decrease the number of Pods based on CPU utilization. Which Kubernetes feature should be configured?<\/b><\/p>\n

1)<\/b> Cluster autoscaler<\/span>
\n<\/span>2)<\/b> Horizontal Pod Autoscaler<\/span>
\n<\/span>3)<\/b> ConfigMap<\/span>
\n<\/span>4)<\/b> Ingress<\/span><\/p>\n

Correct Answer: 2)<\/b><\/p>\n

Explanation:<\/b><\/p>\n

The Kubernetes Horizontal Pod Autoscaler (HPA) automatically adjusts the number of Pod replicas according to observed resource utilization or other supported metrics. For example, an HPA can increase replicas when CPU utilization rises above a configured target and reduce replicas when demand falls. This allows an application workload to respond dynamically to changing demand. The cluster autoscaler operates at the node level by adjusting the number of cluster nodes, rather than directly changing Pod replicas. ConfigMaps store configuration, while Ingress manages HTTP routing. Therefore, HPA is the correct feature for automatic Pod scaling.<\/span><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

View Full Microsoft AZ-204 Exam Dumps and Practice Test Dumps   Q361. An Azure application needs to store application secrets such as database passwords and API keys securely. Which Azure service should be used? 1) Azure App Configuration 2) Azure Key Vault 3) Azure Queue Storage 4) Azure Event Hubs Correct Answer: 2) Explanation: Azure […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12840"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=12840"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12840\/revisions"}],"predecessor-version":[{"id":12844,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12840\/revisions\/12844"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=12840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=12840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=12840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}