Free Microsoft AZ-204 Practice Test Questions MCQs

Explanation:
This question tests your knowledge of Azure Storage account types and lifecycle management policies. The requirements include 5-year data retention, cost minimization for data over 1 year old, and Zone Redundant Storage (ZRS) implementation. You need to select the correct storage account type and the appropriate lifecycle management configuration.

Correct Option:

Storage Account Type: Implement StorageV2 (general purpose v2)
General purpose v2 storage accounts are required for lifecycle management policies and support Zone Redundant Storage (ZRS). They provide the lowest access costs, support all storage tiers (hot, cool, archive), and are recommended by Microsoft for most scenarios. GPv1 accounts don't support lifecycle management or tiering, making them unsuitable for cost optimization requirements.

Lifecycle Management: Set a lifecycle management policy to move blobs to the archive tier
Moving blobs older than one year directly to the archive tier provides maximum cost savings. The archive tier offers the lowest storage cost at $0.00099/GB/month compared to cool tier at $0.01/GB/month. This meets both requirements: cost minimization and 5-year retention. Archive tier is ideal for long-term retention of infrequently accessed data.

Incorrect Option:

Storage Account Type: Implement Storage (general purpose v1)
GPv1 accounts don't support ZRS, lifecycle management policies, or blob tiering. They cannot meet the Zone Redundant Storage requirement and provide no mechanism for cost-optimized tiering. These accounts are legacy and primarily used for classic deployments or specific compatibility scenarios.

Storage Account Type: Implement Azure Cosmos DB/Blob Storage
These are not storage account types. Azure Cosmos DB is a NoSQL database service, and Blob Storage is a feature within storage accounts, not an account type itself. The question specifically asks for storage account configuration.

Lifecycle Management: Snapshot blobs and move them to the archive tier
While snapshots provide point-in-time copies, they incur additional storage costs and require manual management. Lifecycle policies are automated and more cost-effective. Microsoft recommends lifecycle policies over manual snapshot management for long-term retention scenarios.

Lifecycle Management: Set a lifecycle management policy to move blobs to the cool tier
Cool tier is designed for data stored for at least 30 days, but it's more expensive than archive tier ($0.01/GB vs $0.00099/GB). For data over one year old, archive tier provides 90% cost reduction compared to cool tier, better meeting the "minimize costs" requirement.

Lifecycle Management: Use AzCopy to copy data to on-premises device
AzCopy is a data transfer tool, not a retention/cost optimization solution. This would move data out of Azure, incurring egress charges and not meeting the requirement to retain copies in Azure for five years.

Reference:
Azure Storage account overview

Explanation:
This question tests your understanding of User Delegation SAS tokens and how to revoke them in Azure Blob Storage. User Delegation SAS tokens are secured with Azure AD credentials and do not rely on storage account keys. Understanding the revocation mechanisms is critical for security incident response in Azure Storage scenarios.

Correct Option:

A. Revoke the delegation keys
User Delegation SAS tokens are signed using user delegation keys. These keys are temporary credentials obtained from Azure AD. Revoking the delegation keys immediately invalidates all SAS tokens generated using those keys. This is a direct and effective method to revoke compromised User Delegation SAS tokens.

B. Delete the stored access policy
While stored access policies are primarily associated with Service SAS, User Delegation SAS can also be linked to them. If the User Delegation SAS was created with a stored access policy identifier, deleting that policy immediately revokes all SAS tokens associated with it. This provides centralized revocation management.

Incorrect Option:

C. Regenerate the account key
User Delegation SAS tokens do not use account keys for signing. They are signed with Azure AD user delegation keys. Regenerating account keys would affect Service SAS and account SAS but has no impact on User Delegation SAS tokens. This action is unnecessary and ineffective for User Delegation SAS revocation.

D. Remove the role assignment for the security principal
Removing role assignments prevents future authorization but does not revoke already issued User Delegation SAS tokens. The tokens remain valid until their expiry or until the user delegation key is revoked. This addresses future access but not the immediate threat of a compromised token.

Reference:
Create a user delegation SAS

Explanation:
This question tests your knowledge of implementing feature flags in ASP.NET Core using Azure App Configuration. The exhibit shows a feature flag named Export with a label Off. The markup requires the feature to be conditionally rendered using . You must select the correct controller attribute and the correct App Configuration endpoint to enable feature management.

Correct Option:

Controller attribute: FeatureGate
FeatureGate is the correct attribute to filter controller actions or views based on feature flag status. It evaluates whether the feature is enabled and allows or blocks access accordingly. This aligns with the requirement to use the feature in the app via the provided markup.

Startup method: AddAzureAppConfiguration
AddAzureAppConfiguration is the method used in Startup.ConfigureServices to load configuration and feature flags from Azure App Configuration. It is required to enable dynamic feature flag evaluation and refresh in ASP.NET Core.

AppConfig endpoint setting: https://appfeatureflagstore.azconfig.io
This is the App Configuration endpoint for the store named AppreaiureflagStore. It follows the standard pattern of https://.azconfig.io. This is where the application connects to retrieve feature flags and configuration data.

Incorrect Option:

Controller attribute: Route
Route is used for URL routing and endpoint mapping, not for feature flag evaluation. It does not provide any conditional logic based on feature flags.

Controller attribute: ServiceFilter / TypeFilter
These attributes are used to apply filters to controllers or actions, such as authorization or action filters. They do not evaluate feature flags and are not designed for feature flag–based conditional rendering.

Startup method: AddControllersWithViews
This method adds MVC services to the container but does not load Azure App Configuration or feature flags. It is not related to feature flag integration.

Startup method: AddUserSecrets
This is used to load secrets during development from the local secrets store. It is not relevant for loading feature flags from Azure App Configuration.

AppConfig endpoint setting: https://appfeatureflagstore.vault.azure.net
This is a Key Vault endpoint, not an App Configuration endpoint. It is used for accessing secrets, not feature flags.

AppConfig endpoint setting: https://export.azconfig.io / https://exportvault.azure.net
These do not match the naming convention of the actual store (AppreaiureflagStore). export is the feature flag name, not the store name. Using these endpoints would fail to connect to the correct App Configuration resource.

Referene:
Use feature flags in ASP.NET Core

FeatureGate attribute

Connect to App Configuration

Explanation:
This question tests your knowledge of Azure CDN rules engine and device detection. The requirement is to identify iPhone users and redirect them to the app store. Azure CDN Premium from Verizon provides device detection capabilities through the IsDevice condition. The correct condition type and parameters must be selected to match iPhone traffic based on the user agent.

Correct Option:

Condition name: DeliveryRuleIsDeviceConditionParameters
The IsDevice condition is specifically designed for device detection in Azure CDN. It identifies requests from mobile devices, tablets, desktops, or specific device types like iPhone. This is the only condition that directly supports detecting iPhone users without custom header parsing.

Condition parameters: DeliveryRulesDeviceConditionParameters
This matches the exhibit where the @odata.type shows #Microsoft.Azure.Cdn.Models.DeliveryRulesDeviceConditionParameters. This parameter type is required for the IsDevice condition to evaluate device type properties. It supports operators like "Equal" and match values such as "iOS", "Mobile", "iPhone", etc.

Incorrect Option:

Condition name: DeliveryRuleRequestHeaderConditionParameters
This condition evaluates HTTP request headers but requires manual configuration of specific header names and values. While you could theoretically check HTTP_USER_AGENT, this approach is less reliable and more complex than using the built-in IsDevice condition. It also doesn't match the exhibit which shows IsDevice as the condition name.

Condition parameters: DeliveryRuleCookiesConditionParameters / DeliveryRulePostArgsConditionParameters
Cookie and POST arguments conditions are unrelated to device detection. They evaluate cookie values and POST request body parameters respectively. These cannot identify iPhone users and are completely irrelevant for this redirect scenario.

Reference:
Azure CDN rules engine device detection

Azure CDN rules engine conditions

Set device detection for Azure CDN

Explanation:
This question tests your knowledge of recovering Azure VMs stuck in Windows Update pending state. When a VM fails to boot due to pending updates, you must attach the OS disk to a recovery VM, identify the problematic update, remove it, and then reattach the disk. The correct sequence follows Azure VM recovery best practices for Windows Update failures.

Correct Order:

1. Detach the OS disk and recreate the VM.
This is the initial recovery step. First, delete the original VM but retain its OS disk. This stops billing and allows the disk to be attached to a recovery VM for offline repair. The OS disk remains intact in the storage account.

2. Run the following command at an elevated command prompt:

cd /s /d "C:\temp\patch.txt" /get-packages > C:\temp\Patch.txt

After attaching the OS disk to the recovery VM, mount it as a data disk. Navigate to the mounted Windows directory and export the list of installed packages to identify the pending update. This generates an inventory of updates needing removal.

3. Open C:\temp\Patch.txt file and locate the update that is in a pending state. Review the exported package list to find the specific update stuck in pending state. Look for packages with status indicating pending installation or removal. This identifies the exact package name needed for removal.

4. Run the following command at an elevated command prompt:
cd /s /d "C:\temp\patch.txt" //Remove-Package /PackageName=...

With the problematic update identified, execute the package removal command. This removes the pending update from the offline Windows installation. After completion, detach the disk from recovery VM and recreate the original VM.

Incorrect Option Placement:
The commands cannot run before attaching the OS disk to the recovery VM

Package list must be generated before identifying the specific update

Removal command requires the exact package name from the analysis phase

Reference:
Troubleshoot Azure VM startup issues

Remove Windows updates offline

Attach OS disk to recovery VM

Explanation:
This question tests your knowledge of Azure Cosmos DB APIs and their data modeling capabilities. The requirement specifies that the app will process batches of relational data. While Cosmos DB is a NoSQL database, the Core (SQL) API provides the most flexible querying capabilities including JOINs, subqueries, and complex filtering that can accommodate relational-like data structures within JSON documents.

Correct Option:

C. Core (SQL) API
The Core (SQL) API is the native API for Azure Cosmos DB. It supports querying JSON documents using SQL syntax, including JOIN operations, subqueries, and complex projections. This makes it the best choice when working with relational data patterns that need to be modeled in a NoSQL database. It also provides the richest query functionality, SDK support, and integration with Azure services.

Incorrect Option:

A. MongoDB API
MongoDB API provides wire protocol compatibility with MongoDB but is designed for document storage with MongoDB-style queries. While it supports embedded documents and arrays, it does not provide native SQL-like JOIN capabilities for relational data patterns and is better suited for existing MongoDB workloads.

B. Table API
Table API is designed for key-attribute-store scenarios with simple lookup patterns. It supports only point reads and limited range queries. It does not support JOINs, complex queries, or relational data modeling. This API is intended for migrating Azure Table Storage workloads, not for processing relational data batches.

D. Cassandra API
Cassandra API is a wide-column store designed for high-scale, high-availability scenarios with denormalized data models. It supports CQL (Cassandra Query Language) but does not support JOINs or complex relational queries. It is optimized for write-heavy workloads with simple partition key-based access patterns.

Reference:

Azure Cosmos DB Core (SQL) API

Choose an API in Azure Cosmos DB

SQL JOIN queries in Cosmos DB

Explanation:
This question tests your understanding of authentication flow in Azure App Service when using multiple identity providers. The app uses Twitter as the identity provider but also has an Azure AD app registration. When Azure App Service handles authentication, it injects user claims into the X-MS-CLIENT-PRINCIPAL header. The question asks what to validate in the app code specifically for the Azure AD request.

Correct Option:

B. ID token header
When using App Service Authentication, Azure AD tokens are passed in the X-MS-TOKEN-AAD-ID-TOKEN header. The application code should validate this ID token header to verify the authenticity of the Azure AD request. The ID token contains claims about the authenticated user and is issued by Azure AD. Validating the token header ensures the request originates from a legitimate Azure AD authentication flow through App Service.

Incorrect Option:

A. HTTP response code
HTTP response codes indicate the status of the HTTP request itself (200, 401, 403, etc.) but do not provide any authentication or identity validation. Response codes cannot verify the authenticity of a user or token and are not used to validate Azure AD requests in application code.

C. ID token signature
While signature validation is important for token verification in general, when using App Service Authentication, the platform already validates the token signature before forwarding requests to your application. The app code receives the already-validated token header and does not need to perform cryptographic signature validation. This is handled by the App Service authentication layer.

D. Tenant ID
Tenant ID identifies which Azure AD directory issued the token. While this can be checked as an additional authorization constraint, it is not the primary validation required for the Azure AD request itself. The question asks what to validate in the app code for the request, and the immediate validation point is the presence and content of the ID token header.

Reference:
Work with user identities in Azure App Service authentication

Access user claims in App Service

Azure App Service authentication and authorization

Explanation:
This question tests your knowledge of Azure Storage account types and lifecycle management requirements. GPv1 Premium storage accounts do not support lifecycle management policies or blob tiering. To implement a rule that moves blobs to archive tier after one year, you must first migrate to a GPv2 account with the appropriate tier support. The correct sequence ensures both compatibility and cost optimization.

Correct Order:

1. Create a new GPv2 Standard account and set its default access tier level to cool
GPv2 Standard accounts support lifecycle management and all access tiers (hot, cool, archive). Setting the default tier to cool is appropriate for data older than three months that is rarely used but must be available immediately when accessed. This provides cost savings while maintaining low-latency access.

2. Copy the data to be archived to a Standard GPv2 storage account and then delete the data from the original storage account
Since you cannot convert a Premium GPv1 account directly to GPv2 with tiering support and data migration without downtime or manual effort is required, you must copy the existing blobs to the new GPv2 account. After successful copy and validation, delete the data from the original GPv1 Premium account to avoid duplicate costs.

3. Set a lifecycle management policy to move blobs to the archive tier
Once data resides in the GPv2 Standard account, you can configure a lifecycle management rule targeting blobs not modified in the last year. The rule transitions these blobs from cool (or hot) to archive tier, meeting the requirement to save data older than a year without immediate availability needs, while minimizing storage costs.

Incorrect Action Placement:
Upgrade the storage account to GPv2 – GPv1 Premium accounts cannot be upgraded directly to GPv2. You must create a new GPv2 account and migrate data. Change the storage account access tier from hot to cool – This action is not possible in GPv1 Premium accounts as they do not support access tiers. This would fail if attempted.

Reference:
Azure Storage account overview

Lifecycle management policy support

Migrate to GPv2 storage account

Explanation:
This question tests your knowledge of distributed tracing and correlation in Application Insights with OpenTelemetry-compliant services. The requirement is to associate the customer ID of the signed-in user with all operations throughout the overall system — including Azure SQL, Blob Storage, and external HTTP services. This requires propagating user context across service boundaries using correlation context, not modifying trace IDs or span context directly.

Correct Option:

C. Add the customer ID for the signed in user to the CorrelationContext in the web application.
CorrelationContext (or Baggage in OpenTelemetry) is designed to propagate key-value pairs across service boundaries. Adding the customer ID to CorrelationContext ensures it is attached to all outgoing requests, logs, dependencies, and traces throughout the distributed system. This allows end-to-end correlation of user activity across Azure SQL, Blob Storage, and external OpenTelemetry-compliant services without breaking trace integrity.

Incorrect Option:

A. Create a new SpanContext with the TraceFlags value set to the customer ID for the signed in user.
TraceFlags is a byte field used for sampling decisions (e.g., recorded vs. not recorded), not for storing business context like customer IDs. Setting it to a customer ID is invalid and would break trace sampling behavior. SpanContext is also not intended for propagating user identifiers.

B. On the current SpanContext, set the TraceId to the customer ID for the signed in user.
TraceId is a globally unique 128-bit identifier for a trace, generated by the system. Manually setting it to a customer ID violates the OpenTelemetry specification, breaks trace hierarchy, and prevents proper distributed tracing. TraceId must remain system-generated and unique per trace.

D. Set the header Ocp-Apim-Trace to the customer ID for the signed in user.
Ocp-Apim-Trace is an Azure API Management header used for debugging and tracing API requests within APIM only. It is not recognized by Application Insights, Azure SQL, Blob Storage, or OpenTelemetry SDKs, and does not propagate user context across the overall system.

Reference:
Custom operations and correlation in Application Insights
OpenTelemetry Baggage

Correlation headers for distributed tracing

Explanation:
This question tests your knowledge of Azure performance optimization techniques for internet-facing applications that rely on Azure SQL Database. The requirement is to improve the performance of an application accessed by many users. Azure Cache for Redis is a high-performance, low-latency caching solution that reduces database load and improves response times by storing frequently accessed data in memory.

Correct Option:

D. Azure Cache for Redis
Azure Cache for Redis provides in-memory data caching, significantly reducing latency and database read/write operations. For an application with many concurrent users accessing Azure SQL Database, implementing Redis cache for frequently queried data (such as lookups, session state, or read-heavy workloads) offloads database pressure and improves overall application responsiveness. It supports both caching and session state provider patterns.

Incorrect Option:

A. Azure HPC cache
Azure HPC Cache is designed for high-performance computing workloads, specifically to accelerate file access for Linux-based HPC applications. It is not intended for general web application scenarios or Azure SQL Database performance improvement. This is an over-engineered and incorrect solution for App1.

B. ExpressRoute
ExpressRoute provides private, dedicated network connectivity between on-premises infrastructure and Azure. Since App1 is accessed over the internet by many users, ExpressRoute does not improve performance for end-users connecting from public networks. It is also not a caching or query optimization solution.

C. a CON profile
This appears to be a typographical error in the question. If referring to CDN profile (Content Delivery Network), CDN is used for caching static content like images, CSS, and JavaScript files at edge locations. It does not cache dynamic database query results or improve Azure SQL Database performance. If referring to CNAME, it is a DNS record type, not a performance solution.

Reference:
Azure Cache for Redis

Caching guidance for Azure SQL Database