CertArea
All Microsoft exams

Free AZ-204 practice test: 30 questions with answers

30 original questions for Developing Solutions for Microsoft Azure, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions

AZ-204 exam guide: topics, cost and format

All 30 AZ-204 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Develop Azure compute solutions (6 questions)

  1. Question 1

    A team needs to run a containerised HTTP API that scales to zero when idle and requires no cluster management. Which service fits best?

    1. AAzure Virtual Machines with a manually configured Docker host that stays running overnight and at weekends
    2. BAzure Kubernetes Service with a fixed node pool that must keep running at all times, even when no requests arrive
    3. CAzure Container Apps, which runs containers with managed scaling, including scale to zero for HTTP workloads
    4. DAzure Batch, which is designed for running large parallel compute jobs rather than serving HTTP requests from users
    Show answer and explanation
    Correct answer: C

    Container Apps provides managed scaling, including scale to zero, for HTTP workloads without cluster management. AKS keeps nodes running, virtual machines need manual management, and Batch targets batch jobs rather than serving requests.

  2. Question 2

    Which Azure CLI sequence publishes a locally built container image to Azure Container Registry?

    1. Aaz container create with the local image path as its source, which deploys the container straight from the workstation
    2. Baz acr login to authenticate, then docker push of the tagged image to the registry's login server
    3. Caz webapp deploy with the image tag passed as a local file parameter, which uploads the image to the app's storage
    4. Daz storage blob upload of the image layers into a storage account container, which is later read by the registry
    Show answer and explanation
    Correct answer: B

    az acr login authenticates Docker to the registry, and docker push sends the tagged image to the login server. Container instance creation, web app deployment and blob upload do not publish the image to the registry.

  3. Question 3

    An App Service web app must send traffic to a new version and be able to roll back quickly if problems appear. Which feature should be used?

    1. ADeleting the production app and recreating it from the new code package at each release, so that no state remains
    2. BA second App Service plan in another region, which requires separate DNS changes for every release that is made
    3. CDeployment slots, which let a staging slot be swapped into production and swapped back if problems occur
    4. DEnabling autoscaling with a higher minimum instance count to absorb any load while the release is being made
    Show answer and explanation
    Correct answer: C

    Deployment slots allow a warm staging slot to be swapped into production and back again for a fast rollback. The other options add DNS work, cause downtime or do not provide a rollback path.

  4. Question 4

    Which Azure Functions trigger runs a function on a fixed schedule?

    1. ATimer trigger, which runs the function on a CRON schedule defined in its configuration
    2. BHTTP trigger, which runs the function whenever an HTTP request is received at the function's endpoint
    3. CBlob trigger, which runs the function when a new or changed blob appears in a monitored storage container
    4. DService Bus trigger, which runs the function when a message arrives on a queue or a topic subscription that it watches
    Show answer and explanation
    Correct answer: A

    A timer trigger runs on a CRON schedule. HTTP, blob and Service Bus triggers fire on requests, storage changes and messages respectively.

  5. Question 5

    A function must write its output to a Cosmos DB container without the function body containing SDK calls. Which feature provides this?

    1. AA timer trigger, which writes data to the container each time the schedule fires inside the function app that runs it
    2. BA Cosmos DB output binding, which writes the function's returned value to a container declared in the configuration
    3. CA Blob output binding, which writes data to a storage container rather than to a Cosmos DB container at any time
    4. DA managed identity, which authorises the function to write to any database without any binding configuration being declared
    Show answer and explanation
    Correct answer: B

    Output bindings declare where a function's output goes, so the code does not need SDK calls. Timers, blob bindings and identities do not perform that Cosmos DB write declaratively.

  6. Question 6

    Which setting controls the number of instances that an App Service plan scales between automatically?

    1. AThe App Service plan's region, which determines how many instances the platform is willing to run for the plan at any time
    2. BThe autoscale rules with minimum, maximum and default instance counts for the plan
    3. CThe TLS version setting, which determines how many instances can handle encrypted traffic simultaneously during peak load periods
    4. DThe deployment slot name, which sets the instance count for each slot separately within the app's portfolio of environments
    Show answer and explanation
    Correct answer: B

    Autoscale rules define minimum, maximum and default instance counts. Region, TLS version and slot names do not set scaling bounds.

Connect to and consume Azure services and third-party services (6 questions)

  1. Question 7

    Which Azure API Management policy limits how many calls a client can make during a period?

    1. AThe cache-lookup policy, which returns cached responses but does not restrict how many calls clients are allowed to make
    2. BThe set-header policy, which adds or changes HTTP headers in requests and responses but does not limit how many calls are made
    3. CThe rate-limit or quota policy, which restricts calls per key or subscription over a defined time period
    4. DThe mock-response policy, which returns fixed responses for testing and does not restrict calls by client in production use
    Show answer and explanation
    Correct answer: C

    Rate-limit and quota policies restrict call volume per key or subscription over time. Header, caching and mock policies serve other purposes.

  2. Question 8

    Which service should an event-driven app use to react to events such as a blob being created, with a lightweight push model?

    1. AAzure Event Hubs, which ingests large streams of events for pull-based processing by consumer groups over partitions
    2. BAzure Event Grid, which routes events from sources to handlers using a push model
    3. CAzure Queue Storage, which holds messages for later processing by polling consumers in an ordered queue of work items
    4. DThe Cosmos DB change feed, which streams changes for consumers that read the feed themselves at their own pace
    Show answer and explanation
    Correct answer: B

    Event Grid routes discrete events to handlers with push delivery, which suits reacting to a blob being created. Event Hubs, queues and the change feed are pull-based streams or queues.

  3. Question 9

    Which service is best for high-throughput telemetry ingestion where consumers read the stream at their own pace?

    1. AAzure Event Grid, which routes discrete events to subscribers with push delivery rather than storing a stream for later reads
    2. BAzure Event Hubs, which ingests large volumes of events through partitions, with consumer groups reading them at their own pace
    3. CAzure Service Bus topics, which deliver messages with transactional guarantees for enterprise workflows rather than telemetry
    4. DAzure Logic Apps, which runs scheduled workflows that call APIs step by step as the workflow has been designed to run
    Show answer and explanation
    Correct answer: B

    Event Hubs is built for high-volume ingestion with partitions and consumer groups that read at their own pace. Event Grid, Service Bus and Logic Apps serve different patterns.

  4. Question 10

    Which service provides ordered, transactional messaging with dead-lettering for business workflows?

    1. AAzure Service Bus, which offers queues and topics with sessions, transactions and dead-letter queues
    2. BAzure Blob Storage, which stores files and does not provide any message queuing semantics for business workflows at all
    3. CAzure Event Grid, which routes events with retry but does not offer sessions or transactional message workflows for business
    4. DAzure Cache for Redis, which caches data in memory and does not guarantee the delivery of messages for business processes
    Show answer and explanation
    Correct answer: A

    Service Bus provides sessions, transactions and dead-letter queues for business workflows. The other services do not offer that messaging model.

  5. Question 11

    Which Queue Storage feature hides a dequeued message from other consumers while one consumer is processing it?

    1. AThe visibility timeout, which hides a dequeued message from other consumers for a set period
    2. BThe message time-to-live, which deletes the message after a fixed time regardless of whether it has been processed yet
    3. CThe poison-message queue, which stores messages that failed processing after a set number of attempts for later review
    4. DThe queue metadata, which stores the name and creation date of the queue for the administrators to see in the portal
    Show answer and explanation
    Correct answer: A

    The visibility timeout hides a message while it is being processed, which prevents duplicate work. Time-to-live, poison queues and queue metadata serve other purposes.

  6. Question 12

    Which API Management component publishes APIs for developers to discover, read and try?

    1. AA self-hosted runtime for an event hub, which hosts the event consumers for the developer teams in the organisation
    2. BThe gateway only, which routes requests to backends but provides no documentation or subscription interface for developers at all
    3. CThe developer portal, which publishes API documentation and lets developers subscribe to and test the APIs
    4. DAn Azure Monitor workbook, which shows dashboards of API usage for the operations staff only and not for the developers
    Show answer and explanation
    Correct answer: C

    The developer portal publishes documentation and supports subscription and testing for developers. The gateway routes traffic without a discovery interface, and event hub runtimes and monitor workbooks serve other purposes.

Develop for Azure storage (6 questions)

  1. Question 13

    Which Cosmos DB consistency level gives the strongest guarantee that reads return the most recent committed write?

    1. AEventual consistency, which allows reads to return older values for a period and offers the lowest latency of the levels
    2. BStrong consistency, which guarantees that reads return the most recent committed write, at some latency cost
    3. CSession consistency, which guarantees consistency within a single session but is weaker across different sessions of users
    4. DConsistent prefix, which guarantees that reads never see writes out of order but may be behind the latest committed write
    Show answer and explanation
    Correct answer: B

    Strong consistency guarantees reads return the latest committed write, which is the strongest level. The others trade that guarantee for lower latency or session-scoped behaviour.

  2. Question 14

    A Cosmos DB application must react to new and updated items in a container. Which feature should be used?

    1. AMulti-region writes, which allow writes in several regions so that users in each region experience better availability
    2. BPoint-in-time restore, which recovers the database to an earlier time after the accidental deletion of data
    3. CThe change feed, which provides a sorted stream of inserts and updates that consumers can process
    4. DAutoscale throughput, which adjusts the request units available to the container during periods of heavier load
    Show answer and explanation
    Correct answer: C

    The change feed provides an ordered stream of inserts and updates for consumers to process. Restore, multi-region writes and autoscale solve different problems.

  3. Question 15

    Which Blob Storage feature moves older blobs to a cooler tier or deletes them automatically, based on their age?

    1. AA shared access signature with a long expiry, which grants access to blobs for a long period without changing their tier
    2. BSoft delete for containers, which keeps deleted containers for a period but does not move blobs between access tiers
    3. CBlob versioning only, which keeps earlier versions of blobs but does not change their tier or delete them by age
    4. DLifecycle management policies, which transition or delete blobs according to rules based on age or last access
    Show answer and explanation
    Correct answer: D

    Lifecycle management policies move or delete blobs based on rules such as age or last access. Soft delete, versioning and long-lived SAS tokens do not do this.

  4. Question 16

    A client needs to upload one file to a specific blob for 15 minutes without holding an Azure account. Which approach fits?

    1. ACreating a managed identity for the client, which requires the client to sign in to Entra ID before any upload is allowed
    2. BGiving the client the storage account key, which provides access to every container in the account for the upload
    3. CMaking the container public so that anyone can upload to any blob in it during the upload window that is open
    4. DA user delegation or service SAS with write permission on that blob and an expiry time of 15 minutes
    Show answer and explanation
    Correct answer: D

    A SAS scoped to one blob with write permission and a 15-minute expiry gives time-limited access without an account. Account keys, public containers and managed identities are too broad or require sign-in.

  5. Question 17

    Which two practices are recommended when working with Cosmos DB? (Choose two.)

    1. AChoose a partition key that distributes writes and queries evenly across the logical partitions of the container
    2. BUse a single partition key value for all items, so that queries across the whole container are simpler to write
    3. CStore large binary files inside each Cosmos DB item, since the database is designed to hold files of any size
    4. DDisable indexing on every property, to reduce the write cost in all scenarios regardless of the query patterns used
    5. EReuse a single Cosmos DB client instance across requests, rather than creating a new client for each request
    Show answer and explanation
    Correct answer: A, E

    A well-distributed partition key and a reused client are recommended practices. A single partition key value creates hot partitions, large binaries and disabled indexing are poor choices for typical workloads.

  6. Question 18

    Which Cosmos DB feature replicates data to a second region so that reads stay available there?

    1. AThe change feed, which streams changes to consumers in the same region but does not replicate the data itself to other regions
    2. BGlobal distribution with additional read regions, which replicates data to chosen regions for low-latency reads
    3. CAnalytical storage, which keeps a column-oriented copy of the data for analytics but does not replicate it for reads in regions
    4. DAutoscale throughput, which adjusts the request units of a container but does not replicate the data across regions at all
    Show answer and explanation
    Correct answer: B

    Global distribution with additional read regions replicates data for regional reads. The change feed, analytical storage and autoscale do not replicate data across regions for reads.

Implement Azure security (6 questions)

  1. Question 19

    Which approach lets an app read Key Vault secrets without storing credentials in its code or configuration?

    1. AA personal access token in the application's configuration file, which the developer renews by hand whenever it expires
    2. BA plain text connection string stored in the code file, which the team rotates manually each quarter of the year
    3. CA shared access signature embedded in the source repository, which expires after one year of use by the team
    4. DA managed identity assigned to the app, granted a Key Vault access role or policy for the secrets it needs
    Show answer and explanation
    Correct answer: D

    A managed identity lets the app authenticate to Key Vault without stored credentials, and an access role limits what it can read. Embedded connection strings, repository SAS tokens and personal tokens all store credentials.

  2. Question 20

    Which protocols does the Microsoft identity platform use to authenticate users for web apps and APIs?

    1. ALDAP bind over an open port with anonymous access, which the directory allows for every application that connects
    2. BTelnet, which carries the user's credentials in clear text over a terminal session opened on the server by the user
    3. CFTP with a shared username, which is used for file transfer rather than the authentication of apps and their users
    4. DOpenID Connect and OAuth 2.0
    Show answer and explanation
    Correct answer: D

    The Microsoft identity platform uses OpenID Connect for sign-in and OAuth 2.0 for authorisation. Telnet, FTP and anonymous LDAP are not appropriate authentication protocols for this purpose.

  3. Question 21

    Which Microsoft Graph permission type lets a background service act without a signed-in user?

    1. AApplication permissions, which allow the app to act with its own identity without a signed-in user present
    2. BDelegated permissions, which allow the app to act only on behalf of a signed-in user who has consented to the access
    3. CPersonal permissions, which apply only to the developer's own mailbox and not to the mailboxes of any other users
    4. DGuest permissions, which apply only to external users who have been invited into the tenant for collaboration purposes
    Show answer and explanation
    Correct answer: A

    Application permissions let a background service act with its own identity. Delegated permissions need a signed-in user, and the other two options are not Graph permission types.

  4. Question 22

    Which control best protects the secrets that an app reads from Key Vault or App Configuration?

    1. AStoring the secrets as tags on the resource group, which are visible to every reader of the group across the portfolio
    2. BA public network setting that allows anyone on the internet to read the secrets without any form of authentication
    3. CRole-based access control on the vault or configuration store, granting only the identities that need each secret
    4. DDisabling soft delete on the vault, which makes the secrets easier to read for the audit team when they review the vault
    Show answer and explanation
    Correct answer: C

    RBAC limits reads to the identities that need each secret, which is the core protection. Public access, tags and disabled soft delete each expose or weaken the secrets.

  5. Question 23

    Which two statements about Azure Key Vault are correct? (Choose two.)

    1. ASoft delete and purge protection help protect secrets from accidental or malicious deletion
    2. BSecrets can be retrieved in plain text by anyone who has read access to the resource group that contains the vault
    3. CKeys in Key Vault can be used for cryptographic operations without exposing the private key material outside the vault
    4. DKey Vault stores secrets only in the region of the subscription and cannot be accessed from any other region at all
    5. ECertificates in Key Vault cannot be renewed automatically, so they must always be replaced by hand each time they expire
    Show answer and explanation
    Correct answer: A, C

    Soft delete and purge protection guard against deletion, and keys can be used without exporting private material. Resource group read access does not grant secret reads, and certificates can be renewed automatically.

  6. Question 24

    Which Entra ID flow is recommended for a single-page app that calls an API on behalf of a signed-in user?

    1. AResource owner password credentials, which send the user's password to the app so that it can request tokens directly
    2. BImplicit flow, with access tokens returned in the URL fragment, which is the recommended option for all single-page apps
    3. CAuthorization code flow with PKCE, which the app uses to obtain tokens for the API without a client secret
    4. DClient credentials flow, which authenticates the app only and does not act on behalf of a signed-in user at any point
    Show answer and explanation
    Correct answer: C

    Authorization code with PKCE is the recommended flow for single-page apps acting for a user. Implicit flow, password grants and client credentials are not appropriate for that case.

Monitor and troubleshoot Azure solutions (6 questions)

  1. Question 25

    Which Application Insights feature runs scheduled requests from several locations to check that an endpoint responds?

    1. AAvailability tests, which run from multiple locations on a schedule and alert when the endpoint fails
    2. BLive Metrics only, which streams the telemetry of running instances but does not send requests itself to endpoints
    3. CProfiler, which samples the running code to find slow methods but does not check the availability of an endpoint
    4. DSmart detection of anomalies in exceptions, which alerts on unusual patterns but does not probe the endpoint itself
    Show answer and explanation
    Correct answer: A

    Availability tests probe endpoints from several locations on a schedule and alert on failures. Live Metrics, Profiler and smart detection do not probe endpoints in that way.

  2. Question 26

    Which Application Insights table in Log Analytics stores incoming request telemetry?

    1. Aheartbeat, which records only the periodic signal that the agent sends when the host is still alive and running
    2. BcustomMetrics only, which stores the custom metric values emitted by the code of the application being monitored
    3. CavailabilityResults, which records only the results of the availability tests that run from the configured test locations
    4. Drequests, which records incoming request telemetry such as duration, result code and URL
    Show answer and explanation
    Correct answer: D

    The requests table holds incoming request telemetry. The other tables hold custom metrics, availability results and heartbeats.

  3. Question 27

    Which change lets a .NET app send telemetry to Application Insights without changing its business logic?

    1. AAdding the Application Insights SDK or auto-instrumentation, so that requests, dependencies and exceptions are collected
    2. BRemoving all logging calls from the code so that telemetry is sent automatically without any SDK or configuration at all
    3. CChanging the database connection string to point at the Application Insights workspace in the cloud subscription
    4. DEnabling Cosmos DB change feed on the app's storage account to forward telemetry to Application Insights as it arrives
    Show answer and explanation
    Correct answer: A

    Adding the SDK or auto-instrumentation collects telemetry without changing business logic. Removing logs, changing connection strings and change feeds do not send telemetry to Application Insights.

  4. Question 28

    Which Kusto Query Language operator filters the rows of a table based on a condition?

    1. Arender, which draws a chart of the results and does not filter rows as part of the query pipeline
    2. Bproject, which only selects columns and does not filter the rows of the table at all in the query pipeline
    3. Csummarize, which aggregates rows but does not filter them on a predicate before the aggregation takes place
    4. Dwhere, which filters rows of a table based on a predicate
    Show answer and explanation
    Correct answer: D

    The where operator filters rows by predicate. Project selects columns, summarize aggregates and render charts.

  5. Question 29

    Which Application Insights feature shows the end-to-end path of a request across services?

    1. AThe availability test history, which lists the results of each probe but does not trace the requests between the services
    2. BLive Metrics only, which shows the current counts of requests and failures but not the path a request takes between services
    3. CThe cost analysis of the Application Insights resource, which shows the spend on each table in the workspace each month
    4. DTransaction search and end-to-end transaction details, which show the dependencies and calls across components
    Show answer and explanation
    Correct answer: D

    Transaction search with end-to-end details shows the path of a request through dependencies and components. Live Metrics, cost analysis and availability history do not trace requests.

  6. Question 30

    Which alert type fires when a metric crosses a threshold over a time window?

    1. AAn activity log alert, which fires on control-plane events such as resource changes but not on metric thresholds at all
    2. BA log search alert, which evaluates only the results of a query and cannot evaluate platform metrics directly at all
    3. CA metric alert rule, which evaluates a metric against a threshold over a configured time window
    4. DA service health alert, which fires when Azure reports a platform incident affecting the services of the subscription
    Show answer and explanation
    Correct answer: C

    A metric alert rule evaluates a metric against a threshold over a window. Log search, activity log and service health alerts respond to other signals.