AZ-204 — Azure Developer Associate

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. 1. A developer needs to push a custom Docker image to a private registry so it can be pulled by Azure Container Instances. Which Azure service should they use as the registry?

   • A. Azure Blob Storage with public access enabled
   • B. Azure Container Registry(correct)
   • C. Azure Kubernetes Service
   • D. Azure App Service Environment

   Explanation: Azure Container Registry (ACR) is the Azure-native private registry for building, storing, and managing container images. It integrates directly with Azure Container Instances and other Azure services. Blob Storage is not a container registry. AKS is a container orchestration platform, not a registry. App Service Environment is a hosting environment, not a registry.

2. 2. A team wants to run a short-lived containerized batch job that processes a file and exits. The job does not require persistent orchestration or load balancing. Which Azure compute service is the most cost-effective choice?

   • A. Azure Kubernetes Service
   • B. Azure Virtual Machines
   • C. Azure Container Instances(correct)
   • D. Azure App Service

   Explanation: Azure Container Instances (ACI) is purpose-built for running short-lived, isolated containers without managing infrastructure. You pay per second for the duration the container runs, making it ideal for batch jobs. AKS adds unnecessary orchestration overhead. Virtual Machines require OS management and incur higher base costs. App Service is designed for long-running web applications, not batch processing.

3. 3. Contoso Ltd. hosts a web API on Azure App Service. During peak hours, CPU usage reaches 90% and response times degrade. The team wants the App Service plan to automatically add instances when CPU exceeds 70%. Which feature should the developer configure?

   • A. Deployment slots with traffic splitting
   • B. Autoscaling based on a CPU percentage metric rule(correct)
   • C. A scheduled scale-out set to run at peak hours
   • D. Upgrading the App Service plan tier and manually adding instances

   Explanation: Azure App Service supports autoscaling rules based on metrics such as CPU percentage. Configuring an autoscale rule that triggers a scale-out action when average CPU exceeds 70% allows the platform to dynamically add instances during load spikes. Deployment slots are for zero-downtime deployments, not load-based scaling. Scheduled scaling works for predictable patterns but not dynamic CPU-driven load. Manual scaling requires human intervention and cannot respond to real-time demand.

4. 4. A developer is implementing an Azure Functions app that must be triggered every time a new message arrives in an Azure Queue Storage queue. Which trigger type should be used?

   • A. HTTP trigger
   • B. Timer trigger
   • C. Queue Storage trigger(correct)
   • D. Event Grid trigger

   Explanation: The Azure Queue Storage trigger automatically invokes the function whenever a new message is added to the specified queue. HTTP triggers require an inbound HTTP request. Timer triggers fire on a schedule rather than in response to queue messages. Event Grid triggers respond to Event Grid events, not directly to Queue Storage messages.

5. 5. A developer is configuring an Azure Functions app. Which TWO binding types can be configured as output bindings to write data from a function to an external service? Choose 2.

   • A. Azure Blob Storage output binding(correct)
   • B. HTTP trigger
   • C. Azure Service Bus output binding(correct)
   • D. Timer trigger
   • E. Azure Cosmos DB trigger

   Explanation: Azure Functions supports output bindings that send data to external services declaratively without writing SDK code. Blob Storage and Service Bus are both supported as output bindings, enabling the function to write blobs or send messages. HTTP trigger and Timer trigger are triggers (input side), not output bindings. The Cosmos DB trigger fires when documents change — it is not an output binding.

6. 6. Fabrikam's microservices team is adopting Azure Container Apps. They need each microservice to scale independently, communicate over a private virtual network, and support Dapr for service invocation. A solution architect notes that they should NOT use Azure Kubernetes Service because the team lacks Kubernetes expertise. Which Azure Container Apps configuration meets all requirements?

   • A. Deploy each microservice as a separate Container App with Dapr enabled; host the environment with a custom virtual network(correct)
   • B. Deploy all microservices in a single Container App as multiple containers sharing one replica
   • C. Use Azure Container Instances with a sidecar container running Dapr
   • D. Use Azure App Service with a Docker Compose file to run microservices side-by-side

   Explanation: Azure Container Apps natively supports Dapr integration at the Container App level, allowing each microservice to be its own Container App with independent scaling rules. A Container Apps environment can be deployed into a custom virtual network for private communications. Deploying all microservices as containers in a single Container App defeats independent scaling. ACI does not support Dapr natively or Container App environments. App Service with Docker Compose does not provide independent scaling per service or native Dapr support.

7. 7. A developer needs to deploy a new version of an Azure App Service web app with zero downtime and the ability to roll back instantly if issues are detected. Which built-in feature of Azure App Service should be used?

   • A. Configure a WebJob to swap configuration files at deployment time
   • B. Use deployment slots and swap the staging slot to production after validation(correct)
   • C. Enable continuous deployment from GitHub and rely on the automatic rollback webhook
   • D. Deploy to a new App Service plan and update DNS to point to it

   Explanation: Deployment slots allow deploying to a staging slot, testing the new version in a production-equivalent environment, and then performing an atomic slot swap that routes traffic to the new version with zero downtime. If a problem is detected, swapping the slots back immediately achieves instant rollback. WebJobs are background tasks, not deployment mechanisms. Continuous deployment from GitHub does not provide built-in instant rollback. DNS-based cutover has propagation delay and cannot achieve instant rollback.

8. 8. A developer is using the Azure Cosmos DB SDK to read an item. The application requires the most up-to-date value and can tolerate slightly higher latency. Which consistency level should be set on the read operation?

   • A. Eventual
   • B. Consistent Prefix
   • C. Strong(correct)
   • D. Session

   Explanation: Strong consistency guarantees that a read always returns the most recently committed write. It provides the highest data accuracy at the cost of higher read latency because the system must confirm the write has been replicated before returning a response. Eventual consistency offers the lowest latency but may return stale data. Consistent Prefix ensures ordered reads but not the latest write. Session consistency is scoped to a session and does not guarantee globally up-to-date reads.

9. 9. A developer needs to automatically archive Azure Blob Storage blobs that have not been accessed for 90 days to the Archive tier. What is the correct mechanism to configure in Azure Blob Storage?

   • A. Create an Azure Function on a timer that scans blobs and changes their tier
   • B. Configure a lifecycle management policy rule that transitions blobs to Archive after 90 days without access(correct)
   • C. Enable blob versioning and set the version retention to 90 days
   • D. Use Azure Data Factory to copy blobs to an Archive-tier storage account after 90 days

   Explanation: Azure Blob Storage lifecycle management policies let you define rules that automatically transition blobs between tiers (Hot, Cool, Cold, Archive) or delete them based on last-modified or last-access time. This is the native, serverless mechanism for this requirement. An Azure Function could work but adds unnecessary complexity and cost compared to the built-in policy. Blob versioning controls data protection, not tiering. Data Factory is an ETL service, not a storage lifecycle manager.

10. 10. An application reads blob metadata to determine file ownership before processing. The developer wants to add a custom metadata key called 'owner' to an existing blob without re-uploading the blob content. Which SDK method achieves this?

    • A. Upload the blob again with the metadata included in the upload options
    • B. Call SetMetadataAsync on the BlobClient with the updated metadata dictionary(correct)
    • C. Call SetHttpHeadersAsync to add the owner header
    • D. Use the Azure portal to re-create the blob with metadata

    Explanation: The Azure Blob Storage SDK exposes SetMetadataAsync (or SetMetadata in synchronous form) on the BlobClient to update user-defined metadata on an existing blob without touching its content. SetHttpHeadersAsync sets system HTTP headers like Content-Type, not user-defined metadata. Re-uploading the blob is wasteful and replaces the blob content. Using the portal to re-create the blob would delete the existing content.

11. 11. A developer is implementing Azure Cosmos DB change feed in a .NET application to process order events in real time. Which statement accurately describes the change feed behavior?

    • A. The change feed includes all create and delete operations on items in the container
    • B. The change feed includes creates and updates but does not include deletes by default(correct)
    • C. The change feed is only available when using the SQL API
    • D. The change feed delivers changes in random order and must be sorted by the application

    Explanation: By default, the Azure Cosmos DB change feed captures create and update operations for each item in the container. Delete operations are not included by default; to capture deletes, a soft-delete pattern (adding a deleted flag and TTL) must be used. The change feed is available across multiple Cosmos DB APIs, not only SQL API. Changes are delivered in the order they were modified within each logical partition.

12. 12. A developer is designing a Cosmos DB container for a multi-tenant e-commerce application. Each tenant has thousands of orders. The application frequently queries orders by tenantId and orderId together. Which partition key choice minimizes cross-partition queries while ensuring even data distribution?

    • A. /orderId
    • B. /category
    • C. /tenantId(correct)
    • D. /createdDate

    Explanation: Using /tenantId as the partition key groups all orders for a tenant in the same logical partition, eliminating cross-partition fan-out for the most common query pattern (filter by tenantId). Since there are many tenants, the key has high cardinality, enabling even distribution across physical partitions. Using /orderId spreads orders across many partitions, making tenant-level queries cross-partition. /category has low cardinality and creates hot partitions. /createdDate clusters data by time, creating uneven write distribution as new orders concentrate in one partition.

13. 13. A developer needs to allow a web application running on Azure App Service to read secrets from Azure Key Vault without storing any credentials in code or configuration files. Which approach should be used?

    • A. Store the Key Vault client secret in the App Service application settings
    • B. Enable a system-assigned Managed Identity on the App Service and grant it access to Key Vault(correct)
    • C. Use a shared access signature (SAS) token to authenticate with Key Vault
    • D. Embed the Key Vault certificate thumbprint in the application code

    Explanation: Managed Identities for Azure resources allow App Service to authenticate to Azure Key Vault using its Azure AD identity without requiring any credentials in code or configuration. The platform manages the identity token automatically. Storing a client secret in application settings still places a secret in configuration. Key Vault does not support SAS token authentication. Hardcoding a certificate thumbprint still requires managing the certificate and does not eliminate credential management.

14. 14. A developer needs to provide a third-party vendor read-only access to a specific Azure Blob Storage container for exactly 24 hours. The vendor should not require an Azure AD account. Which mechanism should the developer use?

    • A. Assign the Storage Blob Data Reader role to the vendor's email address
    • B. Create a service SAS (Shared Access Signature) scoped to the container with a 24-hour expiry and read permission(correct)
    • C. Enable public access on the container
    • D. Share the storage account access key with the vendor

    Explanation: A Shared Access Signature (SAS) token can be scoped to a specific container, granted only read permission, and set to expire after 24 hours — all without requiring the vendor to have an Azure AD identity. RBAC role assignments (A) require an Azure AD identity. Enabling public container access (C) grants unrestricted anonymous access beyond the required 24 hours with no scoping. Sharing the storage account key (D) grants full control over the entire account permanently, violating the principle of least privilege.

15. 15. Northwind Traders' API needs to call Microsoft Graph to read user profile information. The API runs as a background service with no signed-in user. Which OAuth 2.0 flow should the developer implement to acquire a token from Microsoft Entra ID?

    • A. Authorization Code flow with PKCE
    • B. Client Credentials flow(correct)
    • C. Device Code flow
    • D. Resource Owner Password Credentials flow

    Explanation: The Client Credentials flow is designed for daemon and service-to-service scenarios where no user is present. The application authenticates with its own client ID and secret (or certificate) to obtain an access token representing the application itself. Authorization Code with PKCE is for user-interactive flows in public clients. Device Code flow is for devices without a browser. Resource Owner Password Credentials is deprecated and requires the user's credentials, which is not applicable for a background service.

16. 16. A developer stores an RSA private key in Azure Key Vault as a Key object. The application must sign data without the private key ever leaving Key Vault. Which SDK operation should the developer call?

    • A. Download the key bytes using GetKey, then sign locally
    • B. Call the Sign operation on the CryptographyClient using the Key Vault key identifier(correct)
    • C. Export the key to a local X.509 certificate and use System.Security.Cryptography
    • D. Use Azure Blob Storage with server-side encryption to sign the payload

    Explanation: The CryptographyClient in the Azure Key Vault SDK wraps cryptographic operations by sending the data to Key Vault's HSM-backed service to perform the signing operation server-side. The private key material never leaves the secure boundary of Key Vault. Options A and C both involve exporting or downloading the key material, which defeats the security guarantee of Key Vault. Blob Storage server-side encryption is a data-at-rest encryption feature, not a signing operation.

17. 17. A developer is implementing solutions that interact with Microsoft Graph. Which TWO Microsoft Graph capabilities are directly accessible through the Graph SDK? Choose 2.

    • A. Reading and writing Azure AD user profiles(correct)
    • B. Provisioning Azure Virtual Machines
    • C. Sending emails via the Outlook Mail API(correct)
    • D. Managing Azure Blob Storage containers
    • E. Scaling Azure App Service plans

    Explanation: Microsoft Graph exposes a unified REST endpoint for Microsoft 365 and Azure AD data. Reading/writing user profiles in Azure AD and sending emails via the Outlook Mail API are canonical Graph use cases. Provisioning VMs, managing Blob Storage, and scaling App Service plans are Azure Resource Manager operations exposed through the Azure REST API and SDKs — not Microsoft Graph.

18. 18. A developer wants to detect when an Azure App Service application throws unhandled exceptions and receive an alert within minutes. Which Azure Monitor Application Insights feature should be configured?

    • A. Azure Advisor recommendations
    • B. Availability tests
    • C. Smart Detection and alert rules on exception rate metrics(correct)
    • D. Azure Service Health alerts

    Explanation: Application Insights collects exception telemetry and exposes exception rate as a metric. Alert rules can be created on this metric to notify the team when the exception rate exceeds a threshold. Smart Detection also proactively identifies anomalies in exception rates. Availability tests check external endpoint reachability, not application exceptions. Azure Advisor provides cost and best-practice recommendations, not real-time exception alerts. Service Health monitors Azure platform incidents, not application-level errors.

19. 19. A .NET microservice runs on Azure App Service. The team notices that latency spikes occur intermittently, but the service's logs do not capture enough detail to identify the root cause. A developer needs to trace individual HTTP requests across the service without re-deploying the application. Which Application Insights capability enables this with the least code change?

    • A. Add Console.WriteLine statements and stream them via Kudu
    • B. Enable Application Insights auto-instrumentation (codeless attach) for the App Service(correct)
    • C. Deploy a separate Log Analytics workspace and forward IIS logs
    • D. Add a custom EventSource and configure Azure Diagnostics extension

    Explanation: Application Insights auto-instrumentation (codeless attach) can be enabled directly in the Azure portal for App Service without modifying or redeploying application code. It automatically captures HTTP request traces, dependencies, and performance counters. Console logging (A) does not produce structured traces and requires redeploy to add context. Forwarding IIS logs to Log Analytics (C) requires more setup and provides less request-level detail. Custom EventSource with Azure Diagnostics (D) requires significant code changes and redeployment.

20. 20. A developer wants to apply a rate-limiting policy to an API exposed through Azure API Management so that each subscriber cannot make more than 100 calls per minute. Which APIM policy should be used?

    • A. quota policy
    • B. rate-limit-by-key policy(correct)
    • C. rewrite-uri policy
    • D. set-backend-service policy

    Explanation: The rate-limit-by-key policy in Azure API Management throttles calls based on a key (such as the subscription key) and enforces a limit of N calls per time window. The quota policy limits the total number of calls or bandwidth over a longer period (e.g., per month) but does not control per-minute rates. The rewrite-uri policy modifies the request URL. The set-backend-service policy changes the backend endpoint and has nothing to do with rate limiting.

21. 21. A developer needs to route events from multiple Azure services to a serverless function for real-time processing. The events are heterogeneous (blob created, resource group deleted, custom events). Which Azure service is best suited as the event router?

    • A. Azure Service Bus
    • B. Azure Event Grid(correct)
    • C. Azure Event Hubs
    • D. Azure Queue Storage

    Explanation: Azure Event Grid is a fully managed event routing service that natively integrates with Azure resource events (blob created, resource group changes, etc.) and supports custom events. It delivers events to subscribers such as Azure Functions with low latency in a push model. Service Bus is a message broker for enterprise messaging, not event routing. Event Hubs is optimized for high-throughput event streaming (telemetry ingestion), not heterogeneous routing. Queue Storage is a simple FIFO queue without eventing semantics.

22. 22. A developer is comparing Azure Service Bus and Azure Queue Storage. Which TWO statements are TRUE about Azure Service Bus compared to Azure Queue Storage? Choose 2.

    • A. Service Bus supports message sessions for FIFO ordering within a group(correct)
    • B. Service Bus queues have a maximum message size of 64 KB
    • C. Service Bus supports dead-letter queues for undeliverable messages(correct)
    • D. Service Bus stores messages using Azure Blob Storage internally
    • E. Queue Storage messages expire after a maximum of 7 days

    Explanation: Azure Service Bus supports message sessions to guarantee FIFO ordering within a session group, and it provides built-in dead-letter queues (DLQ) where undeliverable or expired messages are automatically moved. Service Bus supports message sizes up to 256 KB (standard tier) or 100 MB (premium tier), not 64 KB. Service Bus does not use Blob Storage internally. The 7-day maximum TTL is a feature of Azure Queue Storage, not Service Bus.

23. 23. A developer is creating an Azure API Management (APIM) instance and needs to expose an existing REST API with auto-generated interactive documentation. Which APIM feature should be used to import the API definition and generate the developer portal documentation?

    • A. Import the API from an OpenAPI (Swagger) specification(correct)
    • B. Create a new blank API and manually add each operation
    • C. Use the APIM rewrite-uri policy to document routes
    • D. Deploy an Azure Logic App and connect it to APIM via a webhook

    Explanation: Azure API Management supports importing APIs directly from an OpenAPI (formerly Swagger) specification file or URL. This automatically creates operations, parameter definitions, and response schemas and populates the developer portal with interactive documentation. Manually adding operations (B) is error-prone and does not auto-generate documentation. The rewrite-uri policy modifies request URLs and has nothing to do with documentation. Logic Apps connected via webhooks do not generate REST API documentation.

24. 24. Contoso processes 500,000 IoT telemetry events per second and needs to retain them for 7 days for downstream batch analytics. Multiple consumer groups must read from the same event stream independently. The solution must handle backpressure and allow replay of historical events. Which service best meets these requirements?

    • A. Azure Service Bus Premium with 1,000 sessions
    • B. Azure Event Grid with retry policies
    • C. Azure Event Hubs with a 7-day retention period(correct)
    • D. Azure Queue Storage with a visibility timeout

    Explanation: Azure Event Hubs is designed for high-throughput event streaming, supporting millions of events per second with configurable retention periods (up to 90 days on standard/premium tiers). Multiple consumer groups can independently read the same stream at their own pace, and any consumer can replay from any offset within the retention window. Service Bus is an enterprise message broker optimized for transactional messaging, not high-throughput streaming with replay. Event Grid is push-based with no long-term retention or replay capability. Queue Storage does not support consumer groups or event replay.

25. 25. A developer configures Azure Queue Storage to decouple a web front-end from a background worker. Which TWO statements accurately describe Azure Queue Storage behavior? Choose 2.

    • A. A message retrieved by a consumer becomes invisible to other consumers for a configurable visibility timeout period(correct)
    • B. Azure Queue Storage supports publish/subscribe fan-out to multiple consumers simultaneously
    • C. Messages can have a maximum size of 64 KB(correct)
    • D. Queue Storage supports ordering guarantees across all messages
    • E. Messages that exceed their maximum time-to-live are automatically deleted

    Explanation: When a consumer retrieves a message from Azure Queue Storage, the message becomes invisible for a configurable visibility timeout (default 30 seconds), preventing other consumers from processing it concurrently. Individual messages are capped at 64 KB. Queue Storage does not support pub/sub fan-out — it is a point-to-point queue. Queue Storage provides best-effort ordering but does not guarantee strict FIFO across all messages. Messages do expire after their TTL, but the statement asks about TTL expiry causing automatic deletion, which is true — however option E is accurate too; the exam expects A and C as the canonical two statements tested here based on the SDK topic.