AZ-204 practice questions
Microsoft · AZ-204 · 300 questions
Original practice questions for Exam AZ-204: Developing Solutions for Microsoft Azure, covering compute solutions with App Service, Azure Functions, and containers; data storage with Cosmos DB and Blob Storage; security with Microsoft Entra ID, Key Vault, and Managed Identities; monitoring with Application Insights; and integration via API Management, Event Grid, Event Hubs, and Service Bus.
This course contains the use of artificial intelligence.
About the AZ-204 exam
- Passing score
- 700 (scale 1-1000)
- Format
- Proctored, may include interactive components; 10 languages
Schedule this exam The certification this earns
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Develop Azure compute solutions · 89 questions
- A harbor-ferry ticketing team rebuilds the same Node image after every one-line route change and waits while package installs run again. Which Dockerfile change keeps the expensive OS and package layers cached across those frequent app edits?
- A municipal compost lab has a working image, but the container exits immediately because nothing declares the process the runtime should start. Which instruction family defines the default executable for the container?
- A seed-catalog API compiles with a heavy SDK image, then the team ships that entire SDK image to production and wonders why pulls are huge. What image-management approach shrinks the runtime artifact?
- A community-radio playlist service lists port 8080 in the Dockerfile, yet the host still cannot reach the listener. What does EXPOSE actually do versus what still must be configured at run time?
- A credit-union batch image must always start the same scanner binary, but testers want to override only the folder argument without rebuilding. How should ENTRYPOINT and CMD be assigned?
- A botanical-garden kiosk team says they “deployed the registry” after only tagging a local image, then later says “the image is running” when they mean a live instance. Which statement keeps image, container, and registry correctly apart?
- A folk-festival box-office service pins every environment to :latest, then a rollback cannot find the last good bits because the tag moved. Which image-management practice restores a reliable artifact pointer?
- A regional blood-bank courier app COPY-includes a .env file that holds a storage account key, and that layer is now in every registry replica. What is the correct image-hygiene fix at build time?
- A maple-syrup cooperative pushes a grader API image to Azure Container Registry and then waits for HTTPS traffic that never arrives. What role does ACR play versus the compute host?
- A county-clerk filing API builds locally as clerk-api:dev and docker push fails because the tag is not under the registry login server. What publish sequence should the developer follow?
- An oyster-farm sensor laptop has no local Docker daemon, but the team still needs the image in Azure Container Registry. Which approach builds and lands the image without a local daemon?
- A snow-plow depot’s Container Apps revision stores the ACR admin username and password in the app definition so every intern can read them. How should the host authenticate to pull from ACR instead?
- A public-library consortium wants the same container repository available in two Azure regions so App Service pulls stay local. Which ACR capability unlocks that multi-region pull pattern?
- A ferry-kiosk team created an Azure Container Registry, but ACI still cannot find ticket-ui because nothing matches the pull reference the host was given. What is the publish contract the runtime uses?
- A compost-lab CI job pushes a unique tag every hour and the Azure Container Registry balloons. Which developer hygiene control cleans up old published artifacts inside ACR?
- A botanical-garden team wants a Container Apps revision to refresh when a new tag lands in Azure Container Registry. What can ACR contribute, and what can it not do alone?
- A folk-festival needs a one-off Linux container this weekend to generate wristband PDFs, with no scale-out story and no cluster to operate. Which Azure compute choice fits best?
- A blood-bank nightly label job in Azure Container Instances must run once and stay stopped on success, but should retry if the process exits non-zero. Which restart policy matches that contract?
- A maple-grade API in Azure Container Instances needs GRADEREGION=north without rebuilding the image for every region. How should that value be supplied?
- A clerk-office scanner plus a tiny log sidecar must start and stop together and share one private network namespace on Azure Container Instances. How should the containers be deployed?
- The compost lab wants a Fluent Bit-style logging sidecar next to its grader container without adopting Kubernetes. What is the supporting-role pattern on Azure Container Instances?
- An oyster-farm importer writes nightly CSVs that disappear when the Azure Container Instances group restarts because the filesystem was ephemeral. How should the developer keep that state?
- A ferry kiosk bookmarks the Azure Container Instances public IP, then the group restarts during platform maintenance and the IP changes. What should clients use instead for a stabler public address?
- The snow-plow image lives in a private Azure Container Registry, and the Azure Container Instances group definition currently embeds the ACR admin password. How should the group authenticate for the pull instead?
- A public-radio newsroom wants several HTTP microservices that scale with traffic and require no node-pool administration. Which Azure container host should the developer choose?
- A credit-union team wants a public demo Container App to call Dapr building blocks used by the production card-dispute API. They propose placing the demo in the same Container Apps environment so both apps can “share Dapr.” What should the developer do?
- A botanical-garden ticketing API on Azure Container Apps must send 10 percent of live HTTP traffic to a new build while 90 percent stays on the last good revision. Which approach meets the requirement?
- A botanical garden’s public storefront Container App must be reachable on HTTPS from the Internet, while the pricing engine behind it must accept calls only from other apps in the same environment. How should ingress be configured?
- A folk-festival merch API on Azure Container Apps is idle most of the year and should scale to zero when there is no traffic. A second worker in the same environment must scale only on CPU utilization. Which statement is correct?
- A compost lab needs a container that processes a drop folder and exits, three times a day. The team does not want a 24×7 HTTP process with a minimum replica count. Which Azure Container Apps feature should they use?
- A blood-bank courier Container App still embeds the storage account key in a Dockerfile ENV instruction. The team needs to rotate the key without rebuilding image layers. What should the developer do?
- A municipal newsroom’s microservices on Azure Container Apps need service invocation and pub/sub without each team writing a custom HTTP client mesh. What is the appropriate way to add those building blocks?
- A county extension office creates a .NET Web App in the Azure portal and is surprised that deployment slots and certain scale options are missing. What did the team overlook?
- A seed-catalog team has a ready Linux image in Azure Container Registry and also a raw ASP.NET repository. At App Service create time, how should they choose the hosting model?
- A harbor-ferry schedule site on a lower-tier App Service plan sleeps after idle periods, so the first morning commuter hits a long cold start. What should the developer enable, and what constraint applies?
- A public-library catalog is a conventional multi-page web app that needs a custom domain, deployment slots, and app settings in the IIS-style App Service model. Which Azure compute option should the developer choose?
- A clerk-office team tries to host a Windows-only .NET Framework site on a Linux App Service plan, and the runtime never starts. What create-time decision caused the failure?
- A maple cooperative hosts its public storefront and an overnight import site on the same small App Service plan to save money. During imports the storefront becomes CPU-starved. What should the developer explain?
- A folk-festival box office on App Service shows HTTP 500 entries in the platform web-server log, but the ASP.NET exception text written through ILogger never appears. What should the developer enable?
- A blood-bank courier App Service site fails only while a tester is clicking through a multi-step form. The developer needs to watch application output during that live repro. Which approach fits best?
- One /renew path on a library catalog App Service site returns HTTP 500, and the ordinary HTTP log shows only the status code. Which App Service diagnostic should the developer enable for that failing request?
- A compost lab left App Service application logging on the local filesystem, filled the worker disk, and the site began returning errors. What should the developer change?
- A ferry team enables App Service diagnostic logging and claims their Domain 4 monitoring work is complete. How should a developer correct that claim?
- A county-extension .NET site has a published output folder and no container workflow. Which App Service deployment approach should the developer use?
- A seed-catalog Linux image already lives in Azure Container Registry. The team wants App Service to run that image. What should the developer configure?
- A garden ticketing container on App Service listens on port 3000, but the platform probes 80/8080 and marks the site unhealthy. What should the developer set?
- A radio newsroom connects an App Service web app to a GitHub repository so each push publishes the site. How should the developer describe that capability on the exam?
- A clerk-office zip extract left a half-written wwwroot after a failed copy, and users saw mixed old and new DLLs. Which App Service deployment approach avoids that partial-update problem?
- A maple cooperative pushes a new image over the same :latest tag in ACR, but the App Service container web app still runs yesterday’s bits. What should the developer do?
- A blood-bank App Service site stores DbPassword in a text file on the worker and CatalogEndpoint in source code. How should the developer store that configuration instead?
- A municipal ferry schedule site is live on the default azurewebsites.net hostname, but riders need schedule.harbor.example over HTTPS. What should the developer configure on the App Service web app?
- A credit-union auditor reports that outdated TLS 1.0 clients can still negotiate to the municipal dispute portal hosted on App Service. Which App Service setting should the developer raise to block those clients?
- A botanical garden SPA hosted on a different origin calls a JSON API on App Service, but the browser blocks the response. Which App Service configuration should the developer update first?
- An extension-office App Service web app must reach a backing Azure store without committing a raw connection secret into source control. Which App Service feature should the developer use to wire that dependency?
- A city library catalog must serve static documentation from a /docs virtual path and a REST API from the same App Service site. Which site-level configuration should the developer use instead of a second App Service plan?
- On folk-festival ticket-sale morning the App Service site saturates. One teammate wants a larger plan SKU; another wants more instances on the same plan. How should the developer distinguish those two App Service scale actions?
- A compost-lab public dashboard on App Service spikes CPU every weekday at 08:00 when sensors flush. Which autoscale approach should the developer implement?
- A festival box-office App Service app is slammed Friday 16:00–22:00 and nearly idle otherwise. What autoscale configuration should the developer add so capacity is ready before the rush?
- A clerk-office Free-tier App Service plan has no autoscale blade, and a teammate files a platform bug. What should the developer conclude?
- While tuning a city permits portal on App Service, a study guide still pairs “optimize” with Azure Cache for Redis. For Domain 1 autoscaling on this web app, what should the developer implement?
- The harbor-ferry App Service site cannot go dark during weekday deploys, and the team needs a warm staging URL before production sees the build. What should the developer create?
- QA signed off on the staging deployment slot for the municipal permits site. The team wants that build to become production while the public production URL stays unchanged. What should the developer do?
- The staging slot for a clerk-office web app must keep ENVIRONMENT=qa and a QA database connection through a swap so production never points at QA. How should the developer mark those app settings?
- A library Shared App Service plan shows no Slots blade. What should the developer know about enabling deployment slots?
- A blood-bank App Service site JIT-compiles on first request, so a cold swap still caused a rider-visible pause. Which swap technique should the developer use so the destination worker warms before cutover?
- A maple-coop intern created eight separate Function apps for eight tiny related HTTP routes and now manages eight hosting identities. What should the developer recommend instead?
- A ferry webhook Function is idle most nights and can tolerate cold starts, while a clerk-office Function must join a VNet and stay pre-warmed. How should the developer match Azure Functions hosting plans?
- A compost-lab Azure Functions app was created without a linked storage account, and triggers never coordinate correctly. Which required application setting must the developer supply for host internal state?
- A newsroom developer stores a storage connection in local.settings.json and expects it in Azure after deploy, but the cloud function app has no connection. What should the developer understand about these files?
- A botanical public weather HTTP function should be callable without a key, while a blood-bank donor-update HTTP function must require the function key. Which Functions configuration distinguishes those endpoints?
- A seed-catalog Python function targets an unsupported Functions host, and extensions fail to load. What should the developer select when creating the function app?
- A clerk-office JavaScript Azure Functions app adds a Cosmos DB output binding, but the host cannot resolve the binding extension. What should the developer enable on the function app?
- A credit-union .NET Azure Function must run so the host and the app do not share one process. Which create/configure choice should the developer select?
- A festival Azure Function should run on a schedule, read a blob, and write a Cosmos DB item. How should the developer assign trigger and binding roles?
- An HTTP donor-intake Azure Function must enqueue a work item for a later processor. Which approach matches the Functions bindings skill?
- A county flood-camera function runs when a new video lands in Blob Storage and must process the bytes of that same blob. How should the function obtain the triggering blob’s content?
- A municipal soil-lab webhook Function accepts a soil-sample JSON body and must persist one Cosmos DB document per call. The team wants to avoid constructing a Cosmos SDK client inside the function. What should they add?
- A city radio-archive Function needs a Blob Storage API that the available input binding does not expose. A teammate insists every Blob call must go through a binding. What is the correct guidance?
- A compost-yard Function’s queue binding currently embeds the storage account key directly in function.json. What change correctly supplies the connection?
- A harbor ferry /delay webhook Function must return HTTP 202 to the caller and also enqueue a notification message for staff. How should the developer structure outputs on that single function?
- During a parks department review, a teammate asks for a Timer output binding and a SendGrid trigger on Azure Functions. What should the candidate explain about binding directions?
- A public library wants an Azure Function to run at 02:15 every night, but a pasted five-field Linux crontab never fires. What schedule format should the timer trigger use?
- A third-party tide API will POST storm alerts to a URL the municipal harbor owns. Which Azure Functions trigger best implements that webhook?
- When a cooperative grower drops a harvest CSV into a Blob Storage container, a county Function should start processing immediately. Which trigger should the developer choose?
- Work items for a city permits desk already land on an Azure Storage queue from another function’s output binding. The processor Function should run when a message appears. Which trigger fits?
- A clerk-office Azure Function must run whenever a new item is inserted into a Cosmos DB container. Which Functions trigger should the team select?
- A water-utility team needs blob-created notifications to reach a Function quickly without a timer scanning the container every five minutes. What approach should they prefer?
- A transit teammate wants one Azure Function that is both HTTP-triggered and timer-triggered to save a file. What is the correct design?
- A municipal IT backlog lists three needs: nightly cleanup at 01:00, a partner system that POSTs incidents, and a reaction when a monitored queue message appears. How should the team map Azure Functions triggers?
Develop for Azure storage · 57 questions
- A tidal-gauge lab talks about “the Cosmos table” as if one object holds everything. In the Azure Cosmos DB SDK, which resource hierarchy does the application address?
- An alpine-hut booking API has a Cosmos DB account in the portal, but the application still cannot read or write data. What must the developer instantiate first in code?
- A kelp-farm inventory deploy should ensure database kelp-db exists on first run and must not fail when the database is already present on later deploys. Which SDK approach fits?
- A lantern-festival ticketing app’s Cosmos container create fails when the team passes only a container name. What required property must the SDK supply at create time?
- A marsh-bird census API already knows a sighting’s item id and its species partition key and must load that one document as cheaply as possible. Which SDK operation should it use?
- A cider-press co-op must reject inserts when a batch id already exists, while a later nightly sync should insert-or-replace the same items. Which Cosmos SDK pair matches those rules?
- A tramway-maintenance log stores large Cosmos items. Operators must update only the lastInspected field without rewriting the entire document and risking clobbered concurrent edits. Which SDK approach fits best?
- A dune-rescue cache must return every kit whose status is open within one depot partition. The API does not know each kit’s item id in advance. Which Cosmos SDK approach is appropriate?
- An ice-road convoy tracker starts receiving HTTP 429 responses from Cosmos DB after a teammate replaced point reads with broad SELECT scans. What should the developer recognize as Cosmos throughput currency, and what should they prefer?
- Two canal-lock clerks update the same Cosmos lock item a second apart. How should the application prevent the second write from silently overwriting the first?
- A slate-quarry timesheet system has many small Cosmos containers that are idle most of the day and one occasionally busy container. Where can provisioned throughput be set so idle containers can share RU/s?
- A harbor oyster-bed permit desk is building a new Azure app for permit documents as JSON items. Which storage path matches the native AZ-204 Cosmos DB SDK skill for this workload?
- A municipal foghorn museum catalog stores each artifact as a Cosmos DB for NoSQL item. A curator retires one artifact and the app must remove only that document. Which SDK action should the developer call?
- A county sled-dog relay board treats Cosmos consistency as only “strong or eventual.” Which order lists the five official Cosmos DB consistency levels from strongest to weakest?
- A peat-bog research kiosk writes a sample id to Cosmos DB and must immediately read that same committed value from another region for a printed label. Which consistency level should the developer choose?
- A cliff-rail timetable site needs each clerk to see their own writes while the Cosmos account stays on the service default. Which consistency level should the developer name?
- A brine-works municipal payroll replica may lag behind the write region, but never by more than two minutes or five versions. Which Cosmos consistency level matches that requirement?
- A lichen-survey import writes two related items in one Cosmos transactional batch. Readers must never see the second item without the first. Which consistency level should the developer pick?
- A fjord-ferry cargo board only displays a running “crates scanned” total in Cosmos DB. A slightly outdated number is acceptable and ordering across updates does not matter. Which consistency level fits?
- A windmill bakery Cosmos account defaults to Session, but one dashboard query can tolerate Eventual to save RU. How should the developer apply that weaker setting?
- A glacier-guide booking Cosmos account enables multiple write regions, and an operator still tries to set Strong consistency. What should the developer know about that pairing?
- A salt-marsh nursery wants every insert and update on plant items, in modification order, without polling the Cosmos container. Which Cosmos mechanism should the developer use?
- A copper-roof workshop runs a long-lived worker that must checkpoint Cosmos change-feed progress so a restart does not replay the entire history. Which approach should the developer use?
- A birch-sap bottling line deletes a bad batch item from Cosmos DB, but a latest-version change feed consumer never receives that delete. Why?
- A rope-bridge inspection feed must include deletes and intermediate item versions from Cosmos DB. Which change feed configuration should the developer select?
- A thistle-farm CSA backfill must replay Cosmos change history, while a live packer station should only see new changes from now on. What should the developer configure for each consumer?
- An aurora-watch lodge already runs a Cosmos-triggered Azure Function. A second long-running worker in Azure Container Apps must consume the same container’s changes. Which Domain 2 approach fits the Container App?
- A kelp-drying loft scales three change feed processor workers against one large Cosmos container. How should work be distributed?
- A pebble-beach rental tool wants to page Cosmos changes on demand instead of hosting a continuous processor loop. Which official approach should the developer use?
- A herring-smoke house stores Content-Type and a custom smoker-bay label on the same Azure blob. How should the developer treat those two pieces of information in the Blob SDK?
- A moss-garden festival ticket scan must persist booth=north and day=sat on an image blob without changing the image bytes. Which Blob SDK action should the developer take?
- A spruce-mill inventory download opens in the browser as a generic octet-stream instead of a PDF. Which Blob SDK fix should the developer apply?
- A tide-pool classroom app only needs Last-Modified and the module metadata before deciding whether to fetch a 2 GB clip. Which Blob SDK call should it make first?
- A granite-stair repair photo blob already has metadata crew=a. A later Set Metadata call sends only shift=night, and crew disappears. What should the developer understand?
- A cranberry-bog scale team set season=fall as metadata on the container, but a blob listing does not show that value on each file. Where should the developer read season=fall?
- A lighthouse-keeper log blob is snapshotted, then the live blob’s Content-Type is changed. The app needs the headers from before that change. What should the developer do?
- A willow-basket guild stores finished photos in Blob Storage and wants Find Blobs by Tags plus lifecycle filters on status=ready without putting that key in x-ms-meta user metadata. Which Blob Storage feature should the developer use?
- A snowpack-sensor uploader constructs one Azure Blob SDK object and expects that same object to list every container in the account and also upload a file into one container. Which v12 client choice matches those two scopes?
- A reed-bed filter lab must drop a CSV onto a blob path that may already exist and replace the prior file in place. Which Azure Blob Storage SDK operation should the developer call?
- An amber-workshop order form must pull a finished pattern blob from Azure Blob Storage and save the bytes to local disk for a cutter workstation. Which SDK operation should the developer use?
- A cobble-street market stall app should ensure container stall-photos exists on first boot without failing when the container is already present. Which Blob SDK approach should the developer take?
- A pine-resin still stores jar photos under the virtual folder 2026/aug/ in one blob container and must list only that folder’s blobs. Which approach should the developer use with the Blob SDK?
- A frost-fair stall writes a continuously growing JSON audit log to Blob Storage, while ordinary product photos are stored as discrete files. Which blob type pairing should the developer choose?
- An otter-watch camera archive must duplicate a clip from an ingest container into a review container in the same storage account without pulling the bytes through the application host. Which Blob SDK approach should the developer use?
- A barley-malt silo app deletes a mistyped lot photo with the Blob SDK. Soft delete is enabled on the account. What should the developer expect immediately after a successful delete call?
- Two cairn-trail map builders must not overwrite the same GeoJSON blob at the same time. Which Blob Storage SDK concurrency tool should they use for an exclusive write?
- A driftwood gallery must move last year’s exhibit photos to the Cool access tier immediately without waiting for a lifecycle policy evaluation. Which Blob SDK action should the developer take?
- A heather-honey coop pasted the storage account key into appsettings.json checked into source control. How should the developer construct the Azure Blob Storage v12 client instead?
- A fjord-cabin photo album stores binary images with blob metadata in Azure. A teammate proposes Queue Storage or Azure SQL as the primary store because both are “Azure storage.” Which service selection matches Domain 2 for these objects?
- A nettle-tea factory wants blobs unused for 30 days moved to Cool and blobs unused for 365 days deleted, without writing a timer Function that lists and deletes. What should the developer configure?
- A basalt-column tour archive is rarely read and must map storage cost to how often content is accessed. Which official Blob access tier set should the developer use when planning lifecycle targets?
- A plover-nest watch account stores blobs under raw/ and publish/; only raw/ should move to Archive after inactivity. How should the developer scope the lifecycle rule?
- A flax-mill ledger blob is in the Archive tier. A clerk asks for a lifecycle policy that periodically moves it back to Hot on a calendar. What should the developer tell them?
- A pumice-quarry log blob in the Archive tier fails when the app calls Download. What must the developer do before the content can be read?
- A sedge-meadow hydrology team wants one container-side place to revise expiry for several service SAS tokens without regenerating each signature string from scratch. What should the developer define?
- A wicker-ferry ticket scan is deleted while blob soft delete retention is 14 days, so the object remains recoverable and billable during that window. How should the developer contrast this with a lifecycle delete action?
- A lichen-crust legal archive has a time-based immutability (retention) policy on its blobs. A lifecycle rule tries to delete those objects after 400 days. What happens?
Implement Azure security · 57 questions
- A gannet-cliff camera site has sign-in code ready but no directory application object yet. What Microsoft identity platform step must the developer complete before MSAL can sign users in?
- A peat-smoke kiln API works in the home tenant after app registration, then fails in a customer tenant that has no enterprise application for that API. Which identity distinction should the developer apply?
- An alder-charcoal shop begins hand-building OAuth authorize URLs inside a web controller for interactive sign-in. Which approach should the developer take instead on the Microsoft identity platform?
- A samphire-harvest SPA and a confidential server web app both need interactive user sign-in to Microsoft Entra ID. Which OAuth flow should the developer select for modern interactive users?
- A municipal mackerel-auction night worker runs with no signed-in user and must call a protected city API. Which OAuth 2.0 flow should the developer use?
- A county fir-cone catalog web app puts an ID token in the Authorization header when calling a downstream inventory API and receives HTTP 401. What should the developer send to the API?
- A dune-grass nursery portal reads the signed-in grower’s profile with User.Read, while a nightly job must read every grower as the app itself with User.Read.All. How should the developer map those permission types on the identity platform?
- An icehouse inventory app requests a high-privilege Microsoft Graph permission, and ordinary growers cannot complete consent. What should the developer arrange?
- A kelp-ash glaze studio’s sign-in fails with a redirect URI mismatch after a teammate changed the web app’s public URL. What should the developer update?
- A puffin-burrow census site still hashes passwords in Cosmos DB for municipal staff sign-in. What should the developer do instead for user authentication?
- A slate-roof guild API is reachable with no Authorization header. What should the developer implement so unauthenticated calls fail?
- A bog-cotton weaver API must allow Dispatcher apps to POST jobs and forbid Viewer apps. How should the developer enforce that authorization?
- A brine-shrimp tank portal must accept only accounts from the hatchery’s Microsoft Entra tenant, not any Entra user on the internet. What should the developer configure?
- A rowan-berry press API currently accepts any well-formed JWT. Which validation must the developer require for Microsoft Entra access tokens?
- A cormorant-roost daemon still ships a client secret in source control to authenticate to Microsoft Entra ID. What credential approach should the developer prefer?
- A drift-ice buoy dashboard API must call a second protected API while preserving the signed-in ranger’s identity. Which flow should the middle-tier API use?
- A fennel-seed mill user’s sign-in to a municipal app succeeds at Entra but access is still blocked by a Conditional Access grant. How should the developer interpret this?
- A grouse-moor booking tool needs time-boxed browser access to a blob. Which set names the official Azure Storage shared access signature types the developer should choose among?
- A hail-net vineyard web app must mint a SAS for browser uploads without placing the storage account key on the app. What should the developer create?
- An ivy-walled archive function still uses the storage account key and must grant access to one blob container only. Which SAS should the developer mint?
- A juniper-smoke house tool needs blob and queue data-plane operations authorized with a single shared access signature. Which SAS type fits?
- A knapweed survey hands out service SAS URIs whose expiry is baked into each URI, and the team cannot revoke one class of tokens without chasing every link. What should the developer do?
- A loch-side hostel QR code only needs to display one photo for fifteen minutes. How should the developer configure the SAS?
- A mulch-yard kiosk pastes a SAS into an http:// link on a chalkboard web page. What distribution practice must the developer follow?
- A nimbus-radar hut leaks a service SAS that referenced stored access policy field. How should the developer revoke access without breaking every other client?
- An ochre-pit sample app needs the signed-in geologist’s Microsoft 365 profile and photo. Which API should the developer call?
- A perch-pond hatchery page completes MSAL sign-in but still receives HTTP 401 from Microsoft Graph. What step is missing?
- A quahog-lease daemon uses client credentials and calls Microsoft Graph /me, which fails. What should the developer do?
- A rill-garden sensor portal only displays the signed-in ranger’s own profile, but a teammate requested User.Read.All. Which Graph permission should the developer keep?
- A siskin-feed station web app can call Microsoft Graph with the Graph SDK client or with an HTTP GET to https://graph.microsoft.com/v1.0/.... Which statement is accurate for the developer?
- A tarn-depth logger already obtained user consent for User.Read. A new OneDrive export feature needs Files.Read. How should the app obtain the additional Graph permission?
- An umber-dye vat overnight worker lists every shop user at 02:00 with no human signed in. Which Microsoft Graph approach fits?
- A vetch-seed bank teammate files Microsoft Graph under “third-party services” next to Service Bus and Event Grid. Where does Graph belong on the January 14, 2026 AZ-204 outline?
- A wrack-line cleanup API stuffed connection strings, feature flags, and the storage account key into one checked-in JSON file. How should the developer split those values?
- A yarrow-field trial must flip the useNewSampler flag without redeploying the App Service. Where should that feature flag live?
- A zinc-roof workshop wants one configuration client in the app, but DbPassword must remain a vault secret. What App Configuration pattern meets that goal?
- An aspen-grove inventory setting changes in Azure App Configuration, but running App Service instances keep the old value until recycle. What should the developer enable?
- A bluff-erosion pin API uses the same App Configuration key ApiUrl for test and production. How should environments stay separated without overwriting each other?
- A clover-honey frame site still pastes the Key Vault secret’s plaintext value into an App Service application setting. What should the developer do instead?
- A dew-pond gauge team proposes Azure Cache for Redis “because we need configuration.” Which service selection matches AZ-204 for app configuration and secrets?
- An elm-bark archive must hold a signing key and a TLS certificate the app loads at runtime. Which store is appropriate?
- A fen-boardwalk ticket API needs StripeLikeKey from Key Vault at startup. Which SDK approach should the developer use?
- A gorse-fire watch must encrypt a payload with a vault-managed key and must never download the raw key material. Which client pattern is correct?
- A hazel-coppice API must load a client certificate each night for a partner call. What should replace a checked-in PFX on disk?
- An inlet-tide gate rotates BusConnection in Key Vault while a still-warming instance may need the previous version. What should the developer understand about secret addressing?
- A jetty-plank inventory app receives https://<vault>.vault.azure.net/ and a managed identity. How should code address Key Vault secrets?
- A kelp-forest diver deletes OldSmtp in Key Vault and can still recover it during the retention window. What developer-facing behavior explains that?
- A larch-resin pot Function has Key Vault references configured but still receives 403 when resolving secrets. What is the likely missing piece?
- A meadowlark-count teammate begins designing private-endpoint hub-and-spoke plus Managed HSM pools for a simple app secret read. What scope matches AZ-204 Domain 3 for Key Vault?
- A nene-goose collar API still copies a client secret into App Service settings to call Key Vault and Blob Storage. Why enable a managed identity instead?
- An oxbow-lake sampler Azure Function should have an identity that appears and disappears with the Function app itself. Which identity type fits?
- A polder-pump log solution has two App Service apps and one ACI group that all need the same Key Vault role. Which managed identity approach fits best?
- A quaking-bog path API uses the Azure SDK on a developer laptop (interactive login) and in Azure (managed identity) without #if AZURE secret forks. Which credential pattern supports that?
- A river-otter holt web app has a managed identity enabled but still cannot list blobs in a container. What else is required?
- A shingle-bank marker runs on App Service, a sibling worker is a Function, and a third host is Container Apps. Where does the developer enable managed identity for those workloads?
- A tamarack inventory daemon on App Service keeps failing when its Entra app-registration client secret expires. How should the developer remove that secret-rotation hop?
- An urchin-barren plot site must let a visitor’s browser upload one photo to Blob Storage. A teammate tries enabling managed identity on the user’s laptop. What is the correct approach?
Monitor, troubleshoot, and optimize Azure solutions · 24 questions
- An alder-creek ferry API looks slow on an Application Insights chart, but a teammate cannot find the one failing call. How should metrics and logs be treated?
- A bracken-ridge ticket site calls a Function and then Cosmos DB; support wants the whole hop in one view. What Application Insights feature stitches that operation?
- A cedar-swale kiosk app talks to Storage, a Function, and an external HTTP API. Which Application Insights experience shows which dependency node is failing?
- A dune-grass booking site has rising HTTP 500s one week and rising p95 latency the next. Which Application Insights views match those jobs?
- An eelgrass-bay ranger reports one checkout that hung at 14:03. How should the developer locate that single operation in Application Insights?
- A fir-hollow deploy just shipped and the team needs to know whether the app is failing right now. Which Application Insights experience should they open?
- A granite-ledge worker writes ILogger warnings that never appear on a metric chart. Where should the developer query those messages in Application Insights?
- A heather-moor catalog shows fewer failed requests in Application Insights after a config change, yet users still report errors. What should the developer check before celebrating?
- An ice-floe trail map must be proven reachable from several Azure regions even when no visitor is clicking. What should the developer create?
- A juniper-knoll teammate still creates a classic “URL ping test” from an old screenshot. Which availability test type should the developer use instead?
- A kelp-strand status page alerts whenever a single availability-test location times out. How should the developer reduce false outage pages?
- A lichen-cliff API needs a page when its availability test drops below a percentage instead of a human watching the Availability blade. What should the developer create?
- A mangrove-creek site is instrumented and looks green in Application Insights while the public homepage is unreachable from Europe. What complementary check should the developer add?
- A needle-ice partner API requires a signed header and a two-step login that a Standard availability test cannot complete. What should the developer use?
- An oak-copse team wants a near-real-time page on failed-request rate and a slower digest when a rare exception message appears. Which alert shapes fit Application Insights data?
- A peat-bog teammate “optimizes” Domain 4 by adding Azure Cache for Redis and an App Service autoscale rule. What stays in scope for this domain?
- A quartz-spire web app still pastes only an instrumentation key into configuration. What should the developer use for Application Insights ingestion settings?
- A reed-marsh ASP.NET Core API needs traces, metrics, and logs in Application Insights without a handwritten exporter. What should the developer add?
- A spruce-fen App Service site can enable Application Insights in the portal, but the team also wants custom spans. How do the two instrumentation paths compare?
- A tidal-pool Azure Function never appears in Application Insights. What configuration should the developer set on the Function app?
- An umber-bluff marketing page needs page views and client exceptions in Application Insights. Which instrumentation should the developer use in the browser?
- A vernal-pool checkout wants a “promoapplied” business event plus a custom metric in Application Insights. How should the developer emit that telemetry?
- A willow-brake parks desk creates a classic Application Insights resource and then cannot join its telemetry with the rest of the city’s Log Analytics queries. What should the developer create instead?
- A yarrow-field App Service already writes filesystem and blob web-server logs, and a teammate says monitoring is finished. What should the developer still add for requests, dependencies, traces, and availability?
Connect to and consume Azure services and third-party services · 73 questions
- An aspen-grove city API program is told to stand up API Management, but an intern only creates a Function app. Which three parts make up an APIM instance?
- A birch-stand permitting team tries to paste an OpenAPI file into the portal with no API Management resource in the subscription. What must happen first?
- A cattail-pond set of Azure Functions sits idle most of the month and spikes hard at filing deadline. Which APIM tier family fits that bursty serverless pattern?
- A dew-meadow partner integration is about to go live on the Developer APIM tier because the sandbox was cheap. What should the developer do before production cutover?
- An elder-hedge backend lives on a private VNet and the gateway must sit with it in more than one region. Which APIM choice meets that requirement?
- A foxglove-lane legacy SOAP service should not be reachable on the public internet. How should callers reach it through Azure API Management?
- A goldenrod-bank org has App Service, Functions, and a partner HTTPS API to expose. How should they structure API Management?
- A hazel-copse teammate provisions Application Gateway because the team needs an API gateway with keys, products, policies, and a developer portal. Which service should they use instead?
- An indigo-fen catalog already has a Swagger/OpenAPI file for its permit APIs. What is the preferred way to create those operations in API Management?
- A jasmine-walk APIM instance exists, but callers still get 404 because nothing was published to the gateway. What must the developer configure?
- A kestrel-ridge mobile team should see only three of twelve municipal APIs. How does API Management package those APIs for consumers?
- A larkspur-field product is fully configured, but partners still see an empty developer portal. What step is missing?
- A milkweed-ditch partner asks for a PDF of every APIM operation. Where should the developer point them for official interactive documentation?
- A nettle-path consumer app is ready before the origin permit API exists. How can API Management let the contract be called without a live backend?
- An oriole-copse /orders API must keep v1 live while v2 ships a breaking request body. Which APIM construct should the developer use for that breaking change?
- A primrose-bank HTTP Azure Function is the real implementation behind a new city API. How should the developer bring it into API Management?
- A quince-hedge origin API has no authentication of its own. How should API Management keep anonymous internet calls from reaching that origin?
- A redwing-marsh mobile app must prove it subscribed to a protected APIM product. What credential does the app send on each call?
- A sedge-flat weather API should stay intentionally public, while the paid forecast API requires a key. How should products be configured?
- A thrush-hollow partner product should not auto-issue keys when someone clicks Subscribe. What product setting should the developer enable?
- A uvularia-glade SPA already presents an Entra access token for the city API. Which APIM approach validates that caller token at the gateway?
- A vetch-meadow guest can browse docs, but only signed-in developers may subscribe to the paid product. How does APIM control that visibility?
- A wren-thicket firm wants partners to sign into the APIM developer portal with their Entra accounts instead of APIM-local users. What should the developer configure?
- A yew-terrace intern published one API Management subscription that can call both admin and public APIs. How should the team package access so each caller gets only the APIs it needs?
- An azalea-bank APIM policy that rewrites the response body sits in the inbound section and never runs. Where should that statement live among the official policy sections?
- A bluebell-wood public API behind API Management is being scraped. How should the developer throttle callers without coding a counter inside the Function?
- A columbine-ledge public path is /pets/{id}, but the origin lives at /api/v3/animals/{id} on another host. Which APIM approach transforms the request toward that backend?
- A dogwood-bend legacy origin still returns XML, but municipal mobile clients want JSON. Without rewriting the origin, what should the APIM developer apply?
- An eider-cove GET /tides is hit every second and the origin response is cheap to cache at the gateway. Which APIM policy pair should the developer use?
- A fern-gully CORS header is required on one APIM operation, not the whole instance. At which policy scope should the developer apply it?
- A gentian-slope App Service backend should not receive a stored client secret from API Management. Which APIM policy presents a token from the gateway’s identity?
- A heron-pool browser app is blocked by CORS after the municipal API is imported into API Management. What should the developer add instead of documenting around the error in the developer portal?
- An iris-swale app must run a Function when a blob is created, not every minute on a schedule. Which service best delivers that discrete reactive event?
- A jonquil-row storage account should notify a webhook on Microsoft.Storage.BlobCreated. Which Event Grid resource type surfaces that built-in Azure service event?
- A kingfisher-creek checkout service wants other municipal apps to react to an OrderPlaced event. Where should it publish that application event?
- A lupine-hill Event Grid topic exists, but nothing runs when events publish. What delivery contract is still missing?
- A mallow-bend Function should run only for blobs under /orders, not for every blob in the storage account. How should Event Grid narrow delivery?
- A nuthatch-grove third-party site exposes HTTPS and must be told when a municipal resource changes. How should Event Grid deliver that notice?
- An osprey-bluff subscriber is not an Azure service and expects CloudEvents 1.0. How should Event Grid deliver events for that interoperability need?
- A pipit-meadow worker is not always online and cannot expose a public webhook. How can Event Grid still deliver discrete events when the app is ready?
- A quail-hedge Event Grid webhook is down for an hour. What delivery reliability behavior should the developer expect for push subscriptions?
- A redpoll-fen IoT farm emits thousands of temperature readings per second for analytics, and a teammate creates an Event Grid topic. Which service should carry that telemetry stream instead?
- A sanderling-spit SaaS vendor can publish into Azure for municipal subscribers. How should the team treat that inbound third-party capability on Event Grid?
- A teal-inlet fleet streams click telemetry that several analytics jobs must read independently. Which service should the developer pick?
- An urchin-cove team tries to create “an Event Hub” with no parent and wonders where the endpoint lives. What hierarchy should they create first?
- A violet-dell processor cannot keep up on a single ordered log in Event Hubs. Why do partitions exist for that workload?
- A whimbrel-flat device’s readings must stay in order per device on Event Hubs. How should related events be kept on one ordered stream?
- An xeric-ridge archive job and a live-alerting job must both read the same Event Hub without sharing a cursor. What should the developer create?
- A yellowthroat-bog Event Hubs processor restarts and re-reads yesterday's telemetry. What must the consumer do so resume continues from the last processed offset?
- An aster-lea stream must land in a data lake every few minutes without a custom drain Function. What Event Hubs feature should the developer enable?
- A bittern-marsh team already has Kafka producers and needs Event Hubs without rewriting to AMQP on day one. What should the developer configure?
- A crane-meadow Event Hub has 32 partitions and still throttles on ingress. What should the developer raise instead of only adding partitions?
- A dock-weed order workflow needs peek-lock, sessions, and a dead-letter queue, but a teammate opens Event Hubs. Which service should the developer choose instead?
- An egret-pool intern waits for Event Hubs to POST each event to a webhook the way Event Grid does. How should events actually be consumed?
- A fireweed-cut fulfillment step must run once, durably, when checkout finishes — even if the worker is down. Which Azure messaging service fits best?
- A goshawk-crag shop has three workers and each order must be processed by only one of them. Which Service Bus entity should the developer use?
- A hemlock-draw OrderPlaced message must reach billing, shipping, and email independently. How should Service Bus be shaped?
- An ibis-lagoon worker crashes after dequeue and the order vanishes. Which receive mode should the developer use so unfinished work can reappear?
- A junco-thicket customer's create, update, and cancel messages must run in order while other customers may interleave. What Service Bus feature should be enabled?
- A knotweed-dike message fails repeatedly and keeps looping through workers. Where should Service Bus place it after max delivery attempts?
- A loon-lake checkout retries a send after a timeout and must not fulfill the order twice. What should the developer enable on the Service Bus entity?
- A moose-wallow reminder should stay invisible to workers for 24 hours. How should the developer delay the Service Bus message?
- A newt-pond shipping subscription should receive only messages where region equals west. What should the developer configure on the subscription?
- An otter-slide workflow needs sessions, transactions, and a dead-letter queue, but a teammate opens a storage-account queue because "a queue is a queue." Which service should the developer use?
- A plover-bar intern picks Event Grid for a durable order command and Event Hubs for a one-consumer fulfillment queue. How should the services be restated?
- A rabbitbrush-wash thumbnail job is fire-and-forget, small, and needs no sessions or duplicate detection. Which queue should the developer use?
- A sage-flat worker dequeues a resize job and another worker immediately grabs the same message. What Queue Storage behavior should the developer rely on to hide in-flight work?
- A tamarisk-wash Function processes a Storage queue message and returns, then the same job runs again. What must happen after success?
- An umber-wash payload is malformed and reappears after every visibility timeout. How should the developer detect and handle this poison message?
- A vireo-wash worker tries to put an entire JPEG into a Queue Storage message and the SDK rejects it. What pattern should the developer use?
- A willow-wash app already references ServiceBusClient, and a teammate points it at a storage-account queue URL. Which client should talk to Azure Queue Storage?
- A xeric-wash study plan files Azure Storage queues under Cosmos and Blob skills. Where do Storage queues belong on the AZ-204 outline?
- A yucca-wash prompt describes either a blob-created reaction, a telemetry firehose, a durable order command with sessions, or a simple 64 KB work queue. Which mapping should the developer apply?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.