az 204 practice test Advanced Practice Exam: Hard Questions 2025

You are building a multi-tenant API hosted on Azure Functions (HTTP trigger) running on the Consumption plan. The API must call a third-party service that enforces a strict per-client IP allowlist. The allowlist must remain stable, and the solution must minimize operational overhead while keeping cost low. Which approach best meets the requirements?

You deploy an Azure Container App that processes messages from an Azure Service Bus queue. Under load, the queue length grows quickly, but the Container App does not scale out as expected. You confirm the container is healthy and can process messages when manually scaled. Which configuration issue is the most likely root cause?

An Azure App Service hosts a .NET API that uses in-memory caching. During a planned deployment using slots, you notice that after swapping, the API experiences a sharp latency spike and cache misses for several minutes. You must reduce post-swap warm-up impact while keeping zero-downtime deployment. What should you do?

You must design a high-throughput ingestion system writing JSON documents to Azure Blob Storage. Requirements: append-only writes, millions of events per minute, consumers must read events in arrival order per partition key, and you must minimize storage transaction costs. Which storage pattern best fits?

A web app uploads large files directly to Azure Blob Storage using a SAS. Security requires that the SAS cannot be reused to overwrite an existing blob, must be valid for only 10 minutes, and must be restricted to a specific path prefix per user. The solution must avoid storing account keys in the web app. What should you implement?

A microservice running in Azure Kubernetes Service (AKS) must call several Azure resources (Key Vault and Storage) using managed identity. The team uses Azure AD Workload Identity. Calls intermittently fail with 'invalid audience' or 'token not valid yet' errors after pods are rescheduled. What is the most likely misconfiguration?

Your API uses Azure Key Vault references in App Service application settings (e.g., @Microsoft.KeyVault(SecretUri=...)). After enabling Key Vault private endpoint and disabling public network access on Key Vault, the App Service fails to start because secrets cannot be resolved. You must keep Key Vault private-only. What should you do?

A distributed application uses Azure Functions and Azure Service Bus. You observe duplicate processing of messages even though your function code is idempotent only at the database layer and not at downstream APIs. You need to reduce duplicates without sacrificing throughput. Which change is most effective?

You instrument a .NET API with Application Insights. During an incident, you can see many failed requests (HTTP 500) but end-to-end transaction correlation is missing across an outbound dependency call to another internal service. Both services use Application Insights. What is the most likely cause and fix?

A SaaS app exposes an API via Azure API Management (APIM). Backend services are protected by Azure AD and require user context for authorization decisions. The client authenticates with Azure AD and sends a bearer token to APIM. You must ensure the backend receives a token that represents the original user (not APIM) while still allowing APIM policies to validate and enforce scopes. What should you configure?