8 AZ-204 Questions Most Candidates Get Wrong
Here are 8 multiple-choice questions designed to mirror the difficulty, style, and domain coverage of the actual AZ-204 exam. Each question tests your ability to apply Azure development concepts to realistic scenarios, focusing on decision-making rather than simple recall.
Question 1
You are developing a solution that processes insurance claims. The solution uses Azure Cosmos DB and requires that a single logical partition never exceed 20 GB of storage. You need to design a partitioning strategy that ensures optimal scalability and performance. Which partitioning strategy should you implement? If you're preparing for this exam, 10 AWS Cloud Practitioner Questions Most Candidates Get Wrong is essential reading.
A. Partition by the claimId property, which is a unique GUID for each claim.
B. Partition by the customerId property, which groups all claims for a single customer.
C. Partition by the claimDate property, which uses the year and month (e.g., 2023-10).
D. Partition by the status property, which has a value of Open, InReview, or Closed.
Answer: A
Explanation: A unique GUID for claimId ensures a high-cardinality partition key, distributing data evenly and avoiding hot partitions. Options B and C can create hot partitions (large customers or monthly spikes), while option D has low cardinality, leading to a maximum of three physical partitions and exceeding the 20 GB limit.
Question 2
You are deploying a web app to Azure App Service. You need to ensure that the app’s configuration settings are automatically backed up and restored if the app is redeployed to a different region. Which feature should you use?
A. Deployment slots
B. App Service backup
C. Azure Key Vault references
D. App Service cloning
Answer: B
Explanation: App Service backup captures app configuration, files, and database connections, allowing restoration to another App Service plan. Deployment slots are for staging, not disaster recovery. Key Vault references secure secrets but don't back them up. Cloning copies settings to a new app but requires manual execution and is not a scheduled backup.
Question 3
You are writing code to retrieve a secret from Azure Key Vault. The application runs in a virtual machine (VM) with a system-assigned managed identity. You need to authenticate to Key Vault without storing credentials in code. Which code snippet should you use?
A. new KeyVaultClient(new DefaultAzureCredential())
B. new KeyVaultClient(new ClientSecretCredential(tenantId, clientId, clientSecret))
C. new KeyVaultClient(new ManagedIdentityCredential())
D. new KeyVaultClient(new InteractiveBrowserCredential())
Answer: C Readers also benefit from 10 AWS Advanced Networking Specialty Questions Most Candidates Get Wrong.
Explanation: ManagedIdentityCredential uses the VM’s system-assigned identity to authenticate, requiring no secrets in code. DefaultAzureCredential tries multiple sources but is not specific to managed identity. ClientSecretCredential requires a client secret. InteractiveBrowserCredential requires user interaction, which is inappropriate for a background VM process.
Question 4
You are building an Azure Functions app that processes messages from an Azure Storage queue. The function must scale automatically to handle a high volume of messages, and you want to minimize cold start latency. Which hosting plan and trigger should you use?
A. Consumption plan with a Queue trigger.
B. Premium plan with a Queue trigger.
C. Consumption plan with an HTTP trigger.
D. Dedicated plan (App Service) with a Timer trigger.
Answer: B
Explanation: The Premium plan provides pre-warmed instances, eliminating cold starts, and supports automatic scaling for queue-triggered functions. The Consumption plan scales well but has cold starts. An HTTP trigger doesn’t consume queue messages. A Timer trigger does not respond to queue volume.
Question 5
You are developing an API that requires users to be authenticated via Azure AD. The API is registered in Azure AD and exposes custom scopes. You need to validate the JWT bearer token in your ASP.NET Core middleware. Which configuration is required to validate the token’s audience and issuer?
A. Set TokenValidationParameters.ValidAudience to the API’s Application ID URI.
B. Set TokenValidationParameters.ValidIssuer to the client’s Application ID.
C. Set TokenValidationParameters.ValidAudience to the client’s Application ID.
D. Set TokenValidationParameters.ValidIssuer to the API’s Application ID URI.
Answer: A
Explanation: The audience (aud) in the token must match the API’s Application ID URI (e.g., api://contoso-api). The issuer (iss) is the Azure AD tenant endpoint, not the client ID. Option B is incorrect because the issuer is the tenant, not the client. Option C is wrong because the audience is the API, not the client. Option D misidentifies the issuer.
Question 6
You are creating a containerized application to be deployed to Azure Container Instances (ACI). You need to ensure that the container can be restarted automatically if the application inside it crashes. Which restart policy should you set in the ACI configuration?
A. Always
B. OnFailure
C. Never This topic pairs well with 7 AWS DevOps Engineer Professional Questions Most Candidates Get Wrong.
D. UnlessStopped
Answer: B
Explanation: OnFailure restarts the container only when the process exits with a non-zero exit code (crash), which meets the requirement. Always restarts even on successful completion, which is overkill. Never does not restart. UnlessStopped is a Docker Compose policy, not an ACI restart policy.
Question 7
You are implementing a background job that needs to run every 30 minutes to process files from an Azure Blob Storage container. The job must be idempotent and handle failures gracefully. Which Azure service should you use?
A. Azure Logic Apps with a recurrence trigger.
B. Azure Functions with a Timer trigger.
C. Azure WebJobs with a queue trigger.
D. Azure Batch with a schedule.
Answer: B
Explanation: Azure Functions with a Timer trigger is the simplest, most cost-effective way to run a periodic job, supporting retries and idempotent logic. Logic Apps are more for workflow orchestration and are heavier. WebJobs with a queue trigger responds to messages, not a schedule. Azure Batch is for large-scale parallel compute, not simple periodic tasks.
Question 8
You are developing a web app that stores sensitive data in Azure Blob Storage. You need to ensure that data is encrypted at rest and that the encryption keys are managed by your organization, not by Microsoft. Which feature should you use?
A. Server-side encryption with Microsoft-managed keys.
B. Server-side encryption with customer-managed keys (CMK) in Azure Key Vault.
C. Client-side encryption with a library like Azure Storage Encryption.
D. Transport Layer Security (TLS) for data in transit.
Answer: B
Explanation: CMK in Azure Key Vault allows you to bring your own key (BYOK) and control rotation and access, meeting the requirement. Option A uses Microsoft-managed keys, which you don't control. Option C encrypts data before sending it, but the question asks for at-rest encryption managed by your org—CMK is the standard Azure feature. Option D addresses data in transit, not at rest.
These questions cover key domains like compute, storage, security, and integration. To pass the AZ-204, you must not only know the correct service but also understand the trade-offs between options, as seen in the explanations above. Focus on hands-on practice with Azure CLI, ARM templates, and SDKs to solidify these concepts.
You can find free study plans and readiness checks that provide a schedule suited to your time and a quick check of weak topics.
Put your preparation to the test — try Developing Solutions for Microsoft Azure (AZ-204) mock exam that mirror the real exam format.