Free Microsoft Certified: Azure Developer Associate (AZ-204) Sample Questions

Correct answer: B — Distributed Application Runtime (Dapr)

• A. Incorrect. Azure Service Fabric Mesh was a managed microservices platform that is now effectively retired. It is not an integrated feature of Azure Container Apps and does not provide the specific building blocks for mTLS, distributed tracing, and state management abstraction.
• B. Correct. Distributed Application Runtime (Dapr) is a portable, event-driven runtime that simplifies building microservice applications. It provides functionalities as 'building blocks' through sidecars, including service-to-service invocation with mTLS, state management, and distributed tracing. Azure Container Apps has first-class, built-in support for Dapr, allowing you to enable these features through configuration, which directly meets the requirement to handle these cross-cutting concerns with minimal code.
• C. Incorrect. The Azure Application Gateway Ingress Controller (AGIC) is a tool specifically for Azure Kubernetes Service (AKS) that manages external ingress traffic. Its purpose is to handle Layer 7 routing and load balancing for traffic entering the cluster, not to provide internal service-to-service communication features like mTLS, distributed tracing, or state management.
• D. Incorrect. While Open Service Mesh (OSM) is a service mesh for Kubernetes that can provide features like mTLS and observability, it does not offer the same high-level, application-focused building blocks as Dapr for concerns like state management or pub/sub. Dapr is the more comprehensive and deeply integrated solution within Azure Container Apps to address all the specified requirements.

Correct answers: B, C — The primary access key; The secondary access key

• A. Incorrect. The Subscription ID is a GUID that uniquely identifies your Azure subscription for billing and management purposes. It is not used as a credential for authenticating with an Azure Container Registry.
• B. Correct. When the admin user is enabled on an Azure Container Registry, a primary access key is generated. This key can be used as the password for the admin user account when authenticating with the Docker CLI.
• C. Correct. A secondary access key is also generated along with the primary key when the admin user is enabled. This key can be used interchangeably with the primary key as the password. The purpose of having two keys is to allow for credential rotation without service interruption.
• D. Incorrect. The registry login server name (e.g., corpdata.azurecr.io) is the URL or endpoint of the registry. It is used as the server address parameter in the `docker login` command, not as the password.
• E. Incorrect. The tenant ID identifies the Azure Active Directory (AAD) tenant associated with the subscription. While it's used in AAD-based authentication scenarios, it is not the password for the built-in admin user account.

Correct answer: A — True

• A. The statement is true because Azure Container Instances (ACI) natively supports mounting Azure File shares to provide persistent, stateful storage for containers. This is achieved using the 'azureFile' volume mount type. By setting an appropriate restart policy, such as 'Always', an ACI instance can be configured for long-running processes, making it a valid solution that meets all the specified requirements.
• B. The statement is false because the proposed solution is technically sound and directly meets the stated goal. Azure Container Instances (ACI) is designed to run containers and explicitly provides the 'azureFile' volume mount to persist data using Azure File shares. This capability is specifically intended for stateful and long-running applications. While other services like Azure Kubernetes Service (AKS) might offer more advanced scaling and management features, ACI is a perfectly valid and functional choice for the requirements as described.

Correct answer: B — Custom Handlers

• A. Incorrect. Azure Functions Proxies is a feature for creating a lightweight API gateway. It is used to define endpoints that route, reshape, or forward HTTP requests to other functions or external endpoints, not for executing custom code in non-natively supported languages.
• B. Correct. Custom Handlers are designed for this exact scenario. They allow the Azure Functions host to act as a proxy, forwarding trigger data via an HTTP request to a separate executable or web server that you provide. This enables you to implement function logic in any language that can run an HTTP server, such as Rust, while still leveraging the Azure Functions programming model for triggers and bindings.
• C. Incorrect. The in-process hosting model is specific to .NET functions running directly within the same process as the Functions host. This model does not support executing external executables or handlers written in other languages like Rust.
• D. Incorrect. Durable Functions is an extension for writing stateful, orchestrated, and long-running workflows. Its purpose is to manage state and complex execution flows, which is a separate concern from the language or hosting model of an individual function handler.

Correct answer: B — logging.applicationInsights.samplingSettings.maxTelemetryItemsPerSecond

• A. Incorrect. The `logging.fileLoggingMode` setting configures file-based logging for the Functions host, controlling how logs are written to the file system. It does not affect the telemetry data or sampling rate for Application Insights.
• B. Correct. Application Insights uses adaptive sampling to manage the volume of telemetry data. When traces are missing, it's often due to this sampling. The `logging.applicationInsights.samplingSettings.maxTelemetryItemsPerSecond` setting in `host.json` directly controls the rate limit for this sampling. Increasing this value allows more telemetry items to be sent per second, reducing the number of dropped traces and ensuring more complete data is captured in Application Insights.
• C. Incorrect. The `logging.applicationInsights.httpAutoCollectionOptions` setting is used to configure the automatic collection of HTTP request and response data. While it affects what HTTP-related telemetry is gathered, it does not control the overall sampling rate or throttling of telemetry items.
• D. Incorrect. The `logging.logLevel.default` setting determines the minimum severity level (e.g., Information, Warning, Error) of logs that will be recorded. It filters logs based on their level but does not affect the sampling rate of the telemetry that is sent to Application Insights. Changing this only affects *which* logs are generated, not *how many* are sent once generated.

Correct answer: A — True

• A. The statement is true because the Azure Cosmos DB trigger for Azure Functions is the correct mechanism to respond to changes in a Cosmos DB container. It leverages the Cosmos DB change feed, which captures inserts and updates. When a new item is added (an insert), the change feed processor detects this event and invokes the function. The lease container is a mandatory component that tracks the progress of reading the change feed, ensuring reliable and resilient processing across potentially multiple function instances.
• B. The statement is false because the proposed solution is indeed the correct and standard approach. The Azure Cosmos DB trigger is specifically designed to invoke a function based on events in a container's change feed, which includes the creation of new items.

Correct answers: A, B — Application Logging (Filesystem) automatically turns off after 12 hours.; Web Server Logging (Filesystem) has a configurable quota limit.

• A. Correct. Application Logging to the filesystem is intended for temporary debugging. To prevent the log files from consuming all available disk space on the instance, this feature automatically disables itself after 12 hours.
• B. Correct. When enabling Web Server Logging to the App Service filesystem, you can configure a quota in megabytes (MB). This setting limits the amount of disk space the logs can consume. Once the quota is reached, the oldest logs are deleted to make space for new ones.
• C. Incorrect. As stated for option A, Application Logging to the filesystem is not permanent and is automatically turned off after 12 hours.
• D. Incorrect. The 'Web Server Logging (Filesystem)' option writes logs to the local disk of the App Service instance. While logs can be streamed to Event Hubs, this is configured separately through 'Diagnostic settings' and is a different mechanism than filesystem logging.
• E. Incorrect. Detailed Error Messages are stored on the local filesystem of the App Service instance. Blob storage is an optional destination for other log types, such as Web Server Logs or Application Logs, for long-term retention, but it is not a requirement for Detailed Error Messages.

Correct answer: B — Azure Relay Hybrid Connections

• A. Incorrect. App Service VNet Integration allows an app to access resources inside an Azure Virtual Network. While this is a step towards on-premises connectivity, it does not by itself bridge the gap to the on-premises network. A connection like a VPN Gateway or ExpressRoute would still be required, which the question explicitly states to avoid.
• B. Correct. Azure Relay Hybrid Connections is specifically designed for this scenario. It works by installing a small agent, the Hybrid Connection Manager, on the on-premises network. This agent creates a secure outbound TLS connection to the Azure Relay service. The App Service can then use this relayed connection to access the on-premises SQL Server without needing a VPN, a public IP address on-premises, or any open inbound firewall ports.
• C. Incorrect. Service Endpoints are used to secure Azure PaaS services by extending a virtual network's private address space to the service. This restricts access to the Azure service so that it can only be reached from the specified VNet, but it does not provide a mechanism for connecting from Azure to on-premises resources.
• D. Incorrect. Private Link provides private connectivity from a virtual network to Azure PaaS services, customer-owned services, or Microsoft partner services using a Private Endpoint. It brings the service into your VNet, but it does not establish a connection from Azure out to an on-premises network without an existing site-to-site connection like a VPN or ExpressRoute.

Correct answer: A — Yes

• A. The statement is true because the `az webapp log tail` command is the correct Azure CLI command for streaming real-time logs from an Azure App Service instance. This includes application logs, web server logs, and any output sent to the console, such as `console.log` in a Node.js app. While logging must be enabled in the App Service configuration for the command to display data, the command itself is the correct tool for the task.
• B. The statement is false because the `az webapp log tail` command is the designated tool for achieving the goal of viewing real-time log traces from an App Service web app in the Azure CLI. The solution directly and correctly addresses the requirement.

Correct answer: C — Change the blob's access tier to Hot using `SetBlobTierAsync` with `High` priority.

• A. Incorrect. Changing the blob's access tier to Hot using `SetBlobTierAsync` with `Standard` priority will initiate a rehydration operation. However, Standard priority is a low-priority process that can take up to 15 hours to complete, which is not suitable for a critical report that requires immediate access.
• B. Incorrect. You cannot directly copy a blob that is in the Archive tier because the blob is offline. The `CopyBlobAsync` operation would fail. The blob must first be rehydrated to an online tier (Hot or Cool) before it can be read or copied.
• C. Correct. To access data in an archived blob, it must first be rehydrated to an online tier (Hot or Cool). The `SetBlobTierAsync` operation with `High` rehydration priority is the fastest method. For blobs under 10GB, this typically completes in under an hour, making it the most appropriate choice for urgent access requirements.
• D. Incorrect. Blobs in the Archive tier are considered offline and cannot be read directly. Attempting to use `DownloadAsync` on an archived blob will result in an error. The blob must be rehydrated to an online tier before any read or download operations can be performed.

Correct answer: B — The existing metadata is completely overwritten by the new metadata.

• A. The `SetMetadataAsync` method does not perform a merge operation; it performs a full replacement. To achieve a merge, a developer must first read the existing metadata, modify the collection in their code, and then call `SetMetadataAsync` with the complete, updated dictionary.
• B. This is correct. The `SetMetadataAsync` method completely overwrites all existing metadata on the blob with the new metadata dictionary provided in the call. Any metadata keys that existed previously but are not included in the new dictionary will be removed.
• C. The operation is designed to set or update metadata, so it does not fail if metadata already exists; it simply succeeds and replaces it. Failure would occur for other reasons like insufficient permissions, connectivity issues, or concurrency conflicts if conditional headers (like ETags) are used.
• D. This describes a partial update or 'patch' behavior, which is not how `SetMetadataAsync` functions. The method replaces the entire metadata collection, so any keys not specified in the new dictionary are removed from the blob.

Correct answer: C — Define one rule. Under `definition.actions.baseBlob`, set `delete`. Under `definition.actions.snapshot`, set `delete`.

• A. Incorrect. While it's possible to create two separate rules, it is unnecessary and less efficient. A single lifecycle management rule can be defined to include actions for both base blobs and their snapshots, applying the same filters to both.
• B. Incorrect. This configuration is incomplete because it only addresses the base blobs. It completely omits the required action to delete the snapshots associated with the blobs, failing to meet the full requirements of the data retention policy.
• C. Correct. The proper way to configure this policy is within a single rule. The rule's definition would contain an `actions` object with two child objects: `baseBlob` and `snapshot`. The `baseBlob` action would be set to `delete` when `daysAfterModificationGreaterThan` is 7, and the `snapshot` action would be set to `delete` when `daysAfterCreationGreaterThan` is 7.
• D. Incorrect. Deleting a base blob via a lifecycle policy does not automatically delete its associated snapshots. To ensure snapshots are also managed by the retention policy, you must explicitly define an action for snapshots within the rule, such as deleting them based on their creation date.

Correct answer: A — Set `prefixMatch` to `["documents/archive/2023/"]`.

• A. Correct. Lifecycle Management rules are defined at the storage account level. Therefore, the `prefixMatch` filter must specify the full path from the container name downwards. The format `containerName/prefix` is used to target blobs. In this scenario, `documents/archive/2023/` correctly scopes the rule to apply only to blobs inside the `documents` container whose names begin with the `archive/2023/` prefix.
• B. Incorrect. The `blobIndexMatch` filter is used for matching based on user-defined blob index tags (key-value pairs), not for specifying container names. Furthermore, omitting the container name from the `prefixMatch` value would make the rule unable to correctly target the intended blobs within the `documents` container.
• C. Incorrect. The `blobIndexMatch` filter is exclusively used for filtering blobs based on their index tags. It cannot be used to filter based on a blob's name or path prefix and does not accept a simple string path as a value.
• D. Incorrect. While using tags is a valid filtering mechanism, this approach is flawed. A `prefixMatch` of `["documents"]` would target containers whose names start with 'documents', not the blobs within the `documents` container. To target all blobs in the container, the prefix would need to be `["documents/"]`. Using the full prefix `documents/archive/2023/` is the direct, intended, and most efficient method for this requirement, avoiding the overhead of adding and managing tags.

Correct answer: A — ReadItemAsync<Product>("prod-101", new PartitionKey("electronics"))

• A. This method performs a point read, which is the most efficient operation for retrieving a single item in Azure Cosmos DB. By providing both the item's ID ('prod-101') and its partition key ('electronics'), the database can directly locate and retrieve the document without engaging the query engine. This results in the lowest possible RU consumption and latency.
• B. This method executes a SQL query. Although the query filters by both the item ID and the partition key, it must still be parsed and processed by the query engine. This process consumes more RUs compared to a direct point read operation.
• C. This method uses a LINQ query. The Cosmos DB SDK translates the LINQ expression into a SQL query before executing it. Similar to option B, this involves the overhead of the query engine and is therefore less RU-efficient than a direct point read using `ReadItemAsync`.
• D. `ReadManyItemsAsync` is a method designed to efficiently read multiple items from the same logical partition in a single batch request. While useful for retrieving multiple items, it incurs more overhead than `ReadItemAsync` when the goal is to retrieve only a single item. For this specific scenario, a point read is the most RU-efficient choice.

Correct answers: A, B — All items must share the same partition key; The total payload size must not exceed 2 MB

• A. Correct. All operations within a `TransactionalBatch` must target items within the same logical partition. A logical partition is defined by a unique partition key value. This constraint is fundamental because Cosmos DB guarantees ACID properties for transactions only within a single logical partition.
• B. Correct. Azure Cosmos DB imposes a service-side limit on the size of a `TransactionalBatch` request. The total payload size of the entire batch request body cannot exceed 2 MB. This limit constrains the combined size of all operations and their associated data within a single batch to ensure performance and reliability.
• C. Incorrect. A `TransactionalBatch` is scoped to a single container and, more specifically, to a single logical partition within that container. It cannot span multiple containers or multiple logical partitions.
• D. Incorrect. A `TransactionalBatch` provides atomicity, meaning it follows an 'all-or-nothing' principle. The entire set of operations either succeeds or fails together as a single unit of work. This is the opposite of eventual execution, providing strong transactional consistency for the operations in the batch.

Correct answer: A — Override the consistency level to Eventual via `QueryRequestOptions`

• A. This is the correct approach. Azure Cosmos DB allows you to specify a weaker consistency level for an individual request than the account's default level. By overriding the consistency to Eventual for this specific query using `QueryRequestOptions`, you can significantly reduce its Request Unit (RU) cost. Eventual consistency is the least expensive model as it offers the loosest consistency guarantees. Since the reporting tool can tolerate data lag, this is the most cost-effective solution that isolates the change to only the request that needs it.
• B. Changing the account-wide consistency level to Eventual is incorrect. This would affect all operations against the Cosmos DB account, which could be disruptive to other parts of the application that rely on the stronger guarantees of Session consistency. The principle is to make the most granular change possible, which is at the request level, not the account level.
• C. Using `ReadItemAsync` is incorrect because this method is for point reads—retrieving a single item by its ID and partition key. The scenario requires running a 'heavy aggregation query,' which processes multiple documents. `ReadItemAsync` cannot perform aggregations and is therefore not a viable solution for this requirement.
• D. Increasing the provisioned throughput is incorrect as it directly contradicts the goal of minimizing cost. While raising the throughput could prevent the query from being throttled, it does not reduce the RU cost of the query itself. It would increase the overall hourly cost of the Cosmos DB resource.

Correct answer: A — True

• A. The statement is true because Session consistency is specifically designed to guarantee 'read-your-own-writes' within a logical session. This is achieved through a session token that the client application receives after a write operation. The client must then pass this token with subsequent read requests. This mechanism works across globally distributed regions. As long as the application correctly maintains and uses the session token when the user switches read regions, Azure Cosmos DB will ensure the read operation is served from a replica that reflects the user's prior write, thus meeting the goal.
• B. The statement is false. Session consistency is the appropriate choice for this scenario. It provides monotonic reads, monotonic writes, and read-your-writes guarantees for a client session. While it requires the client application to manage a session token, this is the intended design for achieving read-your-writes consistency across regions without incurring the higher latency and cost of Strong consistency.

Correct answer: B — The middleware caches the flags; the default expiration is 30 seconds.

• A. Incorrect. The Azure App Configuration provider uses a pull-based model with caching by default. While integration with Event Grid for a push model is possible for near-instant updates, it requires explicit configuration and is not the default behavior of the `FeatureManager`.
• B. Correct. To optimize performance and reduce requests to the App Configuration service, the .NET provider caches configuration data, including feature flags, in-memory. The default cache expiration time for this data is 30 seconds, after which the next request to the application will trigger a background refresh.
• C. Incorrect. Although the middleware does cache the feature flags, the default expiration time is 30 seconds, not 5 minutes. While you can configure a longer cache duration like 5 minutes, it is not the default setting.
• D. Incorrect. The middleware for Azure App Configuration does cache feature flags in-memory by default. An external distributed cache like Redis is not required for basic functionality but can be implemented for advanced scenarios, such as ensuring consistency across multiple instances of a scaled-out application.

Correct answer: B — http://169.254.169.254/metadata/identity/oauth2/token

• A. Incorrect. This is the standard Azure Active Directory (Azure AD) token endpoint. It is used for authentication flows like client credentials (with a client ID and secret/certificate) or interactive user flows, but it is not the endpoint used by a resource's Managed Identity to obtain a token from within the resource itself.
• B. Correct. This is the Azure Instance Metadata Service (IMDS) endpoint. It is accessible from within an Azure VM at the special, non-routable IP address 169.254.169.254. Applications running on the VM can make a direct REST API call to this endpoint to request an access token for the VM's managed identity. The request must include a `Metadata: true` header to prevent server-side request forgery (SSRF) attacks, along with query parameters for the API version and the target resource (e.g., `resource=https://vault.azure.net`).
• C. Incorrect. The `management.azure.com` domain is the endpoint for the Azure Resource Manager (ARM) API, which is used for management operations on Azure resources. It is not used for retrieving access tokens for a Managed Identity from within a VM.
• D. Incorrect. This is not a valid endpoint for retrieving Managed Identity tokens on an Azure VM. The standard, well-known endpoint for the IMDS is the link-local address `169.254.169.254`, not a `localhost` address.

Correct answer: A — True

• A. The statement is true because the proposed solution is the recommended best practice. Enabling a system-assigned managed identity creates a secure, automatically managed identity for the App Service in Azure Active Directory. This eliminates the need to store and manage credentials in application code or configuration. Assigning the 'Key Vault Secrets User' role to this identity via Azure RBAC grants the application the specific, least-privilege permission required to read secrets, fulfilling both the security and maintenance-free requirements.
• B. The statement is false because the proposed solution is a valid and effective method for achieving the goal. It correctly uses a system-assigned managed identity for automated credential management and assigns an appropriate RBAC role for least-privilege access, which is the modern, secure, and maintenance-free approach for Azure service-to-service communication.

Correct answer: B — Application permissions with Client Credentials Flow

• A. Incorrect. Delegated permissions require the application to act on behalf of a signed-in user. The Authorization Code Flow is designed for interactive scenarios where a user signs in and grants consent. This is unsuitable for a background daemon service that runs without any user interaction.
• B. Correct. Application permissions allow an application to access resources using its own identity, without a signed-in user. This is necessary for a daemon service that needs to access data for all users in a tenant (e.g., using the User.Read.All permission). The Client Credentials Flow is the standard OAuth 2.0 flow for server-to-server interactions and daemon applications to obtain an app-only access token using their client ID and a secret or certificate.
• C. Incorrect. The On-Behalf-Of (OBO) flow is a delegated permission scenario used when a middle-tier service, which has received an access token from a client app, needs to call another downstream API on behalf of the original user. This flow requires an initial user context and is not applicable to a non-interactive daemon service.
• D. Incorrect. The Implicit Flow is designed for browser-based single-page applications (SPAs) and is used to obtain tokens for a signed-in user. It is not suitable for a secure, server-side background service. Furthermore, Implicit Flow is used for delegated permissions, not application permissions, and it is generally recommended to use the Authorization Code Flow with PKCE instead for modern SPAs.

Correct answer: A — Enable App Service Authentication (Easy Auth) and configure Microsoft Entra ID as the provider.

• A. This is the correct solution. App Service Authentication, often called 'Easy Auth', is a platform-level feature that requires no application code changes. You can configure it directly in the Azure portal to use Microsoft Entra ID as the identity provider. It intercepts all incoming requests, enforces authentication, and ensures only users from your specified Entra ID tenant can access the web app, handling all the complexities of token validation.
• B. This is incorrect. Implementing MSAL.NET is a code-based approach. It requires using the Microsoft Authentication Library within your application to manage the sign-in process and token acquisition. This directly contradicts the requirement of not writing any authentication code.
• C. This is incorrect. IP restriction rules operate at the network layer, limiting access based on the client's IP address. This method does not authenticate individual users or verify their membership in an Entra ID tenant. It is a network security measure, not an identity-based authentication solution.
• D. This is incorrect. Client certificate authentication validates a certificate presented by the client, not a user's identity against Microsoft Entra ID. This method does not meet the requirement to restrict access based on an organization's Entra ID tenant.

Correct answer: C — sip

• A. The 'spr' (Signed Protocols) parameter is used to specify which protocols (e.g., HTTPS only, or both HTTP and HTTPS) are permitted for a request made with the SAS. It does not restrict access based on the client's IP address.
• B. The 'sig' (Signature) parameter is required and contains the signature that authenticates the SAS token. It is used to verify that the token has not been tampered with but does not control the source IP address of the request.
• C. The 'sip' (Signed IP) parameter is the correct option. It specifies an allowed public IP address or a range of public IP addresses (in CIDR format) from which requests will be accepted. Requests originating from an IP address that doesn't match the value in this parameter will be rejected.
• D. The 'sv' (Signed Version) parameter indicates the storage service version used to construct and validate the SAS token. While it affects supported features, it does not impose any network or IP address restrictions.

Correct answer: C — Live Metrics

• A. Incorrect. Metrics Explorer is used for plotting metrics on charts, visually correlating trends, and investigating spikes and dips in metric values. While it is near-real-time, its typical latency is several seconds, which does not meet the sub-second requirement for live deployment monitoring.
• B. Incorrect. Log Analytics is a powerful tool for running complex queries against collected logs and telemetry. However, it is not suitable for real-time monitoring due to data ingestion and indexing latency, which can range from seconds to several minutes.
• C. Correct. Live Metrics, also known as Live Metrics Stream, is the feature in Application Insights specifically designed for this purpose. It provides a live, interactive stream of key performance indicators and telemetry with a latency of about one second, making it ideal for monitoring an application's health during a new deployment.
• D. Incorrect. The Performance blade in Application Insights provides aggregated performance data and helps diagnose slow operations and performance bottlenecks over time. It is used for historical analysis rather than providing a live, sub-second stream of telemetry.

Correct answer: B — The Operation ID (traceparent)

• A. Incorrect. The Instrumentation Key is a configuration value that identifies the specific Application Insights resource where telemetry should be sent. It is not a correlation identifier and should not be propagated in message headers between services.
• B. Correct. To enable distributed tracing across asynchronous boundaries like a message queue, a correlation context must be passed from the producer to the consumer. This context is typically propagated using the W3C Trace Context standard header, `traceparent`, which contains the Operation ID. By including this in the message, Application Insights can link the producer's telemetry with the consumer's, allowing it to render the complete end-to-end transaction in the Application Map.
• C. Incorrect. The User ID is used to associate telemetry events with a specific user for usage analysis. It does not provide the necessary context to correlate operations between different services in a distributed system.
• D. Incorrect. The Subscription ID is an Azure administrative identifier for billing and resource management. It is unrelated to application-level telemetry correlation and provides no context for distributed tracing.

Correct answer: A — Snapshot Debugger

• A. Correct. The Application Insights Snapshot Debugger is specifically designed for this scenario. It captures a lightweight snapshot of the application's state, including the call stack and local variable values, at the exact moment an exception is thrown in a production environment. This allows for post-mortem debugging without attaching a live debugger, thus minimizing the performance impact on the running application.
• B. Incorrect. Remote Debugging involves attaching a live debugger like Visual Studio to the running process. This is invasive, pauses the application's execution, and is generally unsuitable for production environments, especially for intermittent failures, due to performance, security, and availability concerns.
• C. Incorrect. The Application Insights Profiler is a tool for performance analysis. It helps identify performance bottlenecks by collecting data on CPU usage, memory consumption, and method execution times, but it does not capture the state of local variables at the point of an exception.
• D. Incorrect. IntelliTrace is a historical debugging feature within Visual Studio Enterprise used during development and testing. While it records execution history, the Snapshot Debugger is the modern, purpose-built, and supported solution for capturing exception snapshots in Azure production environments like Azure Functions.

Correct answer: C — Azure Service Bus Premium Tier

• A. Incorrect. Azure Queue Storage has a maximum message size limit of 64 KB. This is far too small for the requirement of handling messages larger than 1 MB.
• B. Incorrect. The Azure Service Bus Standard tier has a maximum message size of 256 KB. This does not meet the requirement of supporting messages in the 1 MB to 50 MB range.
• C. Correct. The Azure Service Bus Premium tier is the appropriate choice as it supports a maximum message size of 100 MB. This comfortably accommodates the required message size of 1 MB to 50 MB. The Premium tier also offers dedicated resources for predictable performance and higher throughput, which is suitable for processing large messages.
• D. Incorrect. Azure Event Grid is designed for lightweight, event-based notifications and has a maximum event size limit of 1 MB. It cannot be used for messages that are larger than 1 MB.

Correct answer: D — 32

• A. Incorrect. While you can retrieve 10 messages, this is not the maximum limit. The Azure Queue Storage service allows for retrieving larger batches in a single call to improve efficiency and throughput.
• B. Incorrect. It is possible to retrieve 20 messages in one request, but this does not represent the upper limit set by the Azure Queue Storage service.
• C. Incorrect. This value is close to the maximum, but the actual service limit for a single message retrieval operation is slightly higher.
• D. Correct. The Azure Queue Storage service allows retrieving a maximum of 32 messages in a single `ReceiveMessagesAsync` (or equivalent) API call. For an Azure Function with a queue trigger, this corresponds to the maximum configurable `batchSize` in the `host.json` file.

Correct answer: B — False

• A. The statement is false. While a simple, non-partitioned Service Bus queue with a single receiver often behaves in a FIFO manner, this is not a strict guarantee. Factors like competing consumers, deferred messages, or network retries can lead to messages being processed out of order.
• B. The statement is false. To achieve a strict FIFO guarantee in Azure Service Bus, especially with multiple competing consumers or when using partitioned entities, you must use the Message Sessions feature. Sessions group related messages and ensure they are delivered to a single receiver in the exact order they were sent, effectively creating a sub-queue with guaranteed ordering.

Correct answer: A — Enable the 'Subscription required' setting in the API settings.

• A. This is the correct and primary method for enforcing subscription key usage in Azure API Management. When an API is associated with a product, this setting ensures that the APIM gateway will reject any incoming request that does not include a valid subscription key, which is typically passed in the 'Ocp-Apim-Subscription-Key' header or as a query parameter.
• B. Incorrect. The 'validate-jwt' policy is used to secure an API by validating a JSON Web Token (JWT) provided by the client. This is a common requirement when using authentication schemes like OAuth 2.0 or OpenID Connect, but it does not validate the built-in API Management subscription keys.
• C. Incorrect. Client certificate authentication is a separate security mechanism, also known as mutual TLS (mTLS). It requires the client to present a valid digital certificate to the API Management gateway for authentication. This is different from and does not involve the use of subscription keys.
• D. Incorrect. The 'ip-filter' policy provides network-level security by allowing or denying requests based on the caller's IP address. It is used for access control based on network location, not for validating credentials like a subscription key.

Correct answer: A — retry

• A. Correct. The `retry` policy in Azure API Management is specifically designed to handle transient backend errors by re-executing its enclosed policies if a condition is met. It can be configured with a specific number of retries (`count`) and various backoff strategies, including fixed or exponential backoff, making it the ideal solution for this scenario.
• B. Incorrect. The `circuit-breaker` policy is a different resiliency pattern. Its purpose is to protect a failing backend service from being overwhelmed by stopping requests to it for a period after a certain threshold of failures is reached. It prevents repeated calls, rather than retrying them.
• C. Incorrect. The `forward-request` policy is the core policy used in the backend section to send the incoming request to the configured backend service. It does not have any built-in retry logic for handling transient failures.
• D. Incorrect. The `wait` policy simply introduces a delay in the request processing pipeline. While it could be used within a `retry` policy to manually configure the interval between attempts, it does not perform the retry action itself.

Correct answer: A — choose / when / otherwise

• A. Correct. The `choose` policy is the primary control flow statement in Azure API Management for conditional logic. It functions like a switch statement or an if-else if-else chain. You can use multiple `<when>` elements to check for different values of the `X-Region` header and route accordingly, with an optional `<otherwise>` block for a default case. This is the standard and most appropriate policy for this scenario.
• B. Incorrect. Azure API Management policies do not have a policy element named `if / then / else`. The conceptual equivalent is achieved using the `choose / when / otherwise` structure.
• C. Incorrect. While functionally similar, `switch / case` is not a valid policy name in Azure API Management. The correct policy that provides switch-like functionality is `choose / when / otherwise`.
• D. Incorrect. The `for-each` policy is used to iterate over a collection of items and apply a set of policies to each item. It is not designed for conditional branching based on the value of a single request header.

Correct answer: C — Azure Event Hubs

• A. Incorrect. Azure Event Grid is an event routing service designed for reactive programming with discrete events. It is not built for high-throughput, ordered event streaming like telemetry data ingestion and lacks the built-in long-term retention and replay capabilities required.
• B. Incorrect. Azure Service Bus is an enterprise message broker designed for high-value, transactional messages. While it supports pub/sub with Topics, it is not optimized for the massive scale and high-throughput ingestion of telemetry data from thousands of sensors. It also lacks native features like data capture to a data lake for archival.
• C. Correct. Azure Event Hubs is a big data streaming platform and event ingestion service, specifically designed to handle millions of events per second from sources like IoT devices. It provides a partitioned consumer model for high throughput, integrates seamlessly with Azure Stream Analytics for real-time analysis, supports a configurable retention period (up to 7 days on the Standard tier) allowing for event replay, and has a 'Capture' feature to automatically archive data to Azure Data Lake Storage.
• D. Incorrect. Azure Queue Storage provides a simple, reliable queuing service for asynchronous communication between application components. It is not designed for high-volume event streaming and lacks the necessary features like pub/sub, native integration with Stream Analytics, or time-based retention for replay.

Correct answers: A, C, D — id; eventType; eventTime

• A. Correct. The `id` property is a mandatory, publisher-defined string that uniquely identifies the event. It is crucial for downstream consumers to handle duplicates and for event tracing.
• B. Incorrect. The `topic` property, which contains the full resource path to the event source, is added by the Event Grid service itself after receiving the event. It is not a field that the publisher must provide in the JSON payload sent to the topic endpoint.
• C. Correct. The `eventType` property is a mandatory string that indicates the type of event that occurred (e.g., 'MyApp.User.Created'). Subscribers use this field to filter and route events to the appropriate handlers.
• D. Correct. The `eventTime` property is a mandatory field that records the time the event was generated by the publisher. It must be in the UTC ISO 8601 format and is essential for ordering and time-based processing of events.
• E. Incorrect. While the official Microsoft documentation specifies `dataVersion` as a required field for defining the schema version of the `data` object, this question asks to select three fields. The properties `id`, `eventType`, and `eventTime` are arguably the most fundamental to the event envelope and are universally required. Given the constraint to select three, `id`, `eventType`, and `eventTime` are the best choices.
• F. Incorrect. A Shared Access Signature (SAS) token is an authentication mechanism used to authorize the publishing of an event. It is provided in the HTTP request headers (e.g., `aeg-sas-token`), not as a property within the JSON event payload itself.

Correct answer: A — True

• A. The statement is true because Azure Event Grid supports two methods for validating a webhook endpoint. The method described, known as the asynchronous handshake, involves parsing the `SubscriptionValidationEvent` data to find the `validationUrl` and sending an HTTP GET request to that URL. This successfully completes the validation handshake, confirming that the endpoint is ready to receive events.
• B. The statement is false because the described procedure is a valid, documented way to handle Event Grid subscription validation. While an alternative synchronous method exists where you extract a `validationCode` from the event and return it in the response, the existence of this second method does not invalidate the `validationUrl` approach.