AZ-204 Practice Test 2 – 50 Questions and Answers (Azure Developer, Updated August 2026)

AZ-204 Practice Test 2: 50 Questions and Answers for Azure Developer (August 2026 Updated)

Updated August 1, 2026

Practice 50 AZ-204 questions covering the final exam objectives: Azure compute, Azure storage, application security, Application Insights, API Management, and event- and message-based integration.

Exam status: Microsoft retired AZ-204 on July 31, 2026. This archived practice test remains available for reviewing the final AZ-204 exam objectives.

Prepare for the current Azure AI Cloud Developer certification with these AI-200 practice tests:

• AI-200 Practice Test 1 – 50 Questions and Answers
• AI-200 Practice Test 2 – 50 Questions and Answers
• AI-200 Practice Test 3 – 50 Questions and Answers
• AI-200 Practice Test 4 – 50 Questions and Answers

Exam: AZ-204 (retired)Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-204 practice test questions

Question 1: A build pipeline must create a container image in Azure without maintaining a Docker host. Which Azure Container Registry capability should the pipeline use?

• ACR Tasks
• ACR repository locks
• Azure Container Instances restart policies
• App Service deployment slots

The correct answer is ACR Tasks.

ACR Tasks can build container images in Azure, removing the need for a locally managed Docker build host.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 2: An AKS workload must pull images from a private Azure Container Registry without storing registry passwords. What should you configure?

• An account SAS
• Managed identity access to ACR
• Anonymous pull access
• A storage connection string

The correct answer is Managed identity access to ACR.

Granting the cluster identity the AcrPull role enables passwordless image pulls from the private registry.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 3: A container must run once, exit successfully, and remain stopped. Which Azure Container Instances restart policy should you set?

• Always
• OnFailure
• Never
• Manual

The correct answer is Never.

The Never restart policy prevents ACI from restarting the container after a successful or failed exit.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 4: You need two containers to share a lifecycle, local network, and mounted volumes in Azure Container Instances. How should you deploy them?

• In one container group
• In separate subscriptions
• As App Service slots
• As ACR artifacts

The correct answer is In one container group.

Containers in the same ACI container group share a host, lifecycle, local network, and supported volumes.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 5: A Container Apps deployment must preserve the current revision while a new revision is tested with 10% of traffic. Which revision mode is required?

• Single
• Multiple
• Disabled
• Consumption-only

The correct answer is Multiple.

Multiple revision mode allows more than one active revision and supports weighted traffic splitting.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 6: An Azure Container App processes Service Bus messages and should scale to zero when the queue is empty. What should you configure?

• A KEDA-based scale rule
• An App Service autoscale profile
• An ACR webhook
• A VM scale set

The correct answer is A KEDA-based scale rule.

Container Apps uses KEDA-compatible rules to scale replicas from event sources and can scale to zero.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 7: You deploy an internal background worker to Azure Container Apps. It must not accept inbound HTTP traffic. What should you do?

• Enable external ingress
• Enable internal ingress
• Disable ingress
• Add an APIM policy

The correct answer is Disable ingress.

Ingress can be disabled for background or event-driven Container Apps that do not expose an HTTP endpoint.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 8: An App Service staging slot uses a test database connection that must not move during a slot swap. What should you configure?

• A deployment token
• A slot setting
• A scale-out rule
• A custom domain

The correct answer is A slot setting.

Marking the configuration value as a deployment slot setting keeps it with the source slot during a swap.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 9: You want an App Service package to be mounted read-only and avoid file-lock conflicts during deployment. Which setting should you use?

• WEBSITE_RUN_FROM_PACKAGE
• WEBSITE_NODE_DEFAULT_VERSION
• SCM_DO_BUILD_DURING_DEPLOYMENT
• FUNCTIONS_WORKER_RUNTIME

The correct answer is WEBSITE_RUN_FROM_PACKAGE.

WEBSITE_RUN_FROM_PACKAGE mounts the deployment package and avoids partial deployments and file-lock conflicts.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 10: An App Service plan must add instances when average CPU exceeds a threshold. What should you configure?

• Vertical scaling only
• Azure Monitor autoscale rules
• Traffic Manager priority routing
• A deployment slot swap

The correct answer is Azure Monitor autoscale rules.

Azure Monitor autoscale rules can change the App Service plan instance count in response to metrics.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 11: Application code needs a per-environment value exposed as an environment variable in App Service. Where should you store it?

• Application settings
• A host file
• The deployment history
• The pricing tier name

The correct answer is Application settings.

App Service application settings are injected as environment variables and can be configured per environment.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 12: An Azure Function must receive a BlobClient for the blob that triggered execution. Which feature should you use?

• An input binding
• An APIM backend
• A deployment slot
• An availability test

The correct answer is An input binding.

A Functions input binding can provide SDK types such as BlobClient for the triggering resource.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 13: A function must run every weekday at 02:00 UTC. Which trigger should you configure?

• HTTP trigger
• Timer trigger
• Event Grid trigger
• Service Bus trigger

The correct answer is Timer trigger.

A timer trigger uses an NCRONTAB schedule to invoke a function at defined times.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 14: A webhook endpoint implemented as an Azure Function should require a function-specific key. Which HTTP authorization level should you use?

• anonymous
• function
• system
• admin-only

The correct answer is function.

The function authorization level requires a function or host key while avoiding anonymous access.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 15: A globally distributed shopping-cart application needs read-your-writes behavior for each user session with lower latency than strong consistency. Which Cosmos DB consistency level fits?

• Eventual
• Consistent prefix
• Session
• Strong

The correct answer is Session.

Session consistency provides read-your-writes guarantees within a session and is the common default choice for user-centric applications.

Related Microsoft Learn topic

Develop for Azure storage

Question 16: A Cosmos DB container receives most requests for individual customers. Which partition key characteristic is most important?

• A low-cardinality constant
• High cardinality with even request distribution
• A value that changes frequently
• A property absent from many items

The correct answer is High cardinality with even request distribution.

A high-cardinality, evenly distributed partition key avoids hot partitions and supports scalable operations.

Related Microsoft Learn topic

Develop for Azure storage

Question 17: You must update a Cosmos DB item only if another client has not changed it since it was read. What should you send with the replace operation?

• The item TTL
• The partition range ID
• The ETag in an If-Match condition
• A continuation token

The correct answer is The ETag in an If-Match condition.

Using the current ETag with If-Match implements optimistic concurrency and rejects stale updates.

Related Microsoft Learn topic

Develop for Azure storage

Question 18: Several Cosmos DB item operations using the same partition key must succeed or fail atomically. Which SDK feature should you use?

• Bulk mode
• Transactional batch
• Change feed processor
• Cross-partition query

The correct answer is Transactional batch.

A transactional batch provides ACID semantics for operations within one logical partition.

Related Microsoft Learn topic

Develop for Azure storage

Question 19: Multiple application instances must cooperatively process Cosmos DB changes while tracking progress. What should you use?

• Change feed processor
• Stored procedure polling
• Blob inventory
• A strong consistency override

The correct answer is Change feed processor.

The change feed processor distributes work across instances and stores progress in a lease container.

Related Microsoft Learn topic

Develop for Azure storage

Question 20: You need to upload a local stream as one block blob by using the Azure Storage SDK. Which client is appropriate?

• QueueClient
• BlobClient
• ShareClient
• TableClient

The correct answer is BlobClient.

BlobClient provides upload operations for blob content and supports streams.

Related Microsoft Learn topic

Develop for Azure storage

Question 21: Blob metadata names are case-insensitive when they are accessed through Azure Storage.

• True
• False

The correct answer is True.

Azure Storage treats blob metadata names as case-insensitive, although SDKs may preserve their casing.

Related Microsoft Learn topic

Develop for Azure storage

Question 22: Blobs that have not been modified for 90 days should automatically move to the cool tier. What should you configure?

• A lifecycle management rule
• A container lease
• A stored access policy
• A change feed processor

The correct answer is A lifecycle management rule.

Blob lifecycle management can transition eligible block blobs based on age and other filters.

Related Microsoft Learn topic

Develop for Azure storage

Question 23: A distributed worker must obtain exclusive write access to a blob for a limited time. Which Blob Storage feature should it use?

• A blob lease
• A blob snapshot
• A user delegation key
• A lifecycle policy

The correct answer is A blob lease.

A blob lease establishes time-limited exclusive write and delete access.

Related Microsoft Learn topic

Develop for Azure storage

Question 24: A server-rendered web app signs in users and can safely keep a client secret. Which OAuth 2.0 flow should it use?

• Authorization code flow
• Device code flow
• Resource owner password flow
• Client credentials flow for the user

The correct answer is Authorization code flow.

Confidential web applications use the authorization code flow to obtain tokens on behalf of signed-in users.

Related Microsoft Learn topic

Implement Azure security

Question 25: A daemon service calls Microsoft Graph without a signed-in user. Which OAuth 2.0 flow is appropriate?

• Implicit flow
• Client credentials flow
• Device code flow
• Authorization code flow with PKCE only

The correct answer is Client credentials flow.

The client credentials flow issues app-only tokens to a confidential application.

Related Microsoft Learn topic

Implement Azure security

Question 26: API A receives a user token and must call API B while preserving the user's delegated identity. Which flow should API A implement?

• On-behalf-of flow
• Device code flow
• Managed identity for the user
• SAML bearer flow

The correct answer is On-behalf-of flow.

The on-behalf-of flow exchanges the incoming user token for a downstream API token.

Related Microsoft Learn topic

Implement Azure security

Question 27: An application calls Microsoft Graph only when a signed-in user is present. Which permission type should you configure?

• Delegated permission
• Application permission
• Azure RBAC data action
• Shared access signature

The correct answer is Delegated permission.

Delegated Microsoft Graph permissions act within the context and privileges of the signed-in user.

Related Microsoft Learn topic

Implement Azure security

Question 28: You must issue a Blob Storage SAS secured by Microsoft Entra credentials instead of the storage account key. Which SAS type should you create?

• Account SAS
• User delegation SAS
• Service SAS signed with the account key
• Stored access policy only

The correct answer is User delegation SAS.

A user delegation SAS is signed with a user delegation key obtained through Microsoft Entra ID.

Related Microsoft Learn topic

Implement Azure security

Question 29: Several service SAS tokens must be revocable without rotating the storage account key. What should the tokens reference?

• A stored access policy
• A blob snapshot
• An ETag
• A customer-managed key version

The correct answer is A stored access policy.

A stored access policy lets administrators change or revoke constraints for associated service SAS tokens.

Related Microsoft Learn topic

Implement Azure security

Question 30: Code running locally and in Azure should use developer credentials locally and managed identity after deployment. Which Azure Identity credential should you use?

• DefaultAzureCredential
• StorageSharedKeyCredential
• ClientSecretCredential with a committed secret
• AzureSasCredential

The correct answer is DefaultAzureCredential.

DefaultAzureCredential provides a credential chain suitable for local development and managed identity in Azure.

Related Microsoft Learn topic

Implement Azure security

Question 31: An App Service app needs secret access to Key Vault without stored credentials. What should you enable and authorize?

• Managed identity
• Anonymous access
• An account SAS
• A deployment slot only

The correct answer is Managed identity.

A managed identity lets the app obtain Microsoft Entra tokens without storing credentials; it still needs Key Vault permissions.

Related Microsoft Learn topic

Implement Azure security

Question 32: A non-secret configuration value in App Configuration points to a Key Vault secret. What resolves the referenced secret at runtime?

• The application using a Key Vault-aware configuration provider
• Azure DNS
• ACR Tasks
• The App Service deployment engine

The correct answer is The application using a Key Vault-aware configuration provider.

The application provider recognizes the Key Vault reference and retrieves the secret using its configured credential.

Related Microsoft Learn topic

Implement Azure security

Question 33: You need vendor-neutral instrumentation that exports traces and metrics to Azure Monitor Application Insights. Which standard should you use?

• OpenTelemetry
• SNMP
• WebDAV
• SAML

The correct answer is OpenTelemetry.

Azure Monitor supports OpenTelemetry-based instrumentation for collecting and exporting application telemetry.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 34: Requests cross several instrumented services and must appear as one end-to-end transaction. Which telemetry property enables correlation?

• A shared operation or trace identifier
• The deployment slot name
• The App Service plan SKU
• The storage account key

The correct answer is A shared operation or trace identifier.

Distributed tracing correlates telemetry by propagating common trace and operation identifiers.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 35: You need to query failed requests and their correlated exceptions in workspace-based Application Insights. What should you use?

• Kusto Query Language
• An ARM lock
• A SAS token
• An ACR task

The correct answer is Kusto Query Language.

KQL queries Application Insights tables and can join or correlate requests, exceptions, dependencies, and traces.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 36: You must periodically test a public HTTPS endpoint from multiple Azure locations. What should you configure?

• An Application Insights availability test
• A Service Bus topic
• A blob lease
• An App Service slot

The correct answer is An Application Insights availability test.

Availability tests run scheduled probes from selected locations and report endpoint availability and latency.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 37: Operations staff must be notified when failed-request metrics exceed a threshold. Which two Azure Monitor resources are required? Choose 2 answers.

• Alert rule
• Action group
• Deployment slot
• Consumer group
• Blob lifecycle rule

The correct answers are Alert rule and Action group.

The alert rule evaluates the condition and the action group defines notifications or automated responses.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 38: You have an OpenAPI document and need to expose the described endpoints through API Management. What is the fastest supported approach?

• Import the OpenAPI definition
• Create an Event Grid domain
• Upload it as a blob lifecycle policy
• Create one Function key per operation

The correct answer is Import the OpenAPI definition.

API Management can import an OpenAPI definition to create API operations and schemas.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 39: API Management must reject requests whose bearer token has the wrong issuer or audience. Which policy should you apply?

• validate-jwt
• rewrite-uri
• set-body
• cache-lookup

The correct answer is validate-jwt.

The validate-jwt policy verifies token signature and claims such as issuer and audience.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 40: Each API consumer has an independent identifier and must receive a separate request rate limit. Which APIM policy is appropriate?

• rate-limit-by-key
• set-header
• forward-request
• jsonp

The correct answer is rate-limit-by-key.

rate-limit-by-key maintains counters per supplied key, enabling consumer-specific throttling.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 41: An external API path must be translated before API Management forwards it to the backend. Which policy should you use?

• rewrite-uri
• validate-jwt
• return-response
• authentication-certificate

The correct answer is rewrite-uri.

rewrite-uri transforms the request path presented to the configured backend.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 42: An APIM policy needs a reusable backend URL that administrators can change without editing each policy. Where should it be stored?

• A named value
• A Service Bus session
• An Event Hubs partition
• A blob snapshot

The correct answer is A named value.

APIM named values centralize reusable values for policy expressions and configuration.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 43: Only Event Grid events whose subject begins with /orders/ should reach a handler. What should you configure?

• An event subscription subject filter
• An Event Hubs consumer group
• A Service Bus session
• An APIM product

The correct answer is An event subscription subject filter.

Event Grid event subscriptions support subject prefix and suffix filters as well as advanced filtering.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 44: Event Grid cannot deliver an event after its retry period. You need the event stored for later investigation. What should you configure?

• A dead-letter destination
• An ACR repository lock
• A deployment slot
• A Cosmos DB session token

The correct answer is A dead-letter destination.

Event Grid can dead-letter undeliverable events to a Blob Storage container.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 45: An Event Hubs consumer application needs an independent view of the event stream without affecting another application. What should you create?

• A consumer group
• A Service Bus rule
• An APIM revision
• A blob lease on the namespace

The correct answer is A consumer group.

Consumer groups provide independent offsets and views of an Event Hubs stream for separate consuming applications.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 46: Events for the same device must be routed consistently to the same Event Hubs partition. What should the producer specify?

• A partition key
• A lock token
• A subscription filter
• A SAS stored access policy

The correct answer is A partition key.

A partition key is hashed to select a partition consistently, preserving order for that key.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 47: A Service Bus receiver needs time to process a message and should make it visible again if processing fails. Which receive mode should it use?

• PeekLock
• ReceiveAndDelete
• BrowseOnly
• Eventual

The correct answer is PeekLock.

PeekLock holds a message temporarily and allows completion, abandonment, deferral, or dead-lettering.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 48: Related Service Bus messages must be processed in order by the same receiver. Which feature should you enable?

• Sessions
• Duplicate detection only
• Event Grid batching
• APIM revisions

The correct answer is Sessions.

Service Bus sessions provide ordered, stateful handling for messages sharing a session ID.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 49: A Service Bus message repeatedly fails processing and should be isolated for inspection. Where should it go?

• The dead-letter queue
• An Event Hubs partition
• An ACR repository
• An App Service slot

The correct answer is The dead-letter queue.

Dead-letter queues isolate messages that expire or cannot be processed successfully.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 50: A Queue Storage worker crashes after receiving a message. What normally allows another worker to retry it?

• The visibility timeout expires
• The message is immediately deleted
• The partition key changes
• An APIM retry policy runs

The correct answer is The visibility timeout expires.

Receiving a Queue Storage message makes it temporarily invisible; it becomes visible again if it is not deleted before the timeout.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services