AZ-204 Practice Test 3 – 50 Questions and Answers (Azure Developer, Updated August 2026)

AZ-204 Practice Test 3: 50 Questions and Answers for Azure Developer (August 2026 Updated)

Updated August 1, 2026

Practice 50 AZ-204 questions covering the final exam objectives: Azure compute, Azure storage, application security, Application Insights, API Management, and event- and message-based integration.

Exam status: Microsoft retired AZ-204 on July 31, 2026. This archived practice test remains available for reviewing the final AZ-204 exam objectives.

Prepare for the current Azure AI Cloud Developer certification with these AI-200 practice tests:

• AI-200 Practice Test 1 – 50 Questions and Answers
• AI-200 Practice Test 2 – 50 Questions and Answers
• AI-200 Practice Test 3 – 50 Questions and Answers
• AI-200 Practice Test 4 – 50 Questions and Answers

Exam: AZ-204 (retired)Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-204 practice test questions

Question 1: A global application needs low-latency pulls from one logical registry in several Azure regions. Which ACR feature should you configure?

• Geo-replication
• Blob snapshots
• Deployment slots
• Queue geo-fencing

The correct answer is Geo-replication.

Premium Azure Container Registry supports geo-replication so images are served from regional replicas.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 2: A deployment pipeline should start whenever a new image is pushed to a registry repository. Which ACR feature can notify the pipeline endpoint?

• Webhook
• Lease
• Consumer group
• Availability test

The correct answer is Webhook.

ACR webhooks send notifications for supported repository events such as image pushes.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 3: A batch container should restart only when its process exits with an error. Which ACI restart policy is correct?

• Always
• OnFailure
• Never
• Replica

The correct answer is OnFailure.

OnFailure restarts the container after a nonzero exit while leaving successful executions stopped.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 4: Two containers in one ACI group need to communicate privately. Which address should one container use for the other?

• localhost and the exposed container port
• A public load balancer IP
• An APIM gateway URL
• An ACR login server

The correct answer is localhost and the exposed container port.

Containers in an ACI group share a network namespace and can communicate over localhost.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 5: You need to route 80% of Container Apps ingress traffic to a stable revision and 20% to a candidate revision. What should you configure?

• Revision traffic weights
• A blob lifecycle rule
• A Service Bus filter
• An ACR retention lock

The correct answer is Revision traffic weights.

Container Apps supports percentage-based traffic weights across active revisions.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 6: A scheduled container task must run to completion every night without exposing a continuously running endpoint. Which resource should you use?

• Azure Container Apps job
• App Service deployment slot
• Event Hubs consumer group
• APIM product

The correct answer is Azure Container Apps job.

Container Apps jobs are designed for finite manual, scheduled, or event-driven executions.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 7: A web app deployment package is ready and should be pushed directly through the App Service deployment endpoint. Which deployment method fits?

• ZIP deploy
• Event Grid delivery
• Cosmos DB bulk mode
• Service Bus forwarding

The correct answer is ZIP deploy.

ZIP deploy sends an application package to the App Service deployment service for extraction or package execution.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 8: An App Service instance should be removed from load balancing when its application health endpoint fails. Which feature should you enable?

• Health check
• Deployment Center only
• A blob lease
• ACR quarantine

The correct answer is Health check.

App Service Health check probes a configured path and can remove unhealthy instances from routing.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 9: You need a free, App Service-managed TLS certificate for a supported custom domain. Which certificate option should you choose?

• App Service managed certificate
• A user delegation key
• An Event Grid certificate
• A function host key

The correct answer is App Service managed certificate.

App Service managed certificates provide platform-managed TLS for eligible custom domains.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 10: A Web App must stream application log output for immediate troubleshooting. Which App Service capability should you enable?

• Application logging and log stream
• ACR geo-replication
• Cosmos DB change feed
• Queue Storage logging only

The correct answer is Application logging and log stream.

App Service diagnostic logging and Log stream expose application output for live troubleshooting.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 11: An HTTP-triggered function on a Premium plan must avoid cold starts. What should you configure?

• Always-ready/prewarmed instances
• A blob snapshot
• ReceiveAndDelete mode
• An APIM mock response

The correct answer is Always-ready/prewarmed instances.

Premium plans maintain prewarmed instances, which reduces or removes cold-start latency.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 12: A Functions app must use extension configuration shared across all functions. Which file contains host-wide runtime settings?

• host.json
• function.json only
• web.config only
• local.settings.json in production

The correct answer is host.json.

host.json contains runtime and extension settings that apply to the entire function app.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 13: A compiled Azure Function needs declarative input and output integration with a storage queue. What should the code define?

• Trigger and binding attributes
• An ARM delete lock
• An APIM subscription
• An ACR webhook

The correct answer is Trigger and binding attributes.

Functions uses trigger and binding declarations, commonly attributes in compiled languages, to connect code to services.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 14: A function must react when a message arrives in an Azure Service Bus queue. Which trigger is required?

• Service Bus trigger
• Timer trigger
• HTTP output binding
• Blob lifecycle trigger

The correct answer is Service Bus trigger.

The Service Bus trigger invokes a function when messages arrive on the configured queue or topic subscription.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 15: A Cosmos DB read operation requires the strongest guarantee only for one request, while the account default is weaker. What should the client do?

• Set a per-request consistency override supported by the account
• Recreate the account
• Change the partition key
• Use a blob lease

The correct answer is Set a per-request consistency override supported by the account.

Cosmos DB SDK requests can override consistency to a level no stronger than the account configuration.

Related Microsoft Learn topic

Develop for Azure storage

Question 16: You know both the Cosmos DB item ID and partition key. Which operation typically minimizes RU charge and latency?

• Point read
• Cross-partition SQL query
• Change feed scan
• Stored procedure enumeration

The correct answer is Point read.

A point read addresses one item by ID and partition key and is generally the most efficient read.

Related Microsoft Learn topic

Develop for Azure storage

Question 17: Only two properties of a large Cosmos DB item need changing. Which SDK operation avoids replacing the full document?

• Patch item
• Read all partitions
• Recreate container
• Change feed estimation

The correct answer is Patch item.

Patch operations update selected JSON paths without sending a full replacement document.

Related Microsoft Learn topic

Develop for Azure storage

Question 18: Cosmos DB documents should expire automatically 24 hours after creation. Which container or item feature should you set?

• Time to live
• ETag locking
• Session token
• Indexing exclusion only

The correct answer is Time to live.

Cosmos DB TTL automatically removes items after the configured number of seconds.

Related Microsoft Learn topic

Develop for Azure storage

Question 19: A variable Cosmos DB workload needs throughput that automatically scales up to a configured maximum. Which throughput mode should you choose?

• Autoscale throughput
• Manual throughput only
• Server-side JavaScript lock
• Strong consistency

The correct answer is Autoscale throughput.

Autoscale throughput adjusts provisioned RU/s with workload demand up to the configured maximum.

Related Microsoft Learn topic

Develop for Azure storage

Question 20: A large file must be uploaded reliably as independently retriable blocks before it becomes visible as one blob. Which blob type and operation model fit?

• Block blob with stage-block and commit-block-list
• Append blob snapshots only
• Page blob leases only
• Queue messages

The correct answer is Block blob with stage-block and commit-block-list.

Block blobs support staging blocks independently and committing an ordered block list.

Related Microsoft Learn topic

Develop for Azure storage

Question 21: You need to restore the exact previous contents of a blob after it was overwritten. Which enabled feature provides prior immutable versions?

• Blob versioning
• Blob metadata
• Container public access
• A consumer group

The correct answer is Blob versioning.

Blob versioning automatically retains previous versions when a blob is modified or deleted.

Related Microsoft Learn topic

Develop for Azure storage

Question 22: A point-in-time, read-only copy of a blob is needed before a risky transformation. What should you create?

• A blob snapshot
• A queue lease
• A Cosmos DB partition
• An APIM revision

The correct answer is A blob snapshot.

A blob snapshot captures a read-only version of a blob at a specific time.

Related Microsoft Learn topic

Develop for Azure storage

Question 23: You must find blobs by searchable key-value attributes without listing every blob. Which feature should you use?

• Blob index tags
• Blob metadata only
• File share ACLs
• Queue pop receipts

The correct answer is Blob index tags.

Blob index tags are indexed and support server-side filtering across blobs.

Related Microsoft Learn topic

Develop for Azure storage

Question 24: A public native application uses authorization code flow and cannot safely store a secret. Which extension should it use?

• PKCE
• Client credentials
• A storage account key
• SAML metadata only

The correct answer is PKCE.

PKCE protects authorization codes for public clients without relying on a client secret.

Related Microsoft Learn topic

Implement Azure security

Question 25: An API exposes delegated operations such as Orders.Read. What type of Microsoft identity platform permission is Orders.Read?

• OAuth 2.0 scope
• Azure resource lock
• Managed identity
• SAS permission string

The correct answer is OAuth 2.0 scope.

Delegated API permissions are represented as OAuth 2.0 scopes requested by client applications.

Related Microsoft Learn topic

Implement Azure security

Question 26: An API must authorize application-only callers according to an assigned value such as Orders.Writer. What should the API define?

• App roles
• Blob access tiers
• Function keys
• Event Hubs partitions

The correct answer is App roles.

App roles can be assigned to applications and appear in the roles claim of app-only access tokens.

Related Microsoft Learn topic

Implement Azure security

Question 27: A tenant administrator must approve high-privilege Microsoft Graph application permissions. What process is required?

• Admin consent
• Blob lease acquisition
• APIM revision activation
• ACR import

The correct answer is Admin consent.

Microsoft Graph application permissions and sensitive delegated permissions commonly require tenant admin consent.

Related Microsoft Learn topic

Implement Azure security

Question 28: You need strongly typed access to Microsoft Graph resources and automatic request construction. What should the application use?

• Microsoft Graph SDK
• Storage REST API
• KEDA scaler
• Application Insights profiler

The correct answer is Microsoft Graph SDK.

The Microsoft Graph SDK provides generated clients, models, authentication integration, and request handling.

Related Microsoft Learn topic

Implement Azure security

Question 29: A client must access blobs in one container for a limited period using permissions signed with the storage account key. Which token is appropriate?

• Service SAS
• User delegation SAS only
• OAuth ID token
• Cosmos DB session token

The correct answer is Service SAS.

A service SAS delegates limited access to one storage service resource and can be signed with the account key.

Related Microsoft Learn topic

Implement Azure security

Question 30: An application needs to load an X.509 certificate and its private key securely from Azure Key Vault. Which Key Vault client area should it use?

• Certificates together with the backing secret when required
• Keys only, because certificates never have secrets
• Storage queues
• Feature flags

The correct answer is Certificates together with the backing secret when required.

Key Vault certificates manage certificate metadata while downloadable private certificate material is represented by a backing secret.

Related Microsoft Learn topic

Implement Azure security

Question 31: Azure Key Vault soft-delete allows a deleted secret to be recovered during its retention period.

• True
• False

The correct answer is True.

Soft-delete retains deleted vault objects for a configured period so authorized users can recover them.

Related Microsoft Learn topic

Implement Azure security

Question 32: You want Azure role assignments to control secret data operations in Key Vault. Which authorization model should you select?

• Azure RBAC
• Anonymous access
• Storage ACL only
• APIM subscription scope

The correct answer is Azure RBAC.

The Azure RBAC permission model uses Azure role assignments for Key Vault data-plane authorization.

Related Microsoft Learn topic

Implement Azure security

Question 33: Every outgoing dependency call must include a custom tenant identifier in Application Insights telemetry. What should you add to the telemetry pipeline?

• A telemetry initializer or OpenTelemetry processor
• A deployment slot
• A blob index tag
• A queue visibility timeout

The correct answer is A telemetry initializer or OpenTelemetry processor.

Telemetry initializers or processors enrich telemetry consistently before it is sent.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 34: You need automatic collection of supported HTTP and database calls made by an instrumented application. Which telemetry type is produced?

• Dependency telemetry
• Availability telemetry only
• Blob inventory
• ACR audit artifact

The correct answer is Dependency telemetry.

Application Insights dependency tracking records outgoing calls and correlates them with incoming requests.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 35: Telemetry volume is too high, but representative request trends and correlation should be retained. Which feature should you configure?

• Sampling
• A service SAS
• A container restart policy
• Strong consistency

The correct answer is Sampling.

Sampling reduces ingested telemetry volume while SDK-aware approaches preserve representative data and correlation.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 36: Developers need near-real-time request, dependency, and failure telemetry during a production deployment. Which feature should they open?

• Live Metrics
• Blob change feed
• ACR Tasks
• APIM developer portal

The correct answer is Live Metrics.

Application Insights Live Metrics displays low-latency operational telemetry for active applications.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 37: You need to inspect one failed request and navigate to all correlated dependencies and exceptions. Which Application Insights experience is most useful?

• End-to-end transaction details
• Cost Management budgets
• ACR repository map
• Key Vault access policies only

The correct answer is End-to-end transaction details.

End-to-end transaction details visualizes correlated telemetry for one distributed operation.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 38: An APIM response should be served from cache when a matching entry exists and stored after a backend response. Which two policies are needed? Choose 2 answers.

• cache-lookup
• cache-store
• validate-jwt
• rewrite-uri
• rate-limit-by-key

The correct answers are cache-lookup and cache-store.

cache-lookup retrieves eligible cached responses and cache-store stores backend responses.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 39: API Management must route a request to a different backend selected by policy logic. Which policy should you use?

• set-backend-service
• set-status
• jsonp
• trace only

The correct answer is set-backend-service.

set-backend-service changes the backend base URL or backend entity for the request.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 40: A prototype API should return a sample response without calling any backend. Which APIM policy is designed for this?

• mock-response
• forward-request
• authentication-managed-identity
• quota-by-key

The correct answer is mock-response.

mock-response selects an example or schema-generated response and bypasses the backend.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 41: A policy must apply to every API and operation in one API Management instance. At which scope should it be configured?

• Global scope
• Operation scope
• Product subscription only
• Named-value scope

The correct answer is Global scope.

Policies at global scope apply broadly and can be inherited by lower scopes.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 42: A publisher sends CloudEvents 1.0 formatted events to a supported Event Grid endpoint. Which schema is being used?

• CloudEvents schema
• Service Bus AMQP session schema
• OpenAPI schema
• Cosmos DB indexing schema

The correct answer is CloudEvents schema.

Event Grid supports the CloudEvents 1.0 schema for publishing and delivery scenarios.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 43: An Event Grid subscriber is temporarily unavailable. What does Event Grid normally do before dead-lettering or dropping the event?

• Retries delivery according to its retry policy
• Starts a Service Bus transaction
• Changes the event subject
• Creates an APIM revision

The correct answer is Retries delivery according to its retry policy.

Event Grid retries failed deliveries with backoff until the configured or service retention limits are reached.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 44: Raw Event Hubs data must be written automatically to Blob Storage or Data Lake Storage for batch analysis. Which feature should you enable?

• Event Hubs Capture
• Service Bus forwarding
• APIM caching
• Cosmos DB TTL

The correct answer is Event Hubs Capture.

Event Hubs Capture automatically writes the event stream to supported Azure storage destinations.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 45: A producer requires ordering for events that share a business identifier. What must remain stable across those Event Hubs events?

• The partition key
• The consumer group name
• The SAS expiry only
• The APIM product

The correct answer is The partition key.

Using the same partition key sends related events to the same partition, where ordering is preserved.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 46: One published business message must be delivered to billing and analytics independently. Which Service Bus topology should you create?

• A topic with two subscriptions
• One queue with ReceiveAndDelete
• One Event Grid domain only
• One ACI container group

The correct answer is A topic with two subscriptions.

A topic with multiple subscriptions provides independent copies of each matching message.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 47: A Service Bus subscription should receive only messages where the custom property region equals EU. What should you configure?

• A SQL filter rule
• A blob lifecycle filter
• An ACR webhook
• An App Service health check

The correct answer is A SQL filter rule.

Service Bus subscription SQL filters evaluate brokered message properties and custom application properties.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 48: A Service Bus message must become available for processing at a future UTC time. Which feature should the sender use?

• Scheduled enqueue time
• PeekLock renewal
• Duplicate detection history
• Event Hubs Capture

The correct answer is Scheduled enqueue time.

Scheduled messages remain unavailable until their scheduled enqueue time.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 49: A receiver cannot process a Service Bus message yet but must retain it for retrieval by sequence number. What should it do?

• Defer the message
• Complete the message
• Use ReceiveAndDelete
• Move it to ACR

The correct answer is Defer the message.

Deferral keeps the message in the entity until a receiver retrieves it explicitly by sequence number.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 50: A Queue Storage message repeatedly causes a worker failure. Which application pattern prevents endless retries?

• Track dequeue count and move poison messages to a separate queue
• Reduce the visibility timeout to zero
• Use a Cosmos DB session token
• Enable APIM mock responses

The correct answer is Track dequeue count and move poison messages to a separate queue.

Workers commonly inspect DequeueCount and isolate poison messages after a chosen retry threshold.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services