AZ-204 Practice Test 4 – 50 Questions and Answers (Azure Developer, Updated August 2026)

AZ-204 Practice Test 4: 50 Questions and Answers for Azure Developer (August 2026 Updated)

Updated August 1, 2026

Practice 50 AZ-204 questions covering the final exam objectives: Azure compute, Azure storage, application security, Application Insights, API Management, and event- and message-based integration.

Exam status: Microsoft retired AZ-204 on July 31, 2026. This archived practice test remains available for reviewing the final AZ-204 exam objectives.

Prepare for the current Azure AI Cloud Developer certification with these AI-200 practice tests:

• AI-200 Practice Test 1 – 50 Questions and Answers
• AI-200 Practice Test 2 – 50 Questions and Answers
• AI-200 Practice Test 3 – 50 Questions and Answers
• AI-200 Practice Test 4 – 50 Questions and Answers

Exam: AZ-204 (retired)Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-204 practice test questions

Question 1: You need a registry task that rebuilds an image automatically when its base image is updated. Which capability should you configure?

• A multi-step ACR Task with base-image triggers
• A blob snapshot
• An APIM revision
• A Queue Storage lease

The correct answer is A multi-step ACR Task with base-image triggers.

ACR Tasks can track base-image dependencies and trigger automated rebuilds.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 2: Untagged manifests should be deleted from a registry on a controlled schedule. Which ACR-supported approach fits?

• Run an ACR purge task
• Enable App Service Health check
• Create a Service Bus session
• Set Cosmos DB TTL

The correct answer is Run an ACR purge task.

The ACR purge command can run as a scheduled task to remove artifacts that match age and tag criteria.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 3: An ACI workload needs temporary shared files that disappear when the container group stops. Which volume type should it use?

• emptyDir volume
• Azure Files for permanent sharing
• Secret volume for large data files
• Git repository volume

The correct answer is emptyDir volume.

An emptyDir volume provides ephemeral storage shared by containers in the same group.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 4: An ACI container must receive a sensitive value without displaying it in the container properties. How should the environment variable be defined?

• As a secure environment variable
• As a public DNS label
• As an image tag
• As a restart policy

The correct answer is As a secure environment variable.

ACI secure environment variables protect the value from being shown in container properties.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 5: A Container App secret named db-password must be exposed to a revision as an environment variable. What should the environment variable reference?

• secretref:db-password
• The revision suffix
• The ingress FQDN
• The workload profile name

The correct answer is secretref:db-password.

Container Apps environment variables can reference secrets by name rather than embedding their values.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 6: An HTTP Container App should have zero replicas while idle and create replicas as concurrent requests rise. Which scale input is appropriate?

• An HTTP concurrency rule
• An ACR retention policy
• A Service Bus session state rule
• A Cosmos consistency rule

The correct answer is An HTTP concurrency rule.

The built-in HTTP scaler changes replica count based on concurrent requests and supports scale-to-zero.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 7: A new Container Apps revision is unhealthy and should receive no production traffic. What is the safest immediate action?

• Set its traffic weight to 0% and route traffic to the healthy revision
• Delete the environment
• Rotate the registry password
• Increase Cosmos DB RU/s

The correct answer is Set its traffic weight to 0% and route traffic to the healthy revision.

Revision traffic weights allow production traffic to remain on a known-good revision while the candidate is fixed.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 8: A staging slot must be warmed before a production swap so that requests do not hit an uninitialized app. What should you configure?

• Application initialization or warm-up behavior
• A queue visibility timeout
• An Event Hubs partition key
• A blob legal hold

The correct answer is Application initialization or warm-up behavior.

App Service swap warm-up can initialize the source slot before routing production traffic to it.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 9: An App Service app needs TLS 1.2 or later for inbound HTTPS requests. Where should this be configured?

• The app's minimum inbound TLS version
• The storage account SAS
• The ACR repository permissions
• The Function queue batch size

The correct answer is The app's minimum inbound TLS version.

App Service TLS settings define the minimum supported TLS version for inbound connections.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 10: You must scale an App Service plan from a lower SKU to a Premium SKU. What type of scaling is this?

• Scale up
• Scale out
• Traffic splitting
• Geo-replication

The correct answer is Scale up.

Changing the App Service plan tier or VM size is vertical scaling, called scale up.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 11: A function should retry an Event Hubs-triggered execution after transient failures according to a fixed-delay policy. Where can this behavior be declared?

• In supported Functions retry configuration or attributes
• In an APIM product only
• In a blob stored access policy
• In an ACR webhook

The correct answer is In supported Functions retry configuration or attributes.

Azure Functions supports retry policies for supported triggers through function metadata or language-specific attributes.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 12: An HTTP-triggered function must be callable without a key because Microsoft Entra authentication is enforced by App Service Authentication. Which trigger authorization level can be used?

• anonymous
• function
• admin
• system

The correct answer is anonymous.

The anonymous trigger level removes Functions keys; an upstream platform authentication layer can then enforce identity.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 13: Which two settings are commonly required for an Azure Functions app runtime? Choose 2 answers.

• FUNCTIONS_WORKER_RUNTIME
• AzureWebJobsStorage
• APIM_SUBSCRIPTION_NAME
• EVENTGRID_DOMAIN_LOCK
• COSMOS_SESSION_MODE

The correct answers are FUNCTIONS_WORKER_RUNTIME and AzureWebJobsStorage.

FUNCTIONS_WORKER_RUNTIME selects the language worker and AzureWebJobsStorage supports host operations required by common hosting configurations.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 14: A Function output should be written to a queue without application code creating a QueueClient. What should you configure?

• A Queue Storage output binding
• An APIM inbound policy
• An ACR artifact
• An availability test

The correct answer is A Queue Storage output binding.

An output binding lets the Functions runtime write returned or bound values to the target queue.

Related Microsoft Learn topic

Develop Azure compute solutions

Question 15: A data import performs many independent Cosmos DB item operations and should maximize client throughput. Which SDK option should you enable?

• Bulk execution
• Strong consistency for every request
• One stored procedure across partitions
• A fixed continuation token

The correct answer is Bulk execution.

Cosmos DB bulk support groups and schedules independent operations efficiently across partitions.

Related Microsoft Learn topic

Develop for Azure storage

Question 16: A Cosmos DB query returns a partial page and must continue later without restarting. What value should the application persist?

• The continuation token
• The item ETag only
• The account key version
• The blob lease ID

The correct answer is The continuation token.

The continuation token represents query progress and can be supplied to retrieve the next page.

Related Microsoft Learn topic

Develop for Azure storage

Question 17: A client using session consistency switches application instances and must preserve read-your-writes behavior. What should be propagated when necessary?

• The Cosmos DB session token
• A Service Bus lock token
• An APIM subscription key
• A blob snapshot timestamp

The correct answer is The Cosmos DB session token.

A session token carries the logical session progress needed to preserve session guarantees across clients or instances.

Related Microsoft Learn topic

Develop for Azure storage

Question 18: A multi-region Cosmos DB account accepts writes in several regions. Concurrent updates to the same item require what configuration?

• A conflict resolution policy
• A blob lifecycle policy
• An ACR retention rule
• A Function host key

The correct answer is A conflict resolution policy.

Multi-write Cosmos DB accounts use configured conflict resolution to resolve competing item versions.

Related Microsoft Learn topic

Develop for Azure storage

Question 19: A processor must react only to current and future Cosmos DB item changes, not replay the full history. Which feed mode is appropriate?

• Latest-version change feed mode
• All versions and deletes mode
• Strong point-read mode
• Cross-partition snapshot mode

The correct answer is Latest-version change feed mode.

Latest-version mode provides the most recent insert or update events from the selected starting point.

Related Microsoft Learn topic

Develop for Azure storage

Question 20: A downloaded blob must be verified against an expected content hash supplied by the application. Which mechanism should the code use?

• Validate the content hash after transfer
• Compare blob access tier
• Use the lease duration
• Inspect the container name

The correct answer is Validate the content hash after transfer.

A content hash such as MD5 can be validated to detect corruption during transfer.

Related Microsoft Learn topic

Develop for Azure storage

Question 21: A blob should be overwritten only if its current ETag matches the value previously read. Which request condition is required?

• If-Match
• If-None-Match: * only
• x-ms-lease-break-period only
• A continuation token

The correct answer is If-Match.

If-Match with the ETag makes the write conditional and prevents overwriting a concurrently changed blob.

Related Microsoft Learn topic

Develop for Azure storage

Question 22: A large blob already in Azure must be copied asynchronously to another storage account. Which Blob SDK operation should you start?

• Copy from URI
• Stage text as a queue message
• Create a Cosmos transactional batch
• Publish an Event Grid domain

The correct answer is Copy from URI.

Blob copy-from-URI operations let the service copy data between accessible source and destination blobs.

Related Microsoft Learn topic

Develop for Azure storage

Question 23: Only blobs under logs/ with a matching index tag should move to archive after 180 days. What should the lifecycle rule contain?

• Prefix and blob-index-tag filters
• A Service Bus correlation filter
• An APIM product
• A Cosmos session token

The correct answer is Prefix and blob-index-tag filters.

Blob lifecycle rules support scoped filters, including prefixes and blob index tag conditions.

Related Microsoft Learn topic

Develop for Azure storage

Question 24: A command-line tool signs users in on devices that have no browser. Which Microsoft identity platform flow is designed for this?

• Device code flow
• Client credentials flow
• Implicit flow
• SAS delegation

The correct answer is Device code flow.

Device code flow lets users authenticate on a separate browser-capable device.

Related Microsoft Learn topic

Implement Azure security

Question 25: A confidential web app should authenticate to Microsoft Entra ID without a client secret stored as text. Which credential is preferable?

• A certificate credential
• A public redirect URI only
• A storage SAS
• A Function key

The correct answer is A certificate credential.

Certificate credentials are stronger than shared client secrets and can be protected and rotated.

Related Microsoft Learn topic

Implement Azure security

Question 26: Code running on an Azure VM needs an access token for Key Vault. Which managed identity endpoint capability should the Azure Identity SDK use?

• The managed identity token service
• The Event Grid delivery endpoint
• The APIM developer portal
• The ACR data endpoint

The correct answer is The managed identity token service.

The Azure Identity library obtains resource tokens from the platform-managed identity service.

Related Microsoft Learn topic

Implement Azure security

Question 27: An application needs incremental Microsoft Graph changes without rereading the entire collection. Which Microsoft Graph pattern should it use?

• Delta query
• Blob snapshot
• Service Bus deferral
• APIM cache lookup

The correct answer is Delta query.

Microsoft Graph delta query returns changes and a delta link for subsequent incremental synchronization.

Related Microsoft Learn topic

Implement Azure security

Question 28: A .NET application must retrieve a Key Vault secret by name. Which SDK client should it create?

• SecretClient
• BlobClient
• ServiceBusProcessor
• ArmClient only

The correct answer is SecretClient.

SecretClient from Azure.Security.KeyVault.Secrets provides get, set, update, and delete secret operations.

Related Microsoft Learn topic

Implement Azure security

Question 29: Applications should refresh App Configuration only after a sentinel key changes. What pattern should the provider implement?

• Register the sentinel for refresh and refresh dependent settings
• Poll Key Vault certificates only
• Restart ACR
• Change Event Hubs partitions

The correct answer is Register the sentinel for refresh and refresh dependent settings.

A sentinel key can trigger atomic-style refresh of a related configuration set.

Related Microsoft Learn topic

Implement Azure security

Question 30: A SAS token must never be sent over HTTP. Which SAS field should restrict its use?

• Signed protocol set to HTTPS
• Signed IP omitted
• Start time set in the past
• Resource type set to service

The correct answer is Signed protocol set to HTTPS.

The signed protocol field can restrict SAS requests to HTTPS only.

Related Microsoft Learn topic

Implement Azure security

Question 31: A SAS should work only from a known public address range. Which optional constraint should be set?

• Signed IP
• Content disposition
• Blob tier
• Session ID

The correct answer is Signed IP.

The signed IP field restricts SAS acceptance to a specified IP address or range.

Related Microsoft Learn topic

Implement Azure security

Question 32: A short-lived SAS is required. Which design most reduces exposure if it leaks?

• Minimum permissions and the shortest practical expiry
• Account-wide permissions and no expiry
• HTTP-only access
• Embedding the account key

The correct answer is Minimum permissions and the shortest practical expiry.

Least privilege and short expiry minimize the blast radius of a compromised SAS.

Related Microsoft Learn topic

Implement Azure security

Question 33: A checkout completion should be recorded with business properties such as cart value. Which telemetry operation should the app emit?

• A custom event
• A dependency failure only
• A blob lease
• A container revision

The correct answer is A custom event.

Custom events record domain actions and custom dimensions for analysis in Application Insights.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 34: Distributed services must propagate a standard trace context across HTTP calls. Which standard format should they use?

• W3C Trace Context
• SAS query syntax
• NCRONTAB
• OpenAPI discriminator only

The correct answer is W3C Trace Context.

W3C Trace Context standardizes traceparent and tracestate propagation across service boundaries.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 35: An availability test failure should create an incident through a webhook. What should the alert reference for the notification action?

• An action group
• A consumer group
• A container group
• An APIM group

The correct answer is An action group.

Azure Monitor action groups define notification and automation targets, including webhooks.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 36: A workspace-based Application Insights resource stores its log data in a linked Log Analytics workspace.

• True
• False

The correct answer is True.

Workspace-based Application Insights stores telemetry data in a linked Log Analytics workspace.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 37: You need to find slow dependencies above two seconds and group them by target. What is the appropriate analysis method?

• Run a KQL query over dependency telemetry
• Inspect ACR tags
• Change the app's TLS version
• List Service Bus sessions

The correct answer is Run a KQL query over dependency telemetry.

KQL can filter dependency duration and summarize results by target or dependency type.

Related Microsoft Learn topic

Monitor and troubleshoot Azure solutions

Question 38: Clients must provide a key that identifies an API Management subscription. Which request header is commonly used by default?

• Ocp-Apim-Subscription-Key
• x-ms-blob-type
• traceparent only
• If-Match

The correct answer is Ocp-Apim-Subscription-Key.

API Management commonly accepts the subscription key through Ocp-Apim-Subscription-Key.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 39: Several APIs should be offered together under one subscription and usage quota. Which APIM resource should contain them?

• A product
• A consumer group
• A container group
• A Cosmos partition

The correct answer is A product.

APIM products package one or more APIs with subscription and policy settings.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 40: A backend returns XML, but consumers require JSON. Which APIM policy can perform the conversion?

• xml-to-json
• validate-jwt
• rate-limit-by-key
• set-backend-service

The correct answer is xml-to-json.

The xml-to-json policy converts eligible XML response or request content to JSON.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 41: You need a nonbreaking edit of an API configuration before making it current, without creating a new public version. What should you create?

• An APIM revision
• An APIM version
• A Service Bus session
• An Event Grid topic

The correct answer is An APIM revision.

Revisions support controlled, nonbreaking API configuration changes and can later be made current.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 42: A breaking API contract must coexist with the old contract for clients. What APIM feature should you use?

• API versions
• API revisions only
• Named values
• Backend pools only

The correct answer is API versions.

API versions expose distinct contracts concurrently through configured versioning schemes.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 43: A custom Event Grid webhook receives a subscription validation event. What must it return during synchronous validation?

• The validation code in the expected response schema
• A Service Bus lock token
• An APIM subscription key
• A blob ETag

The correct answer is The validation code in the expected response schema.

The webhook must echo the validation code in the prescribed response to prove endpoint ownership.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 44: An Event Hubs processor should resume from the last successfully processed position after restarting. What should it persist?

• Checkpoints
• APIM revisions
• Blob snapshots of payloads only
• Function host keys

The correct answer is Checkpoints.

Checkpoints store a consumer's processed offset or sequence position for each partition.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 45: An Event Hubs receiver makes too many network calls while processing events sequentially. Which client setting can increase local buffering?

• Prefetch count
• Max delivery count
• SAS start time
• APIM quota period

The correct answer is Prefetch count.

Prefetch retrieves events ahead of processing to reduce receive latency and network round trips.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 46: A Service Bus queue should automatically dead-letter a message after repeated abandon or lock-expiry cycles. Which setting controls the threshold?

• Max delivery count
• Duplicate detection window
• Partition count
• APIM rate limit

The correct answer is Max delivery count.

When DeliveryCount exceeds MaxDeliveryCount, Service Bus moves the message to the dead-letter queue.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 47: A Service Bus message must expire if it is not processed within ten minutes. Which property should be set?

• Time to live
• Session state
• ReplyToSessionId
• Partition key only

The correct answer is Time to live.

Time to live defines how long a message remains valid before expiration handling.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 48: A Service Bus subscription should match messages whose CorrelationId equals a fixed value with minimal filter complexity. Which rule type fits?

• Correlation filter
• SQL filter with arbitrary expressions only
• Event Grid subject filter
• Blob index filter

The correct answer is Correlation filter.

Correlation filters efficiently match system and user properties for exact values.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 49: A Queue Storage client receives a message and finishes processing successfully. Which values are required to delete that specific received message?

• Message ID and current pop receipt
• Partition key and ETag
• Session ID and lock token
• Subscription key and revision

The correct answer is Message ID and current pop receipt.

Queue Storage deletion identifies the message and proves the current receive operation using its pop receipt.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services

Question 50: A Queue Storage worker needs more time before a message becomes visible again. Which operation should it call?

• Update message with a new visibility timeout
• Complete a Service Bus lock
• Renew an Event Hubs checkpoint
• Create an APIM version

The correct answer is Update message with a new visibility timeout.

Update Message can extend or change the visibility timeout and returns a new pop receipt.

Related Microsoft Learn topic

Connect to and consume Azure services and third-party services