Microsoft Azure Developer Associate Practice Test (AZ-204)

The BlobClient.UploadAsync overload that accepts a BlobUploadOptions object lets you specify both HTTP headers and metadata in the same upload request. By setting the HttpHeaders.ContentType property to "image/png" and providing the metadata dictionary, the SDK sends only one PUT Blob operation that applies all settings. Calling SetMetadataAsync and SetHttpHeadersAsync would require two additional round-trips, UploadAsync without options would apply neither setting, and StartCopyFromUriAsync is intended for server-side copies, not direct uploads.

In a Consumption plan, Azure Functions enforces an execution timeout of 5 minutes by default and no more than 10 minutes even when functionTimeout is increased in host.json. To run longer-running executions you must move the app to either a Premium plan or a Dedicated (App Service) plan, where the execution timeout is unlimited. After migrating, you can raise functionTimeout (for example, to 30 minutes) or set it to -1 for no limit. Enabling Always On or scaling out does not change the per-execution timeout on a Consumption plan, and simply increasing functionTimeout while remaining on the Consumption plan will still be capped at 10 minutes.

The az acr build command sends the current directory context to the Azure Container Registry build service, which performs the docker build operation in Azure and automatically pushes the resulting image to the specified registry. Using --registry identifies the target ACR, and --image supplies the desired repository name and tag. The trailing period (.) indicates the local context to upload. az acr task create sets up a persistent task but does not immediately build the image; docker build runs locally and therefore requires Docker Engine; az container create provisions a container instance and does not build or push images.

The Weather API must be exempt from the subscription-key check while the rest of the APIs in the Public product keep their current setting. Setting the Subscription required option to Off for the Weather API removes the need for callers to pass the Ocp-Apim-Subscription-Key header or query parameter for that API only. Disabling the requirement at the product level would also disable it for every other API in the Public product. Adding a validate-jwt policy enforces token validation but does not override the key requirement, so requests without a key would still be rejected. There is no global "Bypass subscription key" switch in API Management.

Only the TrackAvailability API records synthetic test results that surface in the Availability blade. Creating an AvailabilityTelemetry object (or calling TelemetryClient.TrackAvailability directly) lets you pass the test name, timestamp, duration, success flag, location, and optional diagnostic details. TrackDependency records outbound calls for performance analysis, TrackMetric stores numeric values, and relying on auto-instrumentation with Smart Detection does not generate synthetic availability data.

KEDA provides the event-driven scaling used by Azure Container Apps. To scale on the length of an Azure Service Bus queue you must add a KEDA rule whose type is "azure-servicebus" (or the equivalent alias "azure-servicebus-queue"). The rule monitors the queue length and changes replica counts, allowing the app to drop to zero when no messages exist and grow up to the maximum you set (20 in this scenario). HTTP ingress scaling works only for HTTP traffic, CPU metrics do not scale to zero, and a cron scaler simply schedules fixed replica counts rather than reacting to queue depth.

A service SAS that references a stored access policy is created on the container. Each URL contains only the signed identifier of the policy, not its own start and expiry times. When the campaign ends, deleting or updating the stored access policy instantly revokes (or changes) the permissions for all SAS URLs that depend on it, so no individual link has to be regenerated. A service SAS created directly on each blob is still valid until its individual expiry time, an account SAS cannot be limited to just the container, and making the container public provides no centrally revocable tokens.

A user-assigned managed identity is a standalone Azure resource whose lifecycle is independent of any single host resource and can be attached to multiple services. Creating such an identity, granting it the Storage Blob Data Contributor role on the storage account, and then associating it with the web app meets all requirements. A system-assigned identity would be deleted with the web app, while solutions that rely on SAS tokens or application secrets violate the requirement to avoid storing credentials.

The az acr build command submits the build context to the Azure Container Registry task service, which performs the Docker build and pushes the resulting image back to the registry. Because the build happens in Azure, Docker does not need to be installed in the local environment. The command must reference the target registry and provide the desired image name and tag. az acr import copies an existing image from another registry, not a local build context. Combining docker build and docker push requires the Docker engine to be available, which contradicts the requirements. az container create deploys a running container instance and does not build or publish an image.

For the client-credentials flow you request an application permission access token. The Microsoft identity platform requires the special .default scope, which represents all application permissions that have been granted for the resource. Therefore the service should request the scope https://graph.microsoft.com/.default. This instructs Azure AD to issue a token containing every application permission consented on Microsoft Graph. Supplying Mail.Read alone or prefixed with the resource URI is valid only for delegated flows, and using the login endpoint URL is not a recognized scope format.

The web API (the Function App) must first expose a scope so that clients can request permission to it. In the Function App's app registration you expose an API by defining a custom delegated scope (for example, api:///user_impersonation). You then add that scope as an "API permission" to the SPA registration and grant consent. When the SPA requests an access token for that scope, Azure AD issues a token whose audience matches the Function App, and the Function App can validate and accept the call.

Enabling implicit grant for ID tokens only supports sign-in, not access to another API. Making the apps public clients or assigning a managed identity to the SPA does not affect interactive token acquisition between a browser client and a protected API.

The TelemetryClient class exposes an overload of TrackTrace that accepts three parameters: the trace message, a SeverityLevel enum value, and an IDictionary<string,string> for custom properties. Calling this overload with SeverityLevel.Warning flags the trace as a warning, and the dictionary adds the custom RetryAfterSeconds dimension that will appear as a custom attribute in Application Insights. The other snippets are invalid: one places the arguments in an unsupported order, one uses a non-existent TraceSeverity enum, and one sends the data as an event rather than a trace.

Moving the blobs automatically between access tiers provides the lowest cost over the files' lifetime. A lifecycle management rule can be configured on a general-purpose v2 account to tier blobs to Cool after 30 days (lower storage cost with moderate availability) and then to Archive after 90 days (lowest cost, long-term storage). The rule requires no code changes and still keeps the files in Hot during the initial active month. Setting a container access tier to Cool keeps the blobs there from day one, increasing early-access latency and retrieval charges. Uploading directly to Archive would block normal reads during the first 30 days because Archive blobs must be rehydrated before they can be accessed. Soft delete is for protecting against accidental deletion, not cost management.

Because the service has no signed-in user, delegated permissions are impossible. The Microsoft identity platform recommends the OAuth 2.0 client credentials grant for daemon or service applications. This grant issues a token on behalf of the application itself, so it must request an application permission such as User.Read.All. Authorization code, device code, and implicit grants are user-interactive and use delegated permissions, which would fail when no user is present. Application permissions in the implicit flow are not supported.

Selecting either a node or the dependency link opens a side pane that summarizes request and dependency metrics. From that pane, choosing "Go to details" opens the End-to-end transaction details blade for a single instance of the operation. This blade shows a Gantt chart of the request, downstream dependencies, and timing breakdowns, enabling you to pinpoint where the slowdown occurs. Live Metrics Stream, Usage analytics, and availability tests do not provide full distributed-trace detail for a specific call.

Access tokens obtained through delegated flows include the scp (scope) claim, which lists the delegated permissions that the user and client app have for the target API. Tokens obtained through the client-credentials flow never carry scp; instead they include the roles claim that lists the application roles (app-only permissions) granted to the calling service principal. Therefore, the API should inspect the scp claim when the call is on behalf of a user and the roles claim when the call is made by a daemon or background service. Inspecting roles for delegated tokens or scp for app-only tokens will always fail, because those claims are not issued in those contexts. Other claims such as aud, appid, or groups do not directly convey the permission being requested.

The Azure Functions Premium plan keeps pre-warmed instances running to eliminate cold start, can automatically scale to many instances, supports VNet integration, and is billed by reserved instance core-seconds rather than individual executions. The Consumption plan also auto-scales but has cold starts, lacks VNet integration without NAT gateway, and charges per execution. An App Service (Dedicated) plan avoids per-execution costs but does not scale to zero and requires manual or rules-based scaling, making unexpected high concurrency expensive. The Elastic Premium (preview) option is synonymous with the Premium plan's capabilities but is not shown as a separate hosting choice in the portal; the appropriate selection remains the Premium plan.

Pre-aggregated (standard) Application Insights metrics are calculated automatically when telemetry is ingested. They become available in the Azure Monitor metrics database within seconds, can be evaluated by metric alerts at a 1-minute frequency, and incur no extra Log Analytics costs. Log-based metrics are updated by running a Kusto query on the Logs store; this introduces several-minute latency and the query execution counts toward Log Analytics charges. Scheduled query alerts have similar cost and latency characteristics, and custom code that emits its own metric still pays Log Analytics ingestion if it first queries Logs.

Calling AddMicrosoftIdentityWebApi configures the JWT bearer middleware so that unauthenticated requests are intercepted and converted to HTTP 401. Adding an authorization policy that requires the access_as_user scope causes ASP.NET Core to return HTTP 403 when a valid token lacks that scope. The WebApp/OpenID Connect helpers are intended for interactive server-rendered apps, and AddJwtBearer without an explicit scope-checking authorization policy would accept any token that passes signature and audience validation, so it would not generate the required 403 response.

The VM can obtain an Azure Active Directory access token for the registry through its system-assigned managed identity. Assigning that identity the AcrPush role on the specific registry lets it push and pull images while avoiding broader permissions. Enabling the ACR admin user relies on long-lived credentials and is not least-privileged. Granting an application the Owner role at subscription scope exceeds the required rights. Anonymous pull allows unauthenticated pulls only and does not permit pushes, so it does not meet the requirement.