Microsoft

AZ-204 Free Practice Questions

This is the free Microsoft AZ-204 practice question bank — 230 of 447 total questions, each with a full explanation, free to read with no signup required. Updated 2026-04-24.

Every answer is verified against official Microsoft documentation — see our methodology.

Question 1

You have 100 Azure virtual machines (VMs) with the system-assigned managed identity enabled. You need to identify the value of the object ID attribute for each of the identities. Which command should you use?

A. Get-AzVM
B. Get-AzureADUserOwnedObject
C. az ad sp credential list
D. az resource show
Show Answer
Correct Answer: A
Explanation:
For a system-assigned managed identity, the object ID is exposed as the PrincipalId property of the VM identity. Using Get-AzVM returns the VM object, including Identity.PrincipalId, which is the Azure AD object ID for the managed identity. The other options either target Azure AD users, service principal credentials, or generic resource output and are not the standard or most direct way to retrieve the object ID for VM managed identities.

Question 1

You have a workspace-based Azure Application Insights resource named Insights1 and an on-premises website. Access to the website from the internet is blocked. You plan to implement availability testing of the website by using Insights1. The implementation must maximize security and minimize the maintenance efforts. You need to decide which Application Insights availability test should be used to deliver the required functionality. Which availability test should you use?

A. standard test
B. multi-step web test
C. custom TrackAvailability test
D. URL ping test
Show Answer
Correct Answer: C
Explanation:
The website is not publicly accessible, so Azure-hosted availability tests (standard, URL ping, multi-step) cannot reach it. A custom TrackAvailability test can be run from the on-premises environment, allowing secure internal testing with minimal ongoing maintenance. Other options require a public endpoint or are deprecated.

Question 2

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You are developing an application that needs to react to events from multiple Azure services, such as Azure Blob Storage and Azure Resource Manager, in near-real time. The application must meet the following requirements: • Handle a high volume of events without manual intervention. • Receive only specific events relevant to your application, based on event types or resource patterns. • Ensure that no events are missed, even if the processing application is temporarily unavailable. • Use Azure Functions for processing events without managing any infrastructure. • Minimize the amount of custom code required for event routing and handling. You need to develop the solution. Solution: Configure Azure Event Grid system topics for each Azure service. Create event subscriptions with Advanced Filters to receive only the relevant events. Use Azure Functions with Event Grid triggers to process the events. Enable Dead-lettering on the event subscriptions to handle failures and ensure reliable delivery. Does the solution meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
Azure Event Grid system topics support high-throughput, near-real-time event delivery from Azure services without manual infrastructure management. Advanced Filters on event subscriptions allow declarative filtering by event type and resource, minimizing custom routing code. Azure Functions with Event Grid triggers provide serverless event processing. Dead-lettering on subscriptions ensures events are retained and not lost if the function is temporarily unavailable, meeting reliability requirements.

Question 2

DRAG DROP - You have an on-premises datacenter and an Azure subscription that contains an Azure Application Insights instance. You plan to implement Azure Monitor Application Insights Agent to instrument web apps hosted on the on-premises servers. You need to automate the implementation by using PowerShell. Which four PowerShell cmdlets should you run in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for AZ-204 question 2
Show Answer
Correct Answer: Install-PackageProvider -Name NuGet Install-Module -Name PowerShellGet Install-Module -Name Az.ApplicationMonitor Enable-ApplicationInsightsMonitoring -ConnectionString <AppInsights connection string>
Explanation:
NuGet is required to download modules. PowerShellGet enables module installation. Az.ApplicationMonitor installs the Application Insights Agent tooling. Finally, monitoring is enabled by configuring the Application Insights connection string.

Question 3

You manage an Azure App Service Web App named App1 and an associated Azure Application Insights resource named AppInsights1. You require alerts about any unusual rate increase of failed HTTP requests targeting App1. You need to implement push notifications. What should you do?

A. Deploy an Azure Resource Manager template that configures AppInsights1.
B. From the Azure portal, modify an action group of Azure Monitor.
C. From the Azure portal, modify diagnostic settings of AppInsights1.
D. Deploy an Azure Resource Manager template that configures the analyticsItems child resource of AppInsights1.
Show Answer
Correct Answer: B
Explanation:
Alerts for unusual increases in failed HTTP requests are generated by Azure Monitor (using Application Insights smart detection or alert rules), but push notifications are delivered via Azure Monitor action groups. To implement push notifications, you must configure or modify an action group in the Azure portal to define how alerts notify users (e.g., push, email, SMS). The other options relate to data collection or resource configuration, not notification delivery.

Question 4

You manage an Azure Storage account named storage1. You plan to load 1 million blobs into storage1. You must assign key-value pairs to blobs so that both keys and their values are automatically indexed and searchable by using the built-in services of storage1. You need to run the command to assign key-value pairs. Which command should you run?

A. az storage blob tag set
B. az storage blob service-properties update
C. az storage blob directory metadata update
D. New-AzStorageBlobQueryConfig
Show Answer
Correct Answer: A
Explanation:
Azure Blob Index Tags provide automatically indexed, searchable key-value pairs on blobs. The Azure CLI command used to assign these tags to a blob is `az storage blob tag set`. The other options configure service properties, metadata (which is not indexed for search), or unrelated query configuration.

Question 5

HOTSPOT - You are developing a containerized microservices application to be deployed by using Azure Container Apps. The application uses Dapr for service invocation between microservices. You develop two services: OrderService and PaymentService. OrderService must invoke a method named ProcessPayment on PaymentService. You need to invoke the method. How should you complete the code segment? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-204 question 5
Show Answer
Correct Answer: using var client = new DaprClientBuilder().Build(); client
Explanation:
In Azure Container Apps with Dapr, service invocation is performed using the Dapr .NET SDK. InvokeMethodAsync is available on DaprClient, which is created via DaprClientBuilder. HttpClient alone does not support InvokeMethodAsync for Dapr service invocation.

Question 6

HOTSPOT - You have an Azure storage account named account1. The account1 account contains 100 containers named container1 through container100. You plan to implement data lifecycle management for container1 to perform the following actions: • Move blobs to cool tier unless they have been read or modified within the last 30 days. • Move blobs to hot tier when they are read or modified in cool tier. You need to define the data lifecycle management policy rule to implement the container1 actions. How should you complete the rule definition? To answer, select the appropriate options in the answer area NOTE: Each correct selection is worth one point.

Illustration for AZ-204 question 6
Show Answer
Correct Answer: daysAfterLastAccessTimeGreaterThan container1/
Explanation:
Blobs should move to cool only if they haven’t been accessed or modified for 30 days, which is evaluated using last access time. To target only blobs in container1 (and not container10, container100, etc.), the prefix match must include the trailing slash.

Question 7

DRAG DROP - You have an Azure App Service Web App named App1. App1 has /public and /private areas. The App Service plan of App1 uses the D1 pricing tier. You plan to configure mutual TLS authentication for App1. The solution must minimize cost. You need to ensure that only the /private area of App1 will require mutual TLS authentication. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for AZ-204 question 7
Show Answer
Correct Answer: Upgrade the pricing tier of the App Service plan. Modify the client certificate mode of the Configuration settings of App1. Modify the certificate exclusion path of the Configuration settings of App1.
Explanation:
Mutual TLS is not supported on the D1 tier, so the App Service plan must be upgraded first while keeping costs minimal. Then client certificates are enabled at the app level. Finally, certificate exclusion paths are configured so that only the /private area requires mutual TLS, while /public remains accessible without it.

Question 9

You have an on-premises, public-facing website named www.contoso.com. You plan to test availability of www.contoso.com by using Application Insights availability tests. You need to configure a test that will generate HTTP POST requests that include custom headers. Your solution must minimize development effort. Which type of test should you configure?

A. Multi-step web test
B. Standard test
C. URL ping test
D. Custom TrackAvailability test
Show Answer
Correct Answer: B
Explanation:
Application Insights Standard availability tests support HTTP POST requests with custom headers and request body, while requiring no custom code. Multi-step web tests are deprecated and require more setup, URL ping tests are limited to simple GETs, and Custom TrackAvailability requires development effort.

$19

Get all 447 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.