Microsoft Azure Developer - AZ-204

1. 1.A developer writes a Dockerfile that installs build tools, compiles a .NET application, and then runs it. The resulting image is over 1 GB. Which Dockerfile technique reduces the final image size without removing the compilation step?

   • AUse a multi-stage build and COPY only the compiled output into the runtime stageCorrect answer
   • BAdd an EXPOSE instruction for every port the application uses
   • CReplace CMD with ENTRYPOINT so the container starts faster
   • DMove the WORKDIR instruction to the top of the file, before FROM

   Why

   A multi-stage build declares multiple FROM statements. The compilation happens in a build stage (aliased with AS build), and only the produced artifacts are copied into a slim runtime stage, so the SDK and build tools never appear in the final image.

2. 2.An Azure Container Registry named contosoacr must serve images to an AKS cluster in a second region with low pull latency, and the team also needs private endpoint support. Which ACR SKU meets these requirements?

   • APremiumCorrect answer
   • BStandard
   • CBasic
   • DClassic

   Why

   Premium is the only SKU that provides private endpoints along with geo-replication and content trust. Standard supports geo-replication but not private endpoints; Basic is intended for development and test workloads.

3. 3.An Azure App Service web app running a Linux container fails to start, and the logs show a 403 error while retrieving the image from Azure Container Registry. The app has a system-assigned managed identity enabled. What is the minimum change required?

   • AAssign the AcrPull role to the app's managed identity scoped to the registryCorrect answer
   • BAssign the AcrPush role to the app's managed identity scoped to the registry
   • CRun az acr login from the App Service Kudu console before each deployment
   • DChange the registry SKU from Basic to Premium

   Why

   Pulling an image requires the identity to hold the AcrPull role scoped to the registry. Enabling the managed identity alone grants no permissions; the role assignment on the ACR resource is what authorizes the pull.

4. 4.A team must automatically rebuild a container image in Azure Container Registry every night at 02:00 without maintaining any build agents. Which approach satisfies this?

   • ACreate an ACR task with az acr task create and the --schedule parameterCorrect answer
   • BConfigure a lifecycle management policy on the registry
   • CEnable the ACR admin account and script docker build on a developer workstation
   • DTurn on Microsoft Defender for Cloud container registry scanning

   Why

   ACR Tasks run builds inside the registry itself. Passing --schedule with a CRON expression to az acr task create produces a timer-triggered task, so no build infrastructure has to be provisioned or maintained.

5. 5.An Azure Container Instances container group runs a nightly data import job. The job must run exactly once per invocation, and the container must not be restarted after it exits successfully. Which restart policy should be used?

   • ANeverCorrect answer
   • BOnFailure
   • CAlways
   • DIfNotPresent

   Why

   Never runs the container a single time and leaves it in a terminated state regardless of the exit code. OnFailure would restart the container after a non-zero exit, and Always, the default, restarts it even after a successful exit.

Practice all 65 questions

Frequently asked questions