Question 770
The planned architecture is: Bind an Azure Functions Service Bus trigger with a compatible hosting plan and idempotent processing. Workload context: A team needs to invoke an Azure Function every time a Service Bus queue receives an invoice command without running a polling VM. Which acceptance test demonstrates that the required behavior works?
- Publish one order event and verify all three intended subscriptions receive independent deliveries.
- Run a test orchestration with one failing activity and verify replay and eventual aggregation behavior.
- Post a test command, observe fast 202/acknowledgment and eventual idempotent worker completion.
- Send a test invoice command and confirm the function consumes and settles it according to retry settings.
Explanation
Correct Answer
D:This observation directly verifies the intended design: Send a test invoice command and confirm the function consumes and settles it according to retry settings. The architecture being tested is: Bind an Azure Functions Service Bus trigger with a compatible hosting plan and idempotent processing. The original symptom was: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle.
Incorrect Answers
A:This check validates a different workload: Publish one order event and verify all three intended subscriptions receive independent deliveries. Its associated design is: Use Azure Service Bus topics and separate subscriptions with appropriate filters and retry policies. The required acceptance test here is: Send a test invoice command and confirm the function consumes and settles it according to retry settings.
B:That observation pertains to a separate failure: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. Its cause is: The workflow lacks durable checkpointed orchestrator state for long-running tasks. It does not confirm the result of this design. The direct proof would be: Send a test invoice command and confirm the function consumes and settles it according to retry settings.
C:The alternative test targets: Use an API frontend to accept validated commands into a durable Service Bus queue, with independent scalable workers. The scenario's actual proposed remedy is: Bind an Azure Functions Service Bus trigger with a compatible hosting plan and idempotent processing. Verify that one by: Send a test invoice command and confirm the function consumes and settles it according to retry settings.
Question 771
The customer states: A team needs to invoke an Azure Function every time a Service Bus queue receives an invoice command without running a polling VM. An incident reveals: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle. What cause best accounts for this evidence?
- The integration omitted an event-triggered compute consumer.
- Application processing and frontend request lifetime are tightly coupled.
- The workflow lacks durable checkpointed orchestrator state for long-running tasks.
- A queue's single-consumer semantics were selected where publish-subscribe fanout is required.
Explanation
Correct Answer
A:The incident is explained by: The integration omitted an event-triggered compute consumer. The reported symptom is: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle. The corresponding design fix is: Bind an Azure Functions Service Bus trigger with a compatible hosting plan and idempotent processing.
Incorrect Answers
B:The proposed diagnosis fits another scenario: Application processing and frontend request lifetime are tightly coupled. It would typically be reflected by: Client HTTP requests frequently time out because processing runs synchronously for several minutes. The current evidence instead supports: The integration omitted an event-triggered compute consumer.
C:The alternative weakness is: The workflow lacks durable checkpointed orchestrator state for long-running tasks. Its associated failure is: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. Neither explains the present observation: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle. The direct cause here is: The integration omitted an event-triggered compute consumer.
D:This cause would explain a different symptom: Only one of the three systems receives an event from a shared competing-consumer queue. The mechanism for that event is: A queue's single-consumer semantics were selected where publish-subscribe fanout is required. Here the stated symptom is: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle. Its cause is: The integration omitted an event-triggered compute consumer.
Question 772
Workload context: A team needs to invoke an Azure Function every time a Service Bus queue receives an invoice command without running a polling VM. The implemented remedy is: Bind an Azure Functions Service Bus trigger with a compatible hosting plan and idempotent processing. Which ongoing practice most specifically prevents recurrence of this failure: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle.?
- Audit subscription rules, dead letters and independent consumer lag.
- Monitor queue age and retry backlog separately from frontend latency.
- Inspect poison/dead-letter handling and Function concurrency during bursts.
- Audit function determinism and activity retry policy during runtime updates.
Explanation
Correct Answer
C:The key follow-up control is: Inspect poison/dead-letter handling and Function concurrency during bursts. It avoids recurrence of the scenario in which: A 24/7 virtual machine polls a queue inefficiently while the managed function is idle. It addresses: The integration omitted an event-triggered compute consumer.
Incorrect Answers
A:That safeguard manages another risk: A queue's single-consumer semantics were selected where publish-subscribe fanout is required. Its scenario is: Only one of the three systems receives an event from a shared competing-consumer queue. The present recurring risk is: The integration omitted an event-triggered compute consumer. The proper ongoing control is: Inspect poison/dead-letter handling and Function concurrency during bursts.
B:This is a reasonable safeguard for a different fault: Client HTTP requests frequently time out because processing runs synchronously for several minutes. That different mechanism is: Application processing and frontend request lifetime are tightly coupled. The original incident here instead arises from: The integration omitted an event-triggered compute consumer. The directly relevant safeguard is: Inspect poison/dead-letter handling and Function concurrency during bursts.
D:That safeguard manages another risk: The workflow lacks durable checkpointed orchestrator state for long-running tasks. Its scenario is: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. The present recurring risk is: The integration omitted an event-triggered compute consumer. The proper ongoing control is: Inspect poison/dead-letter handling and Function concurrency during bursts.
Question 773
A solution architect is reviewing a workload: An enterprise approval process orchestrates SaaS connectors, manual steps and conditional branches without large custom codebases. The observed incident is: A custom script loses workflow state when one approver delays a response for days. Which architecture choice most directly removes the identified weakness?
- Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
- Use Durable Functions orchestration with idempotent activity functions and appropriate state storage.
- Use GitHub Actions with approved workload identity federation, scoped Azure RBAC and environment protection rules.
- Evaluate Azure Container Apps Dapr integration with compatible sidecar components for application APIs.
Explanation
Correct Answer
A:The evidence (A custom script loses workflow state when one approver delays a response for days.) identifies the following cause: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. The design that removes it is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history. The acceptance check is: Start a sample approval and trace completed/rejected branches and connector activity.
Incorrect Answers
B:The option belongs to a different failure mechanism: The workflow lacks durable checkpointed orchestrator state for long-running tasks. That situation exhibits: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. For the stated case, the remedy is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
C:That design instead addresses another observed condition: A copied client secret in repository secrets must be rotated after accidental exposure. Its technical cause is: Deployment trust relies on long-lived secrets instead of constrained OIDC federation. The current workload exhibits: A custom script loses workflow state when one approver delays a response for days. Its targeted remedy is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
D:This choice mitigates an alternative scenario, where: Teams repeatedly hard-code broker URLs into every service and create configuration drift. The underlying issue there is: Common sidecar messaging/state integration components were not used where supported. Here the root issue is: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. Choose the corresponding action: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
Question 774
An architect proposes this change: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history. The workload context is: An enterprise approval process orchestrates SaaS connectors, manual steps and conditional branches without large custom codebases. Which evidence would most directly validate the change?
- Run a test orchestration with one failing activity and verify replay and eventual aggregation behavior.
- Run a signed workflow from the authorized branch and ensure an unapproved ref cannot obtain Azure deployment access.
- Invoke a Dapr service and confirm scoped access to the configured state or pub/sub component.
- Start a sample approval and trace completed/rejected branches and connector activity.
Explanation
Correct Answer
D:The acceptance test is specific: Start a sample approval and trace completed/rejected branches and connector activity. Its purpose is to establish that the proposed architecture works: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
Incorrect Answers
A:That observation pertains to a separate failure: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. Its cause is: The workflow lacks durable checkpointed orchestrator state for long-running tasks. It does not confirm the result of this design. The direct proof would be: Start a sample approval and trace completed/rejected branches and connector activity.
B:The alternative test targets: Use GitHub Actions with approved workload identity federation, scoped Azure RBAC and environment protection rules. The scenario's actual proposed remedy is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history. Verify that one by: Start a sample approval and trace completed/rejected branches and connector activity.
C:This check validates a different workload: Invoke a Dapr service and confirm scoped access to the configured state or pub/sub component. Its associated design is: Evaluate Azure Container Apps Dapr integration with compatible sidecar components for application APIs. The required acceptance test here is: Start a sample approval and trace completed/rejected branches and connector activity.
Question 775
During architecture troubleshooting, a team reports: A custom script loses workflow state when one approver delays a response for days. Context: An enterprise approval process orchestrates SaaS connectors, manual steps and conditional branches without large custom codebases. Which underlying design mistake explains the observed behavior most precisely?
- Deployment trust relies on long-lived secrets instead of constrained OIDC federation.
- Common sidecar messaging/state integration components were not used where supported.
- The workflow lacks durable checkpointed orchestrator state for long-running tasks.
- The integration uses stateless scripts instead of durable orchestration suited to long-running workflows.
Explanation
Correct Answer
D:This is the failure mechanism rather than an incidental symptom: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. It accounts for: A custom script loses workflow state when one approver delays a response for days. The architectural repair is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history.
Incorrect Answers
A:The proposed diagnosis fits another scenario: Deployment trust relies on long-lived secrets instead of constrained OIDC federation. It would typically be reflected by: A copied client secret in repository secrets must be rotated after accidental exposure. The current evidence instead supports: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows.
B:The alternative weakness is: Common sidecar messaging/state integration components were not used where supported. Its associated failure is: Teams repeatedly hard-code broker URLs into every service and create configuration drift. Neither explains the present observation: A custom script loses workflow state when one approver delays a response for days. The direct cause here is: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows.
C:This cause would explain a different symptom: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. The mechanism for that event is: The workflow lacks durable checkpointed orchestrator state for long-running tasks. Here the stated symptom is: A custom script loses workflow state when one approver delays a response for days. Its cause is: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows.
Question 776
The design change is: Build an Azure Logic Apps workflow with supported connector actions, branching and durable run history. The original failure was: A custom script loses workflow state when one approver delays a response for days. Which ongoing control best prevents recurrence of the same root cause?
- Audit workflow run failures and connector authorization expiry.
- Review Dapr component scopes, secret stores and service identity as applications evolve.
- Audit function determinism and activity retry policy during runtime updates.
- Review federated subject claims and repository environment approvals after workflow changes.
Explanation
Correct Answer
A:This is an ongoing protection specific to the fault: Audit workflow run failures and connector authorization expiry. The recurrence risk is: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. It should be checked using: Start a sample approval and trace completed/rejected branches and connector activity.
Incorrect Answers
B:The proposed control focuses on: Common sidecar messaging/state integration components were not used where supported. For the design in the question, recurrence comes from: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. A precise prevention step is: Audit workflow run failures and connector authorization expiry.
C:That safeguard manages another risk: The workflow lacks durable checkpointed orchestrator state for long-running tasks. Its scenario is: An ordinary short-lived HTTP function times out while coordinating hours of dependent tasks. The present recurring risk is: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. The proper ongoing control is: Audit workflow run failures and connector authorization expiry.
D:This is a reasonable safeguard for a different fault: A copied client secret in repository secrets must be rotated after accidental exposure. That different mechanism is: Deployment trust relies on long-lived secrets instead of constrained OIDC federation. The original incident here instead arises from: The integration uses stateless scripts instead of durable orchestration suited to long-running workflows. The directly relevant safeguard is: Audit workflow run failures and connector authorization expiry.
Question 777
A design workshop has this requirement: A bank exposes multiple back-end APIs to partner developers with quotas, versioning and a consolidated developer gateway. Operators currently observe: Partners invoke backend URLs directly and bypass requested quotas. Select the ONE design remedy that best addresses the root cause.
- Evaluate Azure Container Apps Dapr integration with compatible sidecar components for application APIs.
- Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
- Design Azure Front Door with origin groups, routes and WAF policy as appropriate.
- Use supported API Management policies for JWT validation and throttling at the inbound processing stage.
Explanation
Correct Answer
B:This option addresses the actual design defect: There is no API gateway governing public partner traffic consistently. The correction is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies. Confirm the outcome with: Test an approved subscription key and reject an over-quota or unauthorized partner call.
Incorrect Answers
A:The option belongs to a different failure mechanism: Common sidecar messaging/state integration components were not used where supported. That situation exhibits: Teams repeatedly hard-code broker URLs into every service and create configuration drift. For the stated case, the remedy is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
C:This choice mitigates an alternative scenario, where: A client lands on one failed regional endpoint because no global HTTP front end exists. The underlying issue there is: Global application entry routing and edge filtering were not implemented. Here the root issue is: There is no API gateway governing public partner traffic consistently. Choose the corresponding action: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
D:The option belongs to a different failure mechanism: API gateway inbound identity and traffic governance controls were not applied. That situation exhibits: Invalid tokens and request bursts reach an otherwise healthy API backend. For the stated case, the remedy is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
Question 778
The planned architecture is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies. Workload context: A bank exposes multiple back-end APIs to partner developers with quotas, versioning and a consolidated developer gateway. Which acceptance test demonstrates that the required behavior works?
- Send requests to defined paths and confirm origin selection and WAF blocking in logs.
- Submit a wrong-audience JWT and excessive valid requests, confirming the gateway returns expected rejections.
- Test an approved subscription key and reject an over-quota or unauthorized partner call.
- Invoke a Dapr service and confirm scoped access to the configured state or pub/sub component.
Explanation
Correct Answer
C:The acceptance test is specific: Test an approved subscription key and reject an over-quota or unauthorized partner call. Its purpose is to establish that the proposed architecture works: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
Incorrect Answers
A:The alternative test targets: Design Azure Front Door with origin groups, routes and WAF policy as appropriate. The scenario's actual proposed remedy is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies. Verify that one by: Test an approved subscription key and reject an over-quota or unauthorized partner call.
B:This check validates a different workload: Submit a wrong-audience JWT and excessive valid requests, confirming the gateway returns expected rejections. Its associated design is: Use supported API Management policies for JWT validation and throttling at the inbound processing stage. The required acceptance test here is: Test an approved subscription key and reject an over-quota or unauthorized partner call.
D:The alternative test targets: Evaluate Azure Container Apps Dapr integration with compatible sidecar components for application APIs. The scenario's actual proposed remedy is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies. Verify that one by: Test an approved subscription key and reject an over-quota or unauthorized partner call.
Question 779
The customer states: A bank exposes multiple back-end APIs to partner developers with quotas, versioning and a consolidated developer gateway. An incident reveals: Partners invoke backend URLs directly and bypass requested quotas. What cause best accounts for this evidence?
- Global application entry routing and edge filtering were not implemented.
- There is no API gateway governing public partner traffic consistently.
- API gateway inbound identity and traffic governance controls were not applied.
- Common sidecar messaging/state integration components were not used where supported.
Explanation
Correct Answer
B:The incident is explained by: There is no API gateway governing public partner traffic consistently. The reported symptom is: Partners invoke backend URLs directly and bypass requested quotas. The corresponding design fix is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies.
Incorrect Answers
A:The alternative weakness is: Global application entry routing and edge filtering were not implemented. Its associated failure is: A client lands on one failed regional endpoint because no global HTTP front end exists. Neither explains the present observation: Partners invoke backend URLs directly and bypass requested quotas. The direct cause here is: There is no API gateway governing public partner traffic consistently.
C:The proposed diagnosis fits another scenario: API gateway inbound identity and traffic governance controls were not applied. It would typically be reflected by: Invalid tokens and request bursts reach an otherwise healthy API backend. The current evidence instead supports: There is no API gateway governing public partner traffic consistently.
D:The alternative weakness is: Common sidecar messaging/state integration components were not used where supported. Its associated failure is: Teams repeatedly hard-code broker URLs into every service and create configuration drift. Neither explains the present observation: Partners invoke backend URLs directly and bypass requested quotas. The direct cause here is: There is no API gateway governing public partner traffic consistently.
Question 780
Workload context: A bank exposes multiple back-end APIs to partner developers with quotas, versioning and a consolidated developer gateway. The implemented remedy is: Place Azure API Management in front of the APIs using proper product subscriptions, API versions and policies. Which ongoing practice most specifically prevents recurrence of this failure: Partners invoke backend URLs directly and bypass requested quotas.?
- Review gateway policies, API revisions and partner access after backend releases.
- Regression-test gateway policy order and key claims after API registration changes.
- Review Dapr component scopes, secret stores and service identity as applications evolve.
- Monitor origin health and WAF false-positive patterns after deploying rules.
Explanation
Correct Answer
A:The key follow-up control is: Review gateway policies, API revisions and partner access after backend releases. It avoids recurrence of the scenario in which: Partners invoke backend URLs directly and bypass requested quotas. It addresses: There is no API gateway governing public partner traffic consistently.
Incorrect Answers
B:That safeguard manages another risk: API gateway inbound identity and traffic governance controls were not applied. Its scenario is: Invalid tokens and request bursts reach an otherwise healthy API backend. The present recurring risk is: There is no API gateway governing public partner traffic consistently. The proper ongoing control is: Review gateway policies, API revisions and partner access after backend releases.
C:This is a reasonable safeguard for a different fault: Teams repeatedly hard-code broker URLs into every service and create configuration drift. That different mechanism is: Common sidecar messaging/state integration components were not used where supported. The original incident here instead arises from: There is no API gateway governing public partner traffic consistently. The directly relevant safeguard is: Review gateway policies, API revisions and partner access after backend releases.
D:The proposed control focuses on: Global application entry routing and edge filtering were not implemented. For the design in the question, recurrence comes from: There is no API gateway governing public partner traffic consistently. A precise prevention step is: Review gateway policies, API revisions and partner access after backend releases.
Designing Microsoft Azure Infrastructure Solutions (AZ-305) Practice Tests