AZ-204 Exam - Question 50

Question

DRAG DROP -You are developing a serverless Java application on Azure. You create a new Azure Key Vault to work with secrets from a new Azure Functions application. The application must meet the following requirements:✑ Reference the Azure Key Vault without requiring any changes to the Java code. ✑ Dynamically add and remove instances of the Azure Functions host based on the number of incoming application events. ✑ Ensure that instances are perpetually warm to avoid any cold starts. ✑ Connect to a VNet. ✑ Authentication to the Azure Key Vault instance must be removed if the Azure Function application is deleted. You need to grant the Azure Functions application access to the Azure Key Vault. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:.

Examice · Accepted Answer

Step 1: Create the Azure Functions app with a Consumption plan type.

Use the Consumption plan for serverless.

Step 2: Create a system-assigned managed identity for the application.

Create a system-assigned managed identity for your application.

Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.

Step 3: Create an access policy in Key Vault for the application identity.

Create an access policy in Key Vault for the application identity you created earlier. Enable the "Get" secret permission on this policy. Do not configure the

"authorized application" or applicationId settings, as this is not compatible with a managed identity.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

msuser11 · Answer

1. create ~Premium plan Type (Consumption X)
2. create system-assigned ~ (user-assigned X)
3. create an access policy in Azure Key Vault~

uffuchsi · Answer

Received this in my exam today (22/02/2023). Selected 'Created the Azure Function app with Premium plan type', 'Create a system-assigned managed identity for the application', and 'Create an access policy in Azure Key Vault for the application identity'. Score 927.

Samuel316 · Answer

Answer shown in the image does not agree with what's written in the answer description. Image says user-assigned managed identity. Description says system-assigned managed identity, which would be more correct

cb98160 · Answer

1. Premium plan (avoid cold start)
2. system-assigned managed identity (we only have 1 Azure resource that our webapp needs to access and also the managed identity has to be removed when we delete or app.)
3. Create an access  policy in Azure Key Vault.

dookebroyle · Answer

1. Premium plan for function app (needs to connect to vnet)
2. System assigned managed identity (needs to be deleted when app is deleted and you need to do this from settings menu in the app service menu - need to create function app first)
3. Access policy - key vault.

vruizrob · Answer

The following requirements are the key:
 
✑ Ensure that instances are perpetually warm to avoid any cold starts. 
In this link, https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale#cold-start-behavior, you can read this same phrase, so, the correct answer is Premium Plan

✑ Authentication to the Azure Key Vault instance must be removed if the Azure Function application is deleted.
In this link, https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview#managed-identity-types, you can see that is the System-assigned the correct answer

✑ And access policy in Azure Key Vault

Harish86 · Answer

Can you tell me, why this website is showing incorrect answers? And most importantly from where it is this answers. When it is saying about Warm tiers , how can it be Consumption plan

kvtborad · Answer

I have this question on 6th August. it was passed with 904. chose this highly voted:create ~Premium plan Type (Consumption X)
2. create system-assigned ~ (user-assigned X)
3. create an access policy in Azure Key Vault~

Hansmukh · Answer

Will the below requirements be met in the consumption pan?
✑ Ensure that instances are perpetually warm to avoid any cold starts.
✑ Connect to a VNet.

HMKM · Answer

Doc says:
  System-assigned... The identity is tied to the lifecycle of that service instance.
  User-assigned... a managed identity as a standalone Azure resource.
Simply thought, system-assigned managed identity meets the goal.
(https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)

Spondamq · Answer

Premium plan
System assigned
Create an access policy in Azure key Vault

vruizrob · Answer

1.- Consumption -> https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale
"On the Consumption plan, instances of the Functions host are dynamically added and removed based on the number of incoming events."
2.- System Assigned, because it says "Authentication to the Azure Key Vault instance must be removed if the Azure Function application is deleted"
3.- Access Policy

AhmedAbdelAziz · Answer

Why there is a lot of incorrect answers this website show to us ?

JamaicaBot · Answer

The image with the correct answer and the solution text differs. The second step in the image states ‘Create a user assigned managed identity for the application’ while the solution text says, ‘Create a system-assigned managed identity for your application.’ with the annotation ‘Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.’

Further the provided link states that a user assigned managed identity as well as a system-assigned managed identities can be configured. I am not quite sure which of the answers are correct. Any ideas which one meets the given criteria?

jielong109 · Answer

The second step should Create a system-assigned managed identity... based on the explanation.

SlothLearner · Answer

Answer is incorrect . Azure functions needs to be using Premium plan for pre warmed workers and connecting to vnet . Also , it needs to use system managed identity . https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale

micro9000 · Answer

The Azure Function App must be in Premium plan because we need to ensure that instances are perpetually warm to avoid any cold starts.

adilkhan · Answer

consumption plan does not support VNET https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-cli

Tarajee · Answer

Got this on 2023sept

GMartinez · Answer

✑ Authentication to the Azure Key Vault instance must be removed if the Azure Function application is deleted.
=> Managed Identity instead ?

alpfit · Answer

Consumption plan does not avoid cold start. We should use the app service plan

DrSohan · Answer

Shouldn't it be premium plan? Consumption plan has coldstart

Premium plan	Perpetually warm instances to avoid any cold start.

https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale

ITPerson123 · Answer

Dynamic instances should also be added and cold starts also to be avoid so the plan has to be Premium

yohannvf · Answer

Only Premium plan meets all requirements

bashirmja · Answer

Azure function Premium plan: You require features that aren't available on the Consumption plan, such as virtual network connectivity.

Eltooth · Answer

Premium plan
User-assigned
Access policy - key vault

d_vaibhav · Answer

Create Azure Functions App with Premium Plan type - (Perpetually warm instances to avoid any cold start)
Create System assigned managed identity for the application - (enables vault to be automatically removed if the Azure Function application is deleted)
Create an access policy in azure key vault for the application identity.

rohitpatil113 · Answer

1. create ~Premium plan Type (Consumption X)
2. create system-assigned ~ (user-assigned X)
3. create an access policy in Azure Key Vault~

DivyaRajkumar · Answer

What is the correct answer for this question? Very confusing.

CODE_STS · Answer

Got this in the exam today! Feb 28, 2023

ucskips · Answer

I agree with the answers here

1. Create function app with premium plan (premium plan allows for virtual network connection and pre-warmed starts)
2. System assigned managed identity (when the function app is deleted so is the system identity they are "tied" together https://devblogs.microsoft.com/devops/demystifying-service-principals-managed-identities/)
3. create an access policy (here, the system identity can be set as the method of accessing the key value)

ucskips · Answer

I agree with the answers here  1. Create function app with premium plan (premium plan allows for virtual network connection and pre-warmed starts) 2. System assigned managed identity (when the function app is deleted so is the system identity they are "tied" together https://devblogs.microsoft.com/devops/demystifying-service-principals-managed-identities/) 3. create an access policy (here, the system identity can be set as the method of accessing the key vault**)

tom112 · Answer

system-assigned Managed Identity's life cycle:
Shared life cycle with the Azure resource that the managed identity is created with.
When the parent resource is deleted, the managed identity is deleted as well.

raja33 · Answer

Got this in the exam today! Apr 19, 2025

AZ-204 Exam - Question 50

Discussion