Practice Test #5

Set-variable should be placed in the Inbound section because you need to derive and persist request-scoped data (the detected user identity) before any caching decision is made. Inbound is where APIM has access to the incoming request headers (including Authorization: Bearer <JWT>) and can parse JWT claims (for example, sub, oid, upn) to compute a stable user identifier. Storing the user ID in a variable during inbound allows subsequent inbound policies (like cache-lookup-value) to build a cache key such as "{location}:{userId}". If you waited until outbound, you would already have called the backend, defeating the purpose of using the cache to avoid backend calls. Outbound is primarily for response transformations and post-processing, not for request-derived routing/caching decisions.

Cache-lookup-value belongs in the Inbound section because the goal is to check the cache before forwarding the request to the backend. When cache-lookup-value finds an entry, APIM can immediately return the cached payload and skip the backend call, which is the main performance benefit of gateway caching. Placing cache lookup in outbound would be too late: the backend would already have been invoked, so you would not reduce backend load or latency. Inbound lookup also ensures the cache key can be constructed from request context (location parameter/path + user ID variable extracted from JWT). This is also important for security: per-user caching must be enforced before any response is generated to prevent mixing responses between users.

Cache-store-value should be placed in the Outbound section because you typically want to cache the response after the backend has produced it (and after any outbound transformations that should be reflected in the cached content). Outbound is the correct stage to capture the final response body/status/headers that will be returned to the client. If you stored in inbound, you would not yet have the backend response to cache. Also, caching after outbound modifications ensures consistency: the cached representation matches what clients receive (for example, after injecting user profile information or normalizing fields). This approach supports the Performance Efficiency pillar by reducing repeated backend calls for the same user/location combination.

Find-and-replace is a response body transformation policy, so it should be applied in the Outbound section. The requirement explicitly says to update the response body with the user profile information, which is only available/meaningful once a response exists. Inbound policies operate on the request before it is sent to the backend; they are not the right place to modify the response body. In outbound, APIM can read and rewrite the response payload (for example, replacing a placeholder token with user-specific profile data). Doing this in outbound also ensures that what you cache (via cache-store-value) can include the transformed content, so subsequent requests for the same user/location can be served entirely from cache without re-running backend logic.

Yes. Policies that inspect the incoming request (such as checking request body size) and policies that rewrite or normalize the request URL (such as retaining a particular API version segment) are applied before the request is sent to the backend. That is exactly what the <inbound> section is for. In APIM, <inbound> is the correct place for request validation, header/query/path manipulation, and routing decisions. By contrast, <outbound> is used to transform responses coming back from the backend, and <backend> is used to configure how APIM forwards the request (e.g., set-backend-service), not typically to validate request payload size. <on-error> only runs after an error has occurred. Therefore, an XML segment that evaluates request body size and/or rewrites the request path belongs in <inbound>.

No. A body size greater than 256 KB does not automatically cause an error unless the policy explicitly enforces that limit (for example, using validate-content with max-size, or a choose/when that returns an error response when the size exceeds a threshold). APIM does have practical limits and considerations when reading/buffering request bodies, but simply referencing a variable like "bodySize" (as implied by the snippet) does not itself throw an error at 256 KB. Errors occur when you attempt to read a body beyond configured limits, when buffering is required but not possible, or when a validation policy is configured to reject the request. For the exam, distinguish between (a) a computed value/variable and (b) an enforcement policy. Without an explicit reject/return-response/validate-content rule tied to 256 KB, exceeding 256 KB alone is not guaranteed to produce an error.

Yes. With a request like http://contoso.com/api/9.2/, a policy designed to compare versions and retain the higher version would keep 9.2 when compared against a lower version (for example, 9.1 or 9.0). This is a common APIM pattern: extract the version segment from the path, compare it to a configured/expected version, and rewrite/route accordingly. In APIM policy expressions, you must be careful about how versions are compared. If the policy uses numeric/semantic parsing (e.g., converting to a Version type or splitting into major/minor integers), then 9.2 correctly evaluates as higher than 9.1. If it used naive string comparison, results can be incorrect in some cases (e.g., "9.10" vs "9.2"). However, the statement specifically says the policy will retain the higher version for 9.2, which is consistent with the intended behavior of such a policy. Thus, given the scenario, the policy retains the higher version, and 9.2 would be kept.

Lifecycle management for moving blobs based on age requires a GPv2 storage account. A GPv1 account must first be upgraded to GPv2 before lifecycle rules can be used. After the upgrade, set the account's default access tier to Cool so data older than three months remains immediately available at lower cost, while lifecycle management can later move blobs older than one year to Archive. Creating a new Standard GPv2 account and copying data is not required because GPv1 accounts can be upgraded directly to GPv2.

Correct answer: Standard. Azure Service Bus to Event Grid integration is supported for Standard and Premium namespaces, but not for Basic. The Basic tier is intentionally limited (for example, fewer features and integration capabilities) and is not eligible for Event Grid events. Standard is the minimum tier that supports the Event Grid integration feature set commonly tested in AZ-204. Why not Premium? Premium also supports Event Grid integration, but the question asks which settings you should use; unless there is a requirement for dedicated resources, predictable latency, higher throughput, or VNet/private endpoints, Premium is not required. For exam questions, choose the lowest-cost tier that meets the technical requirement. Why not Basic? Basic lacks the required integration capability, so you cannot configure Service Bus events to be emitted to Event Grid from a Basic namespace.

Correct answer: Contributor. Configuring Azure Service Bus to Event Grid integration involves creating or managing Event Grid subscriptions and possibly updating resource configuration. These are management-plane operations governed by Azure RBAC on ARM resources. The Contributor role can create and manage resources (including Event Grid subscriptions) but cannot grant access to others. Why not Owner? Owner would work because it includes Contributor plus the ability to assign roles, but it is more privilege than necessary. Exams typically expect least privilege, so Contributor is preferred when role assignment is not required. Why not Azure Service Bus Data Owner/Data Receiver? These are data-plane roles used for messaging operations (send/receive/manage entities via the Service Bus data plane). They do not provide permissions to create Event Grid subscriptions or manage ARM-level integration settings, so they are insufficient for configuring the integration.

Correct: B. Visual Studio command prompt. To generalize a Windows VM before capturing it as an image, you run Sysprep (typically: %WINDIR%\System32\Sysprep\Sysprep.exe with /generalize /oobe /shutdown). On a Visual Studio Marketplace image, you would execute this from within the VM using local OS tooling/commands; the “Visual Studio command prompt” option represents running the required generalization command locally on the VM. Why others are wrong: A. Azure PowerShell can automate capture steps (stop/deallocate, create image), but it does not itself generalize the OS; Sysprep must be run inside the guest. C. Azure Migrate is for assessing and migrating servers to Azure, not preparing/capturing a reusable dev image. D. Azure Backup creates recovery points for restore, not a generalized image suitable for provisioning new VMs.

Correct: A. Azure Blob Storage. VM images (especially unmanaged/VHD-based artifacts) are stored as page blobs in Azure Blob Storage. Even when you use managed images or Azure Compute Gallery, the underlying storage technology for VHDs is still based on Azure Storage concepts, and Blob Storage is the appropriate service for storing image VHDs. Why others are wrong: B. Azure Data Lake Storage is optimized for big data analytics workloads and hierarchical namespace; it’s not the standard target for VM image VHDs. C. Azure File Storage provides SMB/NFS file shares, not page blobs for OS disk/image VHD storage. D. Azure Table Storage is a NoSQL key/attribute store and cannot store VM image binaries.