AZ-204 — Microsoft Azure Developer Study Guide

You are developing an Azure Functions application that processes messages from Azure Service Bus. The function must process messages in order and ensure exactly-once delivery semantics. Which hosting plan and configuration should you use?

• A Dedicated App Service plan with auto-scale enabled and message ordering disabled
• B Consumption plan with parallel message processing enabled across multiple instances
• C Premium plan with multiple instances and partitioned topic
• D Consumption plan with a single concurrent function instance and session-enabled queue ✓ Correct

Your Azure App Service application needs to authenticate users with Azure AD and call Microsoft Graph API on behalf of the user. Which authentication flow should you implement?

• A Implicit flow
• B Resource owner password credentials flow
• C Authorization code flow with PKCE ✓ Correct
• D Client credentials flow

You need to implement a solution that automatically scales an Azure Container Instances container group based on CPU and memory metrics. What is the best approach?

• A Deploy containers to Azure Kubernetes Service (AKS) instead ✓ Correct
• B Use Azure Container Instances virtual node in AKS for automatic scaling
• C Configure autoscaling directly within Azure Container Instances settings
• D Implement custom logic using Azure Functions and Azure Monitor alerts to manage container group scaling

When implementing Azure Cosmos DB change feed in your application, what is the primary advantage of using the Change Feed Processor library over directly reading the change feed?

• A It provides lower latency for processing changes
• B It automatically handles checkpointing, load balancing, and lease management across multiple consumer instances ✓ Correct
• C It eliminates the need for an Azure Cosmos DB connection string
• D It supports only JSON document types

Your application stores sensitive data in Azure Key Vault and needs to access it from an Azure App Service. Which approach provides the most secure authentication without storing credentials in application code?

• A Store the Key Vault access key in the Application Settings of App Service
• B Use managed identity with appropriate RBAC role assignments ✓ Correct
• C Embed the service principal credentials in the application configuration file
• D Use a shared access signature (SAS) token in environment variables

You are developing a microservices application using Azure Service Bus for asynchronous communication. Messages are being delivered to the dead-letter queue. Which of the following is NOT a common cause for messages ending up in the dead-letter queue?

• A Message time-to-live (TTL) has expired
• B The message size exceeds the maximum allowed size for the queue
• C The receiver application has processed the message successfully ✓ Correct
• D Maximum delivery count has been exceeded due to repeated processing failures

When developing an Azure Functions application that uses output bindings to write to Azure Storage Blob, what happens if the binding configuration references a container that does not exist?

• A The runtime automatically creates the container if it doesn't exist ✓ Correct
• B The binding silently fails and the blob is not created
• C The function waits for manual container creation before executing
• D The function runtime throws an exception immediately when the function is invoked

You need to implement rate limiting for an Azure API Management API to prevent abuse. Which policy should you use to limit requests to 100 calls per minute per IP address?

• A Rate limit policy with calls parameter set to 100 and renewal period set to 60 seconds ✓ Correct
• B Validate-jwt policy with rate limiting enabled
• C Throttle policy with rate-limit-by-key set to context.Request.IpAddress
• D Request quota policy with quota-counter-key set to IP address

An Azure App Service application needs to run scheduled background tasks every day at 2 AM UTC. What is the recommended approach?

• A Implement a timer-triggered Azure Function with CRON expression '0 0 2 * * *' ✓ Correct
• B Use Azure Scheduler to invoke an HTTP endpoint in the App Service
• C Configure a scheduled task in the App Service application settings dashboard
• D Use a WebJob with a continuous execution model and custom scheduling logic

You are implementing a solution that requires correlation of logs from multiple microservices in Azure Application Insights. Which approach best enables distributed tracing across services?

• A Manually append service names to all log messages in code
• B Configure separate Application Insights instances for each service
• C Use Application Insights SDKs with automatic dependency tracking and correlation IDs ✓ Correct
• D Export logs to Azure Monitor and correlate using custom KQL queries only

When using Azure Blob Storage with Azure Functions, which trigger type allows you to process blobs that are uploaded to a specific container?

• A BlobTrigger binding that monitors a specified container path ✓ Correct
• B TableTrigger binding that stores blob metadata in a table
• C TimerTrigger binding that periodically checks for new blobs
• D QueueTrigger binding that monitors a queue for blob upload notifications

Your application requires strong consistency for read operations on Azure Cosmos DB. Which consistency level should you configure, and what is the trade-off?

• A Eventual consistency for optimal availability and minimal latency
• B Session consistency for application-level consistency guarantees
• C Strong consistency with lower availability and higher latency for read operations across regions ✓ Correct
• D Bounded staleness with configurable staleness parameters

When implementing OAuth 2.0 authorization in Azure AD B2C, which response type is used for single-page applications (SPAs) to obtain access tokens securely without exposing them in the URL?

• A response_type=id_token
• B response_type=token (implicit flow)
• C response_type=code with PKCE ✓ Correct
• D response_type=code id_token token

You need to deploy a containerized application to Azure Container Instances with environment-specific configuration. Which approach allows you to externalize configuration without modifying the image?

• A Store configuration only in application.properties file inside the container
• B Modify the image after deployment using Azure Container Registry
• C Define environment variables in the container group definition or use Azure Key Vault references ✓ Correct
• D Bake configuration files directly into the Docker image during build

When implementing a multi-tenant Azure SQL Database solution, what is the primary advantage of using elastic pools?

• A Elastic pools allow each tenant database to be encrypted independently
• B Elastic pools automatically split databases across multiple Azure regions
• C Elastic pools eliminate the need for database backup operations
• D Elastic pools share compute and storage resources while maintaining performance isolation and cost predictability ✓ Correct

Your Azure Functions application uses dependency injection to resolve services. How should you register a scoped service for use across function invocations?

• A Register as transient to ensure each function invocation gets a fresh instance
• B Use the [Inject] attribute directly on function parameters without explicit registration
• C Register as scoped in the IFunctionsHostBuilder configuration during startup ✓ Correct
• D Register as singleton in the host startup class for maximum performance

When using Azure Event Grid to route events to multiple subscribers, what is the role of event subscriptions with filters?

• A Filters determine the storage location of events in Event Grid
• B Filters allow subscribers to receive only events matching specific criteria, reducing unnecessary event processing ✓ Correct
• C Filters encrypt events before they are delivered to subscribers
• D Filters reduce the number of events published to the Event Grid topic

You are developing an application that processes video files uploaded to Azure Blob Storage. The processing is CPU-intensive and can take several minutes. Which Azure service combination is most appropriate?

• A Azure Blob Storage with direct polling from an Azure Web App in a loop
• B Azure Blob Storage directly connected to an Azure Batch pool for processing
• C Azure Blob Storage with a BlobTrigger Azure Function on the Consumption plan
• D Azure Blob Storage with Event Grid triggering an Azure Service Bus message, processed by a Dedicated App Service plan WebJob ✓ Correct

When securing an Azure API Management instance, what is the primary purpose of using Azure Virtual Networks?

• A To automatically scale API Management capacity based on traffic
• B To isolate API Management from the public internet and restrict access to approved internal networks ✓ Correct
• C To enable multi-region deployment of API Management
• D To reduce the number of API operations available to clients

You need to implement retry logic for an Azure Service Bus message processor that handles transient failures. Which approach is most appropriate for an Azure Functions implementation?

• A Implement the Polly library with exponential backoff policy in the function code for transient exceptions ✓ Correct
• B Configure the Service Bus trigger binding with maxAutoRenewDuration and implement retry logic in a try-catch block
• C Configure the Service Bus queue with max delivery count and rely on dead-lettering for failures
• D Use Azure Functions built-in retry policies in the function.json configuration with exponential backoff

When implementing a solution that requires real-time data synchronization between an on-premises database and Azure Cosmos DB, which Azure service is most suitable?

• A Azure Synapse Link for real-time data synchronization with change feed integration ✓ Correct
• B Manual data migration using Azure Database Migration Service
• C Azure Data Factory with scheduled copy activities every 5 minutes
• D Direct ODBC connection from on-premises to Cosmos DB with application-level caching

Your application needs to validate JWT tokens issued by Azure AD in an Azure API Management policy. Which policy should you implement?

• A The validate-jwt policy with the issuer, audience, and signing-keys configured ✓ Correct
• B The authentication-basic policy combined with a custom token validation function
• C The oauth2 policy with implicit flow configuration
• D The ip-filter policy to restrict access to known Azure AD IP ranges

When deploying an Azure Container Registry image to Azure App Service, what is the consequence of setting DOCKER_REGISTRY_SERVER_URL with an incorrect URL?

• A The App Service will automatically detect the correct registry URL from the image name
• B The container will deploy successfully but with degraded performance
• C The deployment succeeds but images cannot be pulled at runtime, resulting in a 500 error ✓ Correct
• D Azure App Service will use Docker Hub as a fallback registry automatically

You are implementing a solution that processes large CSV files using Azure Blob Storage and Azure Functions. Files can be 1-5 GB in size. What is the recommended approach?

• A Use a Data Lake Storage Gen2 account with Hadoop processing instead of Azure Functions
• B Use BlobOpenReadAsync() to stream the blob and process line-by-line without loading the entire file into memory ✓ Correct
• C Split the file into smaller chunks manually before uploading to Blob Storage
• D Download the entire file into memory using BlobClient.Download() and process sequentially

When implementing custom policy in Azure API Management using the Liquid template language, which scenario is most appropriate?

• A Transforming response payloads by extracting and reformatting specific fields from JSON responses ✓ Correct
• B Validating OAuth 2.0 tokens from multiple identity providers
• C Encrypting request and response bodies using symmetric encryption
• D Implementing rate limiting per API consumer based on subscription tier

Your organization requires audit logging for all data accessed in Azure SQL Database. Which feature should you enable?

• A Azure SQL Database Auditing to log database activities to Azure Storage or Log Analytics ✓ Correct
• B Always Encrypted for column-level encryption
• C Transparent Data Encryption (TDE) for at-rest encryption
• D Query Store to track query execution metrics

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must process messages sequentially and maintain order. Which cardinality setting should you use in the function.json binding?

• A stream
• B one ✓ Correct
• C batch
• D many

An application needs to store files in Azure Blob Storage with automatic tiering based on access patterns. Which storage account access tier should you configure for this scenario?

• A Cool tier with read-access geo-redundant storage
• B Hot tier only
• C Hot tier with lifecycle management policies ✓ Correct
• D Archive tier with manual transitions

You are implementing authentication for a web API using Azure AD. The API needs to validate tokens from multiple client applications. Which token validation should you implement?

• A Validate only the expiration time of the token
• B Validate the issuer, audience, and signature of the JWT token ✓ Correct
• C Skip validation for tokens issued by trusted sources
• D Only check if the token string is not empty

Your Azure Function needs to connect to a SQL Database securely without storing connection strings in code. Which approach should you use?

• A Embed the connection string directly in the function code
• B Store the connection string in the function.json file
• C Store credentials in an Azure Storage account as plain text files
• D Use Azure Key Vault references in the application settings ✓ Correct

You need to implement retry logic for calling an unreliable Azure Service Bus endpoint. Which approach uses exponential backoff correctly in the Polly library?

• A IAsyncPolicy policy = Policy.Handle<Exception>().RetryAsync(3);
• B IAsyncPolicy policy = Policy.Handle<Exception>().CircuitBreakerAsync(3, TimeSpan.FromSeconds(30));
• C IAsyncPolicy policy = Policy.Handle<Exception>().WaitAndRetryAsync(new[] { TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(2), TimeSpan.FromSeconds(4) }); ✓ Correct
• D IAsyncPolicy policy = Policy.Handle<Exception>().WaitAndRetryAsync(retryCount: 3, sleepDurationProvider: attempt => TimeSpan.FromSeconds(Math.Pow(2, attempt)));

An application uses Azure Cosmos DB with multiple regions for high availability. You need to enable automatic failover with a secondary write region. What is the correct configuration?

• A Use single-region replication with manual failover scripts
• B Configure Cosmos DB with eventual consistency and disable all replicas
• C Set up read replicas in secondary regions only
• D Enable multi-region writes and configure a secondary region with write capability ✓ Correct

You are developing an application that uploads large files to Azure Blob Storage. Which approach optimizes upload performance for files larger than 256 MB?

• A Upload using block blobs with parallel block uploads ✓ Correct
• B Store large files exclusively in Azure Data Lake Storage instead
• C Compress all files before uploading to reduce network bandwidth usage
• D Use single PUT operation regardless of file size for simplicity

Your application needs to implement custom authorization policies in ASP.NET Core running on Azure App Service. Which interface should you implement?

• A IAccessTokenValidator
• B IAuthorizationPolicyProvider ✓ Correct
• C IAuthenticationScheme
• D IIdentityProvider

You need to monitor an Azure Function that processes events from Event Grid. Which Application Insights metric best indicates if the function is processing events successfully?

• A Server response time
• B User session count
• C Function execution duration and exception count ✓ Correct
• D Page view analytics

An application stores sensitive data in Azure Cosmos DB and requires field-level encryption at rest. Which feature should you implement?

• A Implement application-level encryption on all sensitive fields before writing to Cosmos DB ✓ Correct
• B Always Encrypted in Cosmos DB (available in selected APIs and SDKs)
• C Enable service-side encryption in Azure Storage for Cosmos DB backups only
• D Use Transparent Data Encryption (TDE) on the Cosmos DB account

You are implementing a caching strategy for an Azure App Service application. When should you use Azure Cache for Redis instead of in-process caching?

• A Only when you have a single app service instance to reduce memory usage
• B Only during local development and testing phases
• C When you need to share cached data across multiple app service instances and improve scalability ✓ Correct
• D When caching simple boolean values that don't require persistence

Your application integrates with Microsoft Graph API to access user profile information. You need to handle token expiration gracefully. Which approach is recommended?

• A Cache the access token indefinitely and refresh only when a 401 error occurs
• B Request a new token for every API call to ensure it's always valid
• C Proactively refresh the access token before expiration using token refresh logic ✓ Correct
• D Store multiple tokens in the session and rotate through them when errors occur

You need to create an Azure Logic App that triggers when a file is uploaded to a specific Azure Blob Storage container. Which trigger should you use?

• A Azure Blob Storage - When a blob is added or modified ✓ Correct
• B HTTP trigger that waits for a webhook notification from blob storage
• C Recurrence trigger with polling interval set to check for new blobs
• D Azure Queue Storage trigger with a timer-based interval

An application uses Azure Service Bus topics with multiple subscriptions. You need to filter messages so that different subscribers only receive relevant messages. Which feature should you implement?

• A Subscription filters and correlation filters on each subscription ✓ Correct
• B Separate topics for each subscriber with duplicate messages
• C Message routing policies in the topic properties
• D Message deduplication rules on the Service Bus namespace

You are developing a Web API that uses dependency injection with Azure App Service. How should you register a dependency that requires configuration from Azure Key Vault?

• A Register the dependency inline in the middleware pipeline with direct Key Vault calls
• B Load all Key Vault secrets into environment variables and register the dependency in Program.cs
• C Store dependencies as static singleton objects initialized at application startup with hardcoded vault references
• D Register in Startup.cs ConfigureServices method, retrieving values from Key Vault and IConfiguration ✓ Correct

Your Azure Function processes messages with varying processing times. Some messages take 30 seconds while others take 5 minutes. What should you configure to prevent timeout issues?

• A Set the functionTimeout property in host.json to accommodate the longest processing time
• B Split long-running functions into multiple chained Azure Functions with separate timeouts
• C Use the Durable Functions orchestration pattern for long-running operations, and set appropriate timeout values ✓ Correct
• D Run all functions with a maximum timeout of 10 minutes globally across the function app

You need to implement rate limiting for a public API running on Azure App Service. Which approach is most effective?

• A Configure Azure Front Door rules to block IP addresses after a certain number of requests
• B Implement rate limiting logic in your application code using a sliding window algorithm
• C Use Azure Service Bus with queue-based processing to naturally limit request processing rate
• D Use Azure API Management with rate limiting policies and quotas to control client request rates ✓ Correct

An application uses managed identity to access Azure Key Vault from an Azure App Service. The managed identity cannot retrieve secrets. What is the most likely issue?

• A The application is not using the correct endpoint URL for Key Vault
• B Managed identities cannot be used with Key Vault; you must use connection strings instead
• C The managed identity was not assigned the 'Key Vault Contributor' role
• D The Key Vault access policy does not grant the managed identity 'get' permission for secrets ✓ Correct

You are designing a data processing pipeline where an Azure Function receives data, processes it, and stores results in Cosmos DB. The function must handle partial failures gracefully. Which pattern should you implement?

• A Wrap the entire function in a try-catch and retry all operations on any exception
• B Process data in batches with individual error handling per item, logging failures separately for retry ✓ Correct
• C Use Event Grid to handle errors and automatically re-queue failed messages to the original source
• D Implement idempotent operations and use Cosmos DB stored procedures for transactional writes

Your application needs to send notifications via email and SMS when critical events occur. Which Azure service should you use to decouple the notification logic from event processing?

• A Azure Event Grid to route events to Azure Logic Apps or Azure Functions that trigger notifications ✓ Correct
• B Azure Notification Hubs exclusively for all notification types and delivery channels
• C Azure SendGrid connector directly in your application code for immediate notification
• D Azure Service Bus queues to store events and a scheduled function to process them

You are implementing a document processing workflow where documents are uploaded to Blob Storage and require OCR processing. Which architecture best handles this asynchronous workload?

• A Blob Storage trigger that invokes an Azure Function for processing, with results stored separately ✓ Correct
• B Synchronous Azure Function triggered by HTTP request that processes and returns results immediately
• C Azure App Service web job that continuously polls Blob Storage for new documents to process
• D Logic App scheduled to run every hour and process all pending documents in batch mode

Your application authenticates users via Azure AD B2C and needs to store user preferences in a custom claim. How should you implement this?

• A Modify the JWT token after it's issued by Azure AD to add custom claims in your middleware
• B Use Azure AD B2C built-in claims only; custom claims are not supported in B2C tokens
• C Add custom claims through Azure AD B2C user attributes and include them in the token via application extensions ✓ Correct
• D Store preferences in a separate database and query them after token validation in your application

You need to ensure that an Azure Function triggered by Service Bus messages processes messages in a specific order and handles failures without losing messages. What should you configure?

• A Configure the function to retry indefinitely until the message is successfully processed
• B Set cardinality to 'many' to batch process multiple messages concurrently
• C Use a Service Bus session ID to maintain message ordering and enable dead-letter queue for failed messages ✓ Correct
• D Use Topic subscriptions with separate functions to parallelize message processing across multiple workers

An application running on Azure Container Instances needs to access secrets stored in Azure Key Vault. Which is the recommended approach?

• A Pass secrets as environment variables in the container definition and load them on startup
• B Store secrets in a Docker image layer encrypted with Azure Disk Encryption
• C Mount a volume containing exported Key Vault secrets to the container at startup
• D Use a managed identity assigned to the container instance and reference secrets via Key Vault API at runtime ✓ Correct

You are building a solution that processes streaming data in real-time and requires complex event processing with state management. Which Azure service is most appropriate?

• A Azure Data Factory for scheduling and orchestrating data movement between sources and destinations
• B Azure Event Hubs as a simple data ingestion point with processing in separate components
• C Azure Stream Analytics for real-time event processing with SQL-like query language ✓ Correct
• D Azure Synapse Analytics for batch processing and historical analysis of event data

Your application uses Azure SQL Database and needs to implement column-level encryption for sensitive personal data. Which feature provides this with automatic decryption?

• A SQL Database backup encryption with Azure Key Vault integration
• B Always Encrypted with deterministic or randomized encryption depending on query needs ✓ Correct
• C Application-level hash encryption with a salt stored separately in a second database
• D Azure SQL Transparent Data Encryption (TDE) with database-level encryption

You need to deploy a multi-container application to Azure. The containers require persistent storage, service discovery, and automatic scaling. Which service should you use?

• A Azure Virtual Machines with manually installed container runtime for maximum control
• B Azure Container Instances for simple, container-by-container deployment
• C Azure App Service with Docker containers for built-in scaling and deployment slots
• D Azure Kubernetes Service (AKS) for orchestration, service discovery, persistent storage, and scaling ✓ Correct

You are developing an Azure Function that processes messages from an Azure Service Bus queue. The function must process messages in order and ensure that no message is processed more than once, even if the function crashes during execution. Which approach should you implement?

• A Use the default AutoComplete mode and implement idempotent message processing logic with a database checkpoint
• B Use PeekLock mode with manual message completion and store processed message IDs in a durable state store ✓ Correct
• C Enable session-based processing with automatic message deduplication at the Service Bus namespace level
• D Configure the function with ManualTriggerAttribute and implement a custom message lock mechanism

Your Azure App Service application needs to store sensitive connection strings and API keys. Which Azure service should you use to centrally manage and rotate these secrets?

• A Azure Key Vault with managed identity authentication ✓ Correct
• B Application Insights configuration store
• C Azure App Service Configuration settings in web.config
• D Environment variables stored in the App Service plan

You are implementing a caching strategy for an Azure App Service application using Azure Cache for Redis. The application frequently accesses user profile data. Which pattern minimizes cache misses while reducing database load?

• A Refresh-ahead pattern that preemptively loads all user profiles into cache during off-peak hours
• B Write-through pattern that updates both cache and database synchronously on every profile change
• C Cache-aside pattern with sliding expiration and lazy loading on cache misses, combined with database query optimization ✓ Correct
• D Cache-aside pattern with a 24-hour TTL for all user profiles regardless of access frequency

When using the Microsoft Azure SDK for .NET, how do you configure a retry policy for transient failures in Azure Blob Storage operations?

• A Configure retry behavior exclusively through the Azure Portal's storage account settings
• B Create a BlobClientOptions object, set the Retry property with a RetryOptions containing retry mode and delay parameters ✓ Correct
• C Set the MaximumRetryCount property on the BlobClient options and implement exponential backoff manually
• D Use the RetryPolicy class with the BlobClientOptions to define retry behavior

You need to implement cross-origin resource sharing (CORS) for an Azure Static Web App that calls an Azure Function API. The static web app is hosted at https://app.contoso.com and needs to make requests to https://api.contoso.com. What should you configure?

• A CORS settings on the Azure Function app, specifying the allowed origin https://app.contoso.com ✓ Correct
• B Shared access signatures (SAS) on the Function app with cross-origin permissions
• C CORS rules on the Azure Static Web App resource to allow all origins
• D Network security group rules to permit traffic between the two resources

Your team is implementing distributed tracing for microservices running in Azure Container Instances. You need to correlate logs and traces across multiple containers. Which approach is most suitable?

• A Write all logs to a shared Azure Table Storage and manually parse timestamps to correlate events
• B Use Application Insights with automatic dependency tracking and correlation IDs passed through HTTP headers ✓ Correct
• C Configure Docker logging drivers to send all container logs to a central Azure Log Analytics workspace without instrumentation
• D Implement custom correlation by adding container IDs to all application log entries and storing them in Azure Blob Storage

You are developing an Azure Function that must scale independently based on the number of items in an Azure Cosmos DB change feed. Which hosting plan and trigger combination should you use?

• A Premium plan with TimerTrigger that polls the change feed every 60 seconds
• B Consumption plan with QueueTrigger as an intermediary between Cosmos DB and the function
• C Dedicated (App Service) plan with ManualTrigger and a separate orchestration function
• D Consumption plan with CosmosDBTrigger and autoscaling based on checkpoint lag ✓ Correct

When implementing authentication for an Azure Function using Azure AD (Entra ID), you need to validate JWT tokens issued by your organization's tenant. Which configuration is required in the function code?

• A Manually download the Azure AD signing keys and validate the JWT signature in every function invocation
• B Store the Azure AD client secret in the function code and validate it against the token claims
• C Use the [Authorize] attribute with a policy that references Azure AD as the authentication scheme
• D Configure Azure Function authentication at the platform level using Easy Auth (App Service Authentication), which automatically validates tokens before the function executes ✓ Correct

You need to process JSON documents in an Azure Function and validate them against a schema. The schema validation must reject invalid documents before processing. Which approach is most efficient?

• A Deserialize JSON into strongly-typed C# classes and rely on property attributes for validation
• B Use a NuGet package like JsonSchema.Net to validate documents against a JSON schema file stored in Blob Storage ✓ Correct
• C Store the schema in Cosmos DB and query it during each validation
• D Implement custom regex patterns to validate the JSON structure

Your organization requires that all data stored in Azure Storage accounts be encrypted with customer-managed keys (CMK). You have created keys in Azure Key Vault. What must you do to enable encryption at rest?

• A Enable encryption in the Storage account settings and grant the Storage account's managed identity access to the Key Vault containing the keys, then select the CMK from the Storage account's Encryption blade ✓ Correct
• B Create a service principal with permissions to Key Vault and store the credentials in the Storage account configuration
• C Configure a shared access signature (SAS) token on the Key Vault and reference it in the Storage account's advanced security settings
• D Use the Azure Storage Encryption API to manually encrypt all blobs before uploading them