AZ-104 Implement and Manage Storage — 20 Questions

Question 1

What should the administrator do to prevent anyone from changing the retention settings after validation?

Accepted Answer

Lock the immutability policy after validation is complete.. Locking a time-based retention policy makes it immutable and prevents any changes to retention settings. Legal hold is a separate immutability type that is not locked and can be cleared by authorized users; it should not be confused with a time-based retention lock. For time-based retention, locking is the correct step to make settings permanent.

Answer

Move the container to the Cool access tier to preserve the retention period.

Answer

Create a blob snapshot every day so the retention settings cannot be edited.

Answer

Enable container public access so the audit logs are easier to verify.

Question 2

A hub-and-spoke environment already has an Azure VPN gateway deployed in the hub VNet. A spoke VNet must send on-premises traffic through that existing gateway, and administrators must be able to manage the peering from either side without creating a separate gateway in the spoke. Which two peering settings are required? Select two.

Accepted Answer

Enable Allow gateway transit on the hub-to-spoke peering.. To allow a spoke VNet to use the hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway in the spoke, two peering settings are required. First, enable 'Allow gateway transit' on the hub-to-spoke peering (configured from the hub side). This allows the hub VNet to advertise its VPN gateway routes to the spoke. Second, enable 'Use remote gateways' on the spoke-to-hub peering (configured from the spoke side). This instructs the spoke VNet to use the remote (hub's) gateway for outbound traffic to on-premises networks. Both settings are necessary; 'Allow forwarded traffic' is not sufficient for VPN gateway transit, and 'Allow gateway transit' is not set on the spoke-to-hub peering.

Answer

Enable Allow forwarded traffic on both peerings as the only required setting.

Answer

Enable Allow gateway transit on the spoke-to-hub peering.

Answer

Create a user-defined route that points all on-premises prefixes to the hub VNet gateway.

Question 3

Based on the exhibit, which redundancy setting should you choose before deploying the storage account?

Accepted Answer

RA-GZRS, because it provides zone redundancy and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because the exhibit shows a requirement for zone redundancy within the primary region and read access to the secondary region in the event of a primary region outage. RA-GZRS provides zone-redundant storage in the primary region (synchronously replicating data across Azure availability zones) and asynchronously replicates data to a secondary region, where it is stored with LRS. The 'RA' prefix enables read access to the secondary endpoint, allowing applications to serve read requests from the secondary region even when the primary is unavailable.

Answer

LRS, because it keeps three copies within one datacenter and is the least expensive option.

Answer

ZRS, because it replicates data across availability zones in the primary region.

Answer

GZRS, because it combines zone redundancy with geo-replication to another region.

Question 4

A backup archive must survive a regional outage, and engineers need to read the secondary copy if the primary region is unavailable. Which two redundancy options meet both requirements? Select two.

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) and RA-GZRS (Read-Access Geo-Zone-Redundant Storage) are correct because they both replicate data to a secondary region, ensuring survival of a regional outage, and they also enable read access to the secondary copy at any time, even if the primary region is unavailable. GRS and GZRS replicate data to a secondary region but require a failover to enable read access to the secondary copy, so they do not meet the requirement to read without a failover.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 5

A workload must keep storage available if one availability zone in the primary region fails. Geo-failover is optional, but the account must still meet the zone-failure requirement. Which two redundancy options satisfy this? Select two.

Accepted Answer

ZRS. Both ZRS and GZRS meet the zone-failure requirement. ZRS synchronously replicates data across three availability zones within a single region, ensuring availability if one zone fails. GZRS also replicates synchronously across availability zones in the primary region (combining ZRS with geo-redundancy), so it also satisfies the requirement even without considering the optional geo-failover. LRS, GRS, and RA-GRS do not provide zone-level redundancy within the primary region.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 6

A legal department stores scanned contracts that are kept for compliance and are almost never opened. They want the lowest storage cost, and it is acceptable if files take time to become available before download. Which blob tier should you choose?

Accepted Answer

Archive. The Archive tier is the lowest-cost storage tier in Azure Blob Storage, designed for rarely accessed data. It requires rehydration (which can take up to 15 hours) before data becomes available. The Cold tier is also a valid tier, but it offers higher storage cost than Archive and faster retrieval. For compliance data that is almost never opened and where delayed access is acceptable, Archive is the correct choice.

Answer

Hot

Answer

Cool

Answer

Cold

Question 7

A finance archive stores critical blobs in an Azure region that supports availability zones. The data must survive a single zone failure and also remain available if the primary region becomes unavailable. The team does not need a read-only endpoint in the secondary region during normal operations. Which two redundancy models satisfy the requirement? Select two.

Accepted Answer

GZRS. Both GZRS and RA-GZRS combine zone-redundant storage (ZRS) in the primary region to survive a single zone failure with geo-redundancy to a secondary region, ensuring data remains available if the primary region becomes unavailable. The difference is that RA-GZRS provides read access to the secondary region during normal operations, while GZRS does not. Since the team explicitly does not need a read-only endpoint in the secondary region during normal operations, GZRS is the more cost-effective choice, but RA-GZRS also meets the stated requirement. Therefore, both D and E are correct.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 8

A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key and wants the access to expire automatically. Which two actions should the administrator take? Select two.

Accepted Answer

Generate a user delegation SAS for the contractor.. A user delegation SAS is secured with Azure AD credentials rather than the storage account key, allowing the administrator to grant time-limited access without exposing the key. Setting the SAS expiry to six hours ensures the contractor's access automatically expires after the required duration, meeting both security and time-bound requirements. Option C is correct because it directly specifies the expiry time for the SAS, which aligns with the requirement for automatic expiration after six hours.

Answer

Generate a service SAS by using the account key.

Answer

Enable anonymous blob access on the container.

Answer

Create a storage account access key specifically for the contractor.

Question 9

An employee accidentally deletes several folders from an Azure file share. The administrator must recover only those folders from yesterday, not roll back the whole share. What should the administrator use?

Accepted Answer

A snapshot of the Azure file share from yesterday. To recover the deleted folders, use an Azure file share snapshot that was created before the deletion (for example, yesterday). Mount that snapshot, copy the deleted folders back to the live share, and then unmount the snapshot. This provides granular, file-level recovery without rolling back the entire share.

Answer

The storage account access key

Answer

A shared access signature

Answer

A private endpoint to the storage account

Question 10

A web app has a system-assigned managed identity but currently reads blobs by using the storage account key. Security now requires blocking any future requests that use shared key authorization, while the app must continue to work without storing secrets. Which two changes should the administrator make? Select two.

Accepted Answer

Disable shared key access on the storage account.. To block shared key authorization, disable shared key access on the storage account (A). To allow the app to continue reading blobs without storing secrets, assign its managed identity a data-plane role such as Storage Blob Data Reader (B). Using a storage account key or SAS continues secret/shared key exposure, and removing network rules does not address authorization.

Answer

Replace the managed identity with a storage account key in the app settings.

Answer

Remove all network rules from the storage account.

Answer

Create a service SAS and embed it in the code.

Question 11

A 180-GB blob is in the Archive tier. A legal team needs the file available later today and expects to open it several times during review. Which two actions should the administrator take? Select two.

Accepted Answer

Initiate rehydration of the blob to the Hot tier.. To make the 180-GB blob available for frequent reads later today, the administrator must explicitly rehydrate it from Archive to an online tier. Hot tier is appropriate because it is optimized for high access rates. Since the blob is needed later today, High priority rehydration should be chosen to speed up availability (approximately 1 hour, versus up to 15 hours for Standard priority). Therefore, the correct actions are A (initiate rehydration to Hot) and C (choose High priority).

Answer

Leave the blob in Archive and rely on first access to trigger rehydration.

Answer

Copy the blob to a new container and keep it in Archive.

Answer

Apply a lifecycle rule that moves the blob to Cool after rehydration completes.

Question 12

An on-premises ERP server connected to Azure through a site-to-site VPN must read and write blobs in a storage account by using the storage account's private IP address. Public network access must be blocked. Which storage configuration should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. A private endpoint assigns the storage account a private IP address from an Azure virtual network subnet. The on-premises server, connected via a site-to-site VPN, can reach this private endpoint over the VPN connection. Disabling public network access ensures that all traffic must traverse the private endpoint, blocking any internet-based access. This meets the requirement of using the storage account's private IP address while preventing public exposure.

Answer

Configure a service endpoint on the on-premises subnet and leave public access enabled.

Answer

Issue a container SAS and publish the storage account public DNS name.

Answer

Enable SMB multichannel on the storage account.

Question 13

A finance application stores monthly invoice PDFs in Azure Blob Storage. The data must survive a single availability zone outage in the region, and the storage account must be reachable only through a private IP from AppSubnet. Public network access must not be available. Which three actions should the administrator take? Select three.

Accepted Answer

Create the storage account with zone-redundant storage (ZRS).. Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring data durability even if one entire zone fails—meeting the requirement to survive a single zone outage. A private endpoint (option B) assigns a private IP from AppSubnet to the storage account, making it reachable only through that private IP. Disabling public network access (option C) ensures no public endpoint is available, satisfying the requirement that public network access must not be enabled. These three actions together meet all stated requirements.

Answer

Use locally redundant storage (LRS) because it stays inside one datacenter.

Answer

Enable a service endpoint on AppSubnet instead of using a private endpoint.

Question 14

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials, not the storage account key. Yesterday, a user deleted a folder tree from the share, and only that folder tree should be restored. Which two actions should the administrator take? Select two.

Accepted Answer

Configure identity-based authentication for Azure Files with Active Directory Domain Services.. Identity-based authentication for Azure Files with Active Directory Domain Services (AD DS) allows the Windows file server VM to mount the Azure file share using existing AD DS credentials instead of the storage account key. This is required by the scenario, which specifies that the mount must use AD DS credentials. Option B is correct because Azure file share snapshots capture the state of the share at a point in time, enabling restoration of a specific deleted folder tree without affecting other data. This directly addresses the need to restore only the deleted folder tree.

Answer

Mount the share by using the storage account key in the command line.

Answer

Enable anonymous access on the file share so the VM can mount it.

Answer

Recreate the share as a blob container and use blob snapshots.

Question 15

A development team wants redundancy within the primary region but does not need replication to a secondary region. Which two Azure storage redundancy options meet this requirement? Select two.

Accepted Answer

LRS, because it keeps multiple copies in one datacenter and does not replicate to another region.. A and B are correct. LRS replicates data three times within a single datacenter in the primary region, providing redundancy against local hardware failures without any replication to a secondary region. ZRS replicates data across availability zones within the primary region, also without geo-replication. Both meet the requirement of intra-region redundancy only. GRS, RA-GRS, and RA-GZRS all replicate to a secondary region, so they do not meet the requirement.

Answer

GRS, because it replicates to a secondary region and therefore matches the requirement.

Answer

RA-GRS, because it adds read access to the secondary region and still remains single-region only.

Answer

RA-GZRS, because it combines zone redundancy with readable geo-replication to another region.

Question 16

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key. Which two temporary access methods can be used? Select two.

Accepted Answer

Service SAS, because it grants scoped access to a container or blob for a limited time.. A Service SAS (Shared Access Signature) allows you to delegate limited-time, scoped access to a specific container or blob without exposing the storage account key. It can be configured with a start time, expiry time, and permissions (e.g., write, read), making it ideal for a 12-hour upload window. This method ensures the partner can only access the designated container for the required duration. B User delegation SAS is also a valid temporary access method: it is issued with Microsoft Entra ID (Azure AD) and provides scoped, time-limited access to a container or blob without sharing the storage account key. The user delegation SAS is signed with the user's credentials rather than the account key, offering a more secure option for temporary access.

Answer

Storage account shared key, because it can be time-limited when copied into an email.

Answer

Anonymous access, because it can be enabled for the container and expires automatically after 12 hours.

Answer

Resource lock, because it can restrict the partner to one container without requiring any token.

Question 17

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. GZRS (Option C) is correct because it provides zone-redundant storage within the primary region, surviving a zone failure, and geo-replication to a secondary region, keeping data available during a regional outage. RA-GZRS (Option D) is also correct because it provides the same zone-redundancy and geo-replication as GZRS, and additionally allows read access to the secondary region, which also satisfies both requirements. Therefore, both C and D meet the stated requirement.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 18

A company wants a storage account that keeps a readable copy in the secondary region and lets read operations continue if the primary region becomes unavailable. Which two redundancy options meet this requirement? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS). Both RA-GRS and RA-GZRS maintain a readable copy in the secondary region and allow read operations to continue if the primary becomes unavailable. RA-GRS provides geo-redundant replication with continuous read access to the secondary region, while RA-GZRS combines zone-redundant storage in the primary region with geo-redundant read access to the secondary region. Both meet the requirement. GRS alone does not provide read access until failover.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 19

A storage account has public network access disabled. A VM in VNet-Prod must reach Blob storage by using the storage account name, but nslookup from the VM still returns the public endpoint address. What should the administrator do?

Accepted Answer

Create a private endpoint for the blob service and link the private DNS zone to VNet-Prod.. The VM's nslookup returns the public endpoint address, indicating that DNS resolution is not pointing to the private IP of the storage account. Creating a private endpoint for the blob service assigns a private IP from the VNet-Prod subnet to the storage account, and linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-Prod ensures that DNS queries from the VM resolve the storage account name to that private IP, bypassing the public endpoint entirely.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep public network access disabled.

Answer

Add an inbound NSG rule that allows TCP 443 from the VM to the storage account.

Answer

Turn on the trusted Microsoft services exception for the storage account firewall.

Question 20

Your company plans to migrate on-premises file shares to Azure Files. You need to choose the appropriate Azure Files configuration for different scenarios. Which three of the following statements are correct? (Choose three.)

Accepted Answer

Azure file shares can be accessed over the internet using SMB 3.0 with encryption, provided port 445 is open.. Azure Files supports SMB protocol for Windows, Linux, and macOS clients. NFS protocol is supported only on Premium file shares. Azure file shares can be accessed over the internet using SMB 3.0 with encryption if port 445 is open.

Answer

Azure file shares can be used as a backing store for Azure SQL Managed Instance databases.

Answer

Azure Files supports both SMB and NFS protocols for Standard file shares.

Answer

Azure Files requires a VPN or ExpressRoute for any access from on-premises.