AZ-104 Implement and Manage Storage Practice Test 10 — 15 Questions

Question 1

A finance team stores PDF statements in Azure Blob Storage. The workload must survive a zone failure in the primary region, and if the entire region becomes unavailable, auditors still need read-only access to the copies in the secondary region. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it combines zone redundancy with geo-replication and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone redundancy (synchronous replication across Azure availability zones within the primary region) with geo-replication (asynchronous replication to a secondary region), and crucially enables read access to the secondary region even when the primary is unavailable. This meets the requirement to survive a zone failure (via ZRS) and provide read-only access during a full regional outage (via the read-access geo-replication endpoint).

Answer

ZRS, because it keeps copies across zones but does not replicate to another region.

Answer

LRS, because it keeps three copies in a single datacenter and is sufficient for regional resilience.

Answer

GRS, because it provides geo-replication and always allows direct reads from the secondary region.

Question 2

A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?

Accepted Answer

A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Azure AD authentication, meeting the requirement of no account keys, passwords, or connection strings.

Answer

The storage account key, because it is the simplest way to authenticate an application securely.

Answer

A shared access signature embedded in the app settings, because SAS is the same as managed identity.

Answer

An anonymous public container with write access disabled on the account.

Question 3

An administrator wants a storage account to be accessible only from one subnet. The storage account should still use its public FQDN, the team does not want a private IP address in the VNet, and they do not want to manage private DNS zones. Which solution should be used?

Accepted Answer

Enable a service endpoint on the subnet and restrict the storage firewall to that subnet.. Option B is correct because a service endpoint allows the storage account to be accessed from a specific subnet while still using the public FQDN. By enabling a service endpoint on the subnet and configuring the storage firewall to allow traffic only from that subnet, the administrator meets all requirements: no private IP, no private DNS zones, and access restricted to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Peer the subnet to a dedicated storage VNet and route traffic through peering.

Answer

Assign a route table with a host route to the storage account.

Question 4

A compliance team stores signed contract scans in Azure Blob Storage. The data must remain available if one zone in the primary region fails. If the entire primary region is unavailable, the team also needs to read the secondary copy while recovery work is underway. Which redundancy option should you choose for the storage account?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous zone-level redundancy within the primary region (protecting against a single zone failure) and asynchronous geo-replication to a secondary region. Additionally, it enables read access to the secondary region at all times, allowing the compliance team to read the secondary copy immediately if the primary region becomes unavailable, without waiting for a failover.

Answer

ZRS, because it protects against a single zone failure in one region.

Answer

GRS, because it keeps a geo-replicated copy but does not provide zone redundancy in the primary region.

Answer

GZRS, because it combines zone redundancy with geo-replication and supports failover recovery.

Question 5

A records team stores monthly regulatory exports in a blob container. The files are rarely opened, but auditors may request one specific file later the same day. The team wants the lowest storage cost possible while keeping a path to restore a single file on demand. Which approach should you use?

Accepted Answer

Move the blobs to the Archive tier and use high-priority rehydration when a file is requested.. The Archive tier offers the lowest storage cost for rarely accessed data, and high-priority rehydration allows a single file to be restored within approximately one hour, meeting the auditor's same-day request requirement. This approach minimizes cost while retaining the ability to retrieve a specific file on demand.

Answer

Keep the blobs in the Hot tier and rely on lifecycle rules to delete them after 90 days.

Answer

Move the blobs to the Cool tier because it is offline until accessed.

Answer

Use the Cold tier because it requires a rehydration job before the blob becomes readable.

Question 6

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key. Which two temporary access methods can be used? Select two.

Accepted Answer

Service SAS, because it grants scoped access to a container or blob for a limited time.. Option A is correct because a Service SAS (Shared Access Signature) allows you to delegate limited-time, scoped access to a specific container or blob without exposing the storage account key. It can be configured with a start time, expiry time, and permissions (e.g., write, read), making it ideal for a 12-hour upload window. This method ensures the partner can only access the designated container for the required duration.

Answer

Storage account shared key, because it can be time-limited when copied into an email.

Answer

Anonymous access, because it can be enabled for the container and expires automatically after 12 hours.

Answer

Resource lock, because it can restrict the partner to one container without requiring any token.

Question 7

A VM-based application needs to read from Azure Storage without storing a password, access key, or other secret in code or configuration. The identity should also be removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM: when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any secrets in code or configuration, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A storage account access key

Answer

A shared access signature

Question 8

An administrator archives monthly log exports in a blob container to reduce storage cost. During an audit, one archived blob must be downloaded and opened later the same day. What must the administrator do before the blob can be read?

Accepted Answer

Change the blob tier from Archive to Hot or Cool and wait for rehydration to finish. Blobs stored in the Archive tier are offline and must be rehydrated to the Hot or Cool tier before they can be read. Rehydration can take up to 15 hours, so the administrator must initiate a tier change and wait for completion before downloading the blob. Option B correctly identifies this required step.

Answer

Read the blob directly from the Archive tier because archive data remains immediately online

Answer

Copy the blob to a new container in the same account to bypass the archive restriction

Answer

Assign an Azure RBAC role to the auditor so the archived blob becomes available immediately

Question 9

A workload uses Azure Blob Storage for customer uploads. The team wants protection against a datacenter failure within the primary region and wants data copied to a paired region for disaster recovery, but they do not need to read from the secondary region during normal operations. Which redundancy option fits best?

Accepted Answer

GZRS. GZRS (Geo-Zone-Redundant Storage) is correct because it combines ZRS within the primary region (synchronously replicating data across three Azure availability zones) with asynchronous geo-replication to a paired secondary region. This provides protection against both a datacenter failure (via ZRS) and a full region failure (via geo-replication), while the lack of read access from the secondary during normal operations matches the requirement exactly.

Answer

ZRS

Answer

RA-GZRS

Answer

GRS

Question 10

An administrator archived monthly log exports in a blob container six weeks ago. An auditor now needs to open one of those files later today, and the file must be readable from Azure Storage rather than restored from a separate backup copy. What should the administrator do?

Accepted Answer

Start rehydration of the blob to the Hot tier before opening it.. Option B is correct because blobs in the Archive tier are offline and cannot be read directly. To access the data, the blob must first be rehydrated to the Hot or Cool tier, which changes its state to online and readable. Rehydration can take up to 15 hours, so the administrator must start this process well before the auditor needs the file.

Answer

Open the blob directly from the Archive tier because archived blobs remain online for read access.

Answer

Change the blob to the Cold tier, because Cold is designed for archived content.

Answer

Use a snapshot of the archived blob, because snapshots can be opened even when the base blob is archived.

Question 11

A storage account must accept traffic only from a single subnet. The team wants to keep using the storage account's public endpoint and does not want to deploy a private endpoint. What should you configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule that allows that subnet. Option B is correct because a service endpoint on the subnet extends the virtual network identity to the storage account, and a storage firewall rule that allows that subnet restricts access to only traffic originating from that subnet. This meets the requirement of using the public endpoint without deploying a private endpoint, as the storage account's public endpoint remains accessible but is locked down to the specified subnet via the firewall rule.

Answer

A private endpoint and private DNS zone

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Archive access tier for the container

Question 12

A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Option A is correct because enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.

Answer

Create a private endpoint and disable the public endpoint.

Answer

Assign a SAS token to the subnet so only resources there can connect.

Answer

Use an Azure Policy assignment to block public traffic to the storage account.

Question 13

A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Accepted Answer

User delegation SAS. A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.

Answer

Shared access key authentication

Answer

Account SAS

Answer

Service endpoint access with network rules only

Question 14

A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account network rules.. Option B is correct because a service endpoint on the subnet allows the web app to access the storage account via its public FQDN while restricting access to that specific subnet. By enabling the Microsoft.Storage service endpoint on the subnet and adding the subnet's virtual network rule to the storage account's network rules, traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network, and only traffic from that subnet is permitted. This meets the requirement of limiting access without deploying a private endpoint or managing private DNS records.

Answer

Deploy a private endpoint and private DNS zone.

Answer

Add a route table that sends storage traffic to an NVA.

Answer

Place the storage account behind a public load balancer.

Question 15

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. Option C (GZRS) is correct because it provides both zone-redundant storage (ZRS) within the primary region, ensuring survival of an availability zone failure, and geo-replication (GRS) to a secondary region, ensuring availability if the entire primary region becomes unavailable. This meets both requirements of the question.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.