AZ-104 Implement and Manage Storage Practice Test 11 — 15 Questions

Question 1

A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Microsoft Entra ID authentication, meeting the requirement of no account keys, passwords, or connection strings.

Answer

The storage account key, because it is the simplest way to authenticate an application securely.

Answer

A shared access signature embedded in the app settings, because SAS is the same as managed identity.

Answer

An anonymous public container with write access disabled on the account.

Question 2

An administrator wants a storage account to be accessible only from one subnet. The storage account should still use its public FQDN, the team does not want a private IP address in the VNet, and they do not want to manage private DNS zones. Which solution should be used?

Accepted Answer

Enable a service endpoint on the subnet and restrict the storage firewall to that subnet.. A service endpoint allows the storage account to be accessed from a specific subnet while still using the public FQDN. By enabling a service endpoint on the subnet and configuring the storage firewall to allow traffic only from that subnet, the administrator meets all requirements: no private IP, no private DNS zones, and access restricted to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Peer the subnet to a dedicated storage VNet and route traffic through peering.

Answer

Assign a route table with a host route to the storage account.

Question 3

A compliance team stores signed contract scans in Azure Blob Storage. The data must remain available if one zone in the primary region fails. If the entire primary region is unavailable, the team also needs to read the secondary copy while recovery work is underway. Which redundancy option should you choose for the storage account?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous zone-level redundancy within the primary region (protecting against a single zone failure) and asynchronous geo-replication to a secondary region. Additionally, it enables read access to the secondary region at all times, allowing the compliance team to read the secondary copy immediately if the primary region becomes unavailable, without waiting for a failover.

Answer

ZRS, because it protects against a single zone failure in one region.

Answer

GRS, because it keeps a geo-replicated copy but does not provide zone redundancy in the primary region.

Answer

GZRS, because it combines zone redundancy with geo-replication and supports failover recovery.

Question 4

A records team stores monthly regulatory exports in a blob container. The files are rarely opened, but auditors may request one specific file later the same day. The team wants the lowest storage cost possible while keeping a path to restore a single file on demand. Which approach should you use?

Accepted Answer

Move the blobs to the Archive tier and use high-priority rehydration when a file is requested.. The Archive tier offers the lowest storage cost for rarely accessed data, and high-priority rehydration allows a single file to be restored within approximately one hour, meeting the auditor's same-day request requirement. This approach minimizes cost while retaining the ability to retrieve a specific file on demand.

Answer

Keep the blobs in the Hot tier and rely on lifecycle rules to delete them after 90 days.

Answer

Move the blobs to the Cool tier because it is offline until accessed.

Answer

Use the Cold tier because it requires a rehydration job before the blob becomes readable.

Question 5

A VM-based application needs to read from Azure Storage without storing a password, access key, or other secret in code or configuration. The identity should also be removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM: when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any secrets in code or configuration, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A storage account access key

Answer

A shared access signature

Question 6

An administrator archives monthly log exports in a blob container to reduce storage cost. During an audit, one archived blob must be downloaded and opened later the same day. What must the administrator do before the blob can be read?

Accepted Answer

Change the blob tier from Archive to Hot or Cool and wait for rehydration to finish. Blobs stored in the Archive tier are offline and must be rehydrated to the Hot or Cool tier before they can be read. Rehydration can take up to 15 hours, so the administrator must initiate a tier change and wait for completion before downloading the blob. Option B correctly identifies this required step.

Answer

Read the blob directly from the Archive tier because archive data remains immediately online

Answer

Copy the blob to a new container in the same account to bypass the archive restriction

Answer

Assign an Azure RBAC role to the auditor so the archived blob becomes available immediately

Question 7

A workload uses Azure Blob Storage for customer uploads. The team wants protection against a datacenter failure within the primary region and wants data copied to a paired region for disaster recovery, but they do not need to read from the secondary region during normal operations. Which redundancy option fits best?

Accepted Answer

GZRS. GZRS (Geo-Zone-Redundant Storage) is correct because it combines ZRS within the primary region (synchronously replicating data across three Azure availability zones) with asynchronous geo-replication to a paired secondary region. This provides protection against both a datacenter failure (via ZRS) and a full region failure (via geo-replication), while the lack of read access from the secondary during normal operations matches the requirement exactly.

Answer

ZRS

Answer

RA-GZRS

Answer

GRS

Question 8

An administrator archived monthly log exports in a blob container six weeks ago. An auditor now needs to open one of those files later today, and the file must be readable from Azure Storage rather than restored from a separate backup copy. What should the administrator do?

Accepted Answer

Start rehydration of the blob to the Hot tier before opening it.. Blobs in the Archive tier are offline and cannot be read directly. To access the data, the blob must first be rehydrated to the Hot or Cool tier, which changes its state to online and readable. Rehydration can take up to 15 hours, so the administrator must start this process well before the auditor needs the file.

Answer

Open the blob directly from the Archive tier because archived blobs remain online for read access.

Answer

Change the blob to the Cold tier, because Cold is designed for archived content.

Answer

Use a snapshot of the archived blob, because snapshots can be opened even when the base blob is archived.

Question 9

A storage account must accept traffic only from a single subnet. The team wants to keep using the storage account's public endpoint and does not want to deploy a private endpoint. What should you configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule that allows that subnet. A service endpoint on the subnet extends the virtual network identity to the storage account, and a storage firewall rule that allows that subnet restricts access to only traffic originating from that subnet. This meets the requirement of using the public endpoint without deploying a private endpoint, as the storage account's public endpoint remains accessible but is locked down to the specified subnet via the firewall rule.

Answer

A private endpoint and private DNS zone

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Archive access tier for the container

Question 10

A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.

Answer

Create a private endpoint and disable the public endpoint.

Answer

Assign a SAS token to the subnet so only resources there can connect.

Answer

Use an Azure Policy assignment to block public traffic to the storage account.

Question 11

A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Accepted Answer

User delegation SAS. A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.

Answer

Shared access key authentication

Answer

Account SAS

Answer

Service endpoint access with network rules only

Question 12

A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account network rules.. A service endpoint on the subnet allows the web app to access the storage account via its public FQDN while restricting access to that specific subnet. By enabling the Microsoft.Storage service endpoint on the subnet and adding the subnet's virtual network rule to the storage account's network rules, traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network, and only traffic from that subnet is permitted. This meets the requirement of limiting access without deploying a private endpoint or managing private DNS records.

Answer

Deploy a private endpoint and private DNS zone.

Answer

Add a route table that sends storage traffic to an NVA.

Answer

Place the storage account behind a public load balancer.

Question 13

A company stores contract PDFs in Azure Blob Storage. The application must keep working if one datacenter in the primary region has an outage, and auditors also want read-only access to the replicated data from the secondary region during a regional outage. Which redundancy option should the administrator choose?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone-redundant storage (ZRS) across availability zones in the primary region with geo-replication to a secondary region, and crucially enables read access to the secondary region data during a regional outage. This ensures the application remains available if one datacenter fails (via ZRS) and satisfies the auditors' requirement for read-only access to replicated data during a regional outage (via the read-access flag).

Answer

LRS

Answer

ZRS

Answer

GZRS

Question 14

An archived blob must be read tomorrow morning. Which two actions are required before the blob can be opened? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool so the data becomes online again.. An archived blob is in an offline state and must be rehydrated to the Hot or Cool tier before it can be read. Changing the access tier initiates the rehydration process, which makes the blob data online and accessible.

Answer

Enable a private endpoint, because archive blobs can only be read through private connectivity.

Answer

Convert the storage account to GZRS, because geo-replication automatically restores archived blobs.

Answer

Set the container ACL to public so archived blobs can be read without rehydration.

Question 15

A legal department keeps signed contract scans in a blob container. The files are almost never opened, but when a reviewer requests one, it must be available later the same day and then stay online for about three days while the review is completed. The team wants the lowest ongoing storage cost during that review window. What should the administrator do?

Accepted Answer

Rehydrate the blob to the Cool tier with standard priority. Rehydrating the blob from Archive to the Cool tier with standard priority meets the requirement of making the file available later the same day (standard priority rehydration completes within 1–15 hours) and provides the lowest ongoing storage cost during the three-day review window, as Cool tier is cheaper than Hot tier for data that is infrequently accessed.

Answer

Leave the blob in Archive and download it directly when needed

Answer

Copy the blob to the Hot tier permanently before the review starts

Answer

Change the storage account replication to GZRS to make archived data readable