AZ-104 Implement and Manage Storage Practice Test 11 — 15 Questions

Question 1

A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.

Answer

Create a private endpoint and disable the public endpoint.

Answer

Assign a SAS token to the subnet so only resources there can connect.

Answer

Use an Azure Policy assignment to block public traffic to the storage account.

Question 2

A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Accepted Answer

User delegation SAS. A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.

Answer

Shared access key authentication

Answer

Account SAS

Answer

Service endpoint access with network rules only

Question 3

A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account network rules.. A service endpoint on the subnet allows the web app to access the storage account via its public FQDN while restricting access to that specific subnet. By enabling the Microsoft.Storage service endpoint on the subnet and adding the subnet's virtual network rule to the storage account's network rules, traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network, and only traffic from that subnet is permitted. This meets the requirement of limiting access without deploying a private endpoint or managing private DNS records.

Answer

Deploy a private endpoint and private DNS zone.

Answer

Add a route table that sends storage traffic to an NVA.

Answer

Place the storage account behind a public load balancer.

Question 4

A company stores contract PDFs in Azure Blob Storage. The application must keep working if one datacenter in the primary region has an outage, and auditors also want read-only access to the replicated data from the secondary region during a regional outage. Which redundancy option should the administrator choose?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone-redundant storage (ZRS) across availability zones in the primary region with geo-replication to a secondary region, and crucially enables read access to the secondary region data during a regional outage. This ensures the application remains available if one datacenter fails (via ZRS) and satisfies the auditors' requirement for read-only access to replicated data during a regional outage (via the read-access flag).

Answer

LRS

Answer

ZRS

Answer

GZRS

Question 5

An archived blob must be read tomorrow morning. Which two actions are required before the blob can be opened? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool so the data becomes online again.. An archived blob is in an offline state and must be rehydrated to the Hot or Cool tier before it can be read. Changing the access tier initiates the rehydration process, which makes the blob data online and accessible.

Answer

Enable a private endpoint, because archive blobs can only be read through private connectivity.

Answer

Convert the storage account to GZRS, because geo-replication automatically restores archived blobs.

Answer

Set the container ACL to public so archived blobs can be read without rehydration.

Question 6

A records team stores blobs that are read often during the first month and then rarely accessed later, but the files must stay online the whole time. Which two access tiers should they use for the active and inactive data sets? Select two.

Accepted Answer

Hot, because it is optimized for frequent reads and online access to active data.. The Hot access tier is optimized for frequent reads and provides low-latency online access, making it ideal for the active data set that is read often during the first month. Option B is correct because the Cool access tier is designed for infrequently accessed data that must remain online, with lower storage costs but higher access costs, perfectly matching the rarely accessed but always online requirement.

Answer

Archive, because it is best for data that must be opened immediately by users.

Answer

Premium block blob, because it is the standard tier for long-term retention and low-cost storage.

Answer

Cold, because it is intended for data that can stay offline until someone requests it.

Question 7

A media archive contains video files that are accessed only a few times per year, but they must remain online and readable immediately whenever an investigator requests them. Which blob access tier should the administrator choose to minimize storage cost?

Accepted Answer

Cold. The Cold tier is the correct choice because it provides online, immediately readable storage for data accessed only a few times per year, while offering lower storage costs than the Cool tier. Unlike the Archive tier, Cold tier data does not require a rehydration delay, ensuring instant access for investigators.

Answer

Hot

Answer

Cool

Answer

Archive

Question 8

A legal department keeps signed contract scans in a blob container. The files are almost never opened, but when a reviewer requests one, it must be available later the same day and then stay online for about three days while the review is completed. The team wants the lowest ongoing storage cost during that review window. What should the administrator do?

Accepted Answer

Rehydrate the blob to the Cool tier with standard priority. Rehydrating the blob from Archive to the Cool tier with standard priority meets the requirement of making the file available later the same day (standard priority rehydration completes within 1–15 hours) and provides the lowest ongoing storage cost during the three-day review window, as Cool tier is cheaper than Hot tier for data that is infrequently accessed.

Answer

Leave the blob in Archive and download it directly when needed

Answer

Copy the blob to the Hot tier permanently before the review starts

Answer

Change the storage account replication to GZRS to make archived data readable

Question 9

An analytics team keeps quarterly telemetry exports in Azure Blob Storage. The files are accessed only a few times per year, but when they are needed they must remain online and immediately readable without any rehydration delay. Which access tier should you use?

Accepted Answer

Cold, because it is intended for rarely accessed online data with lower storage cost.. The Cold tier is designed for data that is rarely accessed but must remain online with immediate read access, offering lower storage costs than Cool or Hot tiers while avoiding the rehydration delay of Archive. The scenario specifies files are accessed only a few times per year but must be immediately readable without any rehydration delay, which matches Cold tier's purpose of providing online access with no latency for infrequent reads.

Answer

Hot, because it is optimized for frequent reads and writes.

Answer

Cool, because it is designed for infrequently accessed data that still stays online.

Answer

Archive, because it is the cheapest tier and can be opened directly in the portal.

Question 10

A development team stores build artifacts in Azure Blob Storage. The artifacts must remain available if one datacenter in the Azure region fails, but the business does not want to pay for replication to another region. Which redundancy option should the administrator select?

Accepted Answer

ZRS, because it distributes copies across availability zones within the same region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring durability even if one entire datacenter (zone) fails. This meets the requirement of intra-region resilience without incurring the cost of geo-replication to another region.

Answer

LRS, because it keeps multiple copies in the same zone and is the cheapest option.

Answer

GRS, because it keeps the workload available in two regions at all times.

Answer

RA-GRS, because it provides zone redundancy and read access in the secondary region.

Question 11

A legal department keeps evidence files in Azure Blob Storage. The files are accessed only a few times per year, but they must stay online and be immediately readable when requested. The team wants the lowest-cost online tier and does not want a rehydration step. Which tier should you choose?

Accepted Answer

Cold, because it keeps data online and is intended for rarely accessed content.. The Cold tier is the correct choice because it is an online tier designed for rarely accessed data that must remain immediately readable without a rehydration step. It offers lower storage costs than Hot or Cool while still providing instant access, meeting the requirement for the lowest-cost online tier.

Answer

Hot, because it prioritizes immediate access over storage cost.

Answer

Cool, because it is an online tier for infrequent access.

Answer

Archive, because it has the lowest cost and can be opened instantly from the portal.

Question 12

A compliance team keeps signed contract scans in Azure Blob Storage. The files are usually read only a few times per year, but when a reviewer needs one, it must be available immediately without waiting for rehydration. Which access tier should the administrator use?

Accepted Answer

Cold, because it is designed for infrequently accessed data and remains online for immediate reads.. The Cold access tier is designed for data that is infrequently accessed but must remain online and immediately readable without any rehydration delay. Since the compliance team needs instant access to contract scans when requested, Cold tier provides low-cost storage while keeping data online, unlike Archive which requires rehydration.

Answer

Hot, because it is optimized for frequent access and immediate retrieval.

Answer

Cool, because it is online and suited to infrequent access while remaining immediately readable.

Answer

Archive, because it is the lowest-cost option and can still be read instantly.

Question 13

A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.

Accepted Answer

Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.. Enabling a Microsoft.Storage service endpoint on the subnet extends the virtual network identity to the storage service, allowing traffic from that subnet to reach the storage account over the Azure backbone network without using a public IP. This ensures private connectivity from the subnet to the storage account while keeping the storage account's public endpoint enabled but restricted.

Answer

Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.

Answer

Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.

Answer

Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.

Question 14

An operations team archived monthly log exports six weeks ago. An auditor now needs one specific blob restored within a day, and the file will likely be opened several times during the audit. Which action should the administrator take first?

Accepted Answer

Rehydrate the blob to the Hot tier. The blob is currently in the Archive tier, which is offline and cannot be read directly. To access the data, the blob must first be rehydrated to an online tier (Hot or Cool) by changing its tier or copying it to a new blob. Rehydrating to the Hot tier ensures the blob is available for multiple reads within the audit timeframe, as the rehydration process typically takes up to 15 hours for Archive tier blobs.

Answer

Set the blob directly to the Archive tier again

Answer

Create a snapshot of the archived blob and open the snapshot

Answer

Increase the account redundancy to RA-GRS before the audit

Question 15

A records team wants blobs to be replicated to a secondary region, and the secondary copy must be readable if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it provides geo-redundant replication (GRS) to a secondary region, plus read access to the secondary copy even if the primary region is unavailable. This ensures the blob data is replicated asynchronously to a paired secondary region, and the secondary endpoint can be read immediately during a primary outage, meeting the team's requirement for readable secondary copies.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)