AZ-104 Implement and Manage Storage Practice Test 12 — 15 Questions

Question 1

Match each storage networking requirement to the Azure storage network control that should be used.

Accepted Answer

Enable secure access from a specific VNet: Use service endpoints. Azure storage network controls: service endpoints for VNet access, private endpoints for private connectivity, IP firewall for public IP restrictions, trusted services exception, route tables for custom routing, and disabling public access for complete lockdown.

Answer

Enable secure access from a specific VNet: Use private endpoints

Answer

Restrict access to a specific public IP address: Enable trusted services exception

Answer

Block all public network access: Use IP firewall rules

Question 2

A platform team wants one Azure storage account for application logs in Blob containers and a shared working directory for a Windows admin VM and a Linux automation VM. The account must support blob lifecycle rules, standard performance, and future private endpoint access. Which storage account kind should the administrator create?

Accepted Answer

StorageV2 (general-purpose v2), because it supports blobs, Azure Files, lifecycle management, and modern network features.. StorageV2 (general-purpose v2) is the correct choice because it supports Blob storage, Azure Files (required for the shared working directory), blob lifecycle management rules, and advanced networking features like private endpoints. It also provides standard performance, meeting all stated requirements. Other storage kinds lack either Azure Files support or lifecycle management capabilities.

Answer

BlobStorage, because it is optimized for blob data and can store logs efficiently.

Answer

FileStorage, because it is the best option when Azure Files is required.

Answer

BlockBlobStorage, because it provides the highest performance for operational data.

Question 3

An organization wants a single Azure storage account that can host blob containers, Azure Files shares, and lifecycle management rules for blob data. Which storage account kind should the administrator create?

Accepted Answer

General-purpose v2 (StorageV2). General-purpose v2 (StorageV2) is the only storage account kind that supports blobs, Azure Files, and lifecycle management rules for blob data. It provides a unified account for all Azure Storage data services, including blobs, files, queues, and tables, and it natively supports lifecycle management policies to automatically tier or delete blob data based on age or other conditions.

Answer

BlobStorage

Answer

FileStorage

Answer

BlockBlobStorage

Question 4

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Accepted Answer

LRS: Locally redundant storage replicates data three times within a single datacenter in the primary region.. LRS replicates within a single datacenter; ZRS across zones; GRS across regions; RA-GRS adds read access to GRS; RA-ZRS adds read access to ZRS. LRS is cheapest, GRS is highest durability.

Answer

LRS: Provides synchronous replication across three availability zones.

Answer

GRS: Provides read access to the secondary region.

Question 5

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Accepted Answer

Move blobs not modified for 30 days: Transition to cool tier. Lifecycle management rules define actions (tier changes or deletion) based on age or access. The actions correspond to moving to cooler tiers (cool, cold, archive) or deleting, and can apply to snapshots.

Answer

Move blobs not modified for 30 days: Transition to archive tier

Answer

Move blobs not modified for 90 days: Transition to cool tier

Answer

Delete blobs after 365 days: Transition to cool tier

Question 6

An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. A service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.

Answer

Create a private endpoint for the storage account and disable the public endpoint.

Answer

Allow trusted Microsoft services to bypass the firewall.

Answer

Add a user-defined route that points storage traffic to the virtual network gateway.

Question 7

A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?

Accepted Answer

A service endpoint on AppSubnet and a storage firewall VNet rule.. A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.

Answer

A private endpoint in AppSubnet.

Answer

A VPN gateway between AppSubnet and the storage account.

Answer

A public IP address on the storage account.

Question 8

Which two authentication methods let an app access blob data without storing the storage account key on the machine? Select two.

Accepted Answer

Microsoft Entra ID authorization with an appropriate Azure RBAC role.. Microsoft Entra ID authorization with an appropriate Azure RBAC role (e.g., Storage Blob Data Contributor) allows an app to authenticate to blob storage using OAuth 2.0 tokens, eliminating the need to store the storage account key on the machine. Option B is correct because a user delegation SAS is signed with Microsoft Entra ID credentials and can be generated without the account key, providing time-limited, scoped access to blob data.

Answer

The storage account access key.

Answer

A service SAS generated directly from the account key.

Answer

Anonymous public access to the container.

Question 9

A Windows VM and a Linux VM in Azure need to use the same shared folder for application artifacts. The team wants a managed file service instead of running a separate file server VM, and both operating systems must be able to mount the share using a standard protocol. Which solution should the administrator implement?

Accepted Answer

Create an Azure Files share and mount it over SMB from both virtual machines.. Azure Files provides a fully managed file share that supports both SMB and NFS protocols. Since the question requires a managed file service accessible by both Windows and Linux VMs using a standard protocol, the correct solution is to create an Azure Files share and mount it over SMB from both VMs. Windows natively supports SMB, and Linux can mount SMB shares using the CIFS-utils package, meeting the requirement without running a separate file server VM.

Answer

Create a blob container and mount it as a file system from both virtual machines.

Answer

Use an Azure managed disk and attach it to both virtual machines.

Answer

Create an Azure Files share and force the Linux VM to use NFS while the Windows VM uses SMB.

Question 10

A help desk group must use the Azure portal to start a virtual machine, stop or deallocate it, and see its current state, but they must not change any other VM settings. Which three Microsoft.Compute actions should be included in a custom role? Select three.

Accepted Answer

Microsoft.Compute/virtualMachines/read. The Microsoft.Compute/virtualMachines/read permission is required to view the current state of a virtual machine in the Azure portal. Without this read action, the help desk group would not be able to see the VM's status, which is essential for their task of monitoring and managing the VM lifecycle.

Answer

Microsoft.Compute/virtualMachines/write

Answer

Microsoft.Compute/virtualMachines/delete

Question 11

Match each data-access pattern to the blob tier or required action.

Accepted Answer

Frequent read and write operations: Hot tier. Azure Blob Storage tiers are Hot (frequent access), Cool (infrequent, 30-day minimum), and Archive (rare, 180-day minimum). Rehydration is needed to access Archive blobs. Azure Files sync is used for replication.

Answer

Frequent read and write operations: Cool tier

Answer

Infrequent access with 30-day minimum storage duration: Archive tier

Question 12

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 13

A development team needs a single Azure Storage account for blob containers, Azure Files shares, and blob lifecycle rules. The account must support standard performance and allow future use of access tiers. Which account kind should you create?

Accepted Answer

StorageV2 because it supports blobs, Azure Files, lifecycle management, and access tiers.. StorageV2 (general-purpose v2) is the only account kind that supports blobs, Azure Files shares, lifecycle management policies, and all access tiers (hot, cool, archive) with standard performance. BlobStorage lacks Azure Files support, FileStorage is premium-only and does not support lifecycle rules, and BlockBlobStorage is premium-only and does not support Azure Files or lifecycle management.

Answer

BlobStorage because it is optimized for blobs and supports lifecycle management.

Answer

FileStorage because it is designed for file shares and can also host blob lifecycle rules.

Answer

BlockBlobStorage because it provides the best performance for lifecycle policies and file shares.

Question 14

Match each file-sharing requirement to the best Azure Files mounting or integration approach.

Accepted Answer

SMB: Requires storage account credentials and port 445 for mounting. SMB mounting requires storage account credentials; NFS needs private endpoint; REST API for programmatic access; Azure AD DS enables identity-based access; File Sync caches on-premises.

Answer

Azure AD DS: Used for programmatic access to Azure file shares

Answer

File Sync: Enables identity-based access to Azure file shares

Question 15

A business-critical storage account must survive a zone outage in the primary region and also keep a read-only copy in the paired region for reporting if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS because it provides zone redundancy and read access to the secondary region.. (RA-GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region, ensuring data survives a zone outage, with read-access geo-redundant storage (RA-GRS) to the paired region, providing a readable secondary copy for reporting if the primary region becomes unavailable. This meets both requirements: zone-level fault tolerance and read-only access to the secondary region during a primary outage.

Answer

ZRS because it protects against a single datacenter failure.

Answer

GZRS because it provides a readable secondary region by default.

Answer

RA-GRS because it provides zone redundancy and read access to the secondary region.