AZ-104 Implement and Manage Storage Practice Test 12 — 15 Questions

Question 1

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Question 2

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Question 3

An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Option B is correct because a service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.

Answer

Create a private endpoint for the storage account and disable the public endpoint.

Answer

Allow trusted Microsoft services to bypass the firewall.

Answer

Add a user-defined route that points storage traffic to the virtual network gateway.

Question 4

A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?

Accepted Answer

A service endpoint on AppSubnet and a storage firewall VNet rule.. A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.

Answer

A private endpoint in AppSubnet.

Answer

A VPN gateway between AppSubnet and the storage account.

Answer

A public IP address on the storage account.

Question 5

Which two authentication methods let an app access blob data without storing the storage account key on the machine? Select two.

Accepted Answer

Microsoft Entra ID authorization with an appropriate Azure RBAC role.. Option A is correct because Microsoft Entra ID authorization with an appropriate Azure RBAC role (e.g., Storage Blob Data Contributor) allows an app to authenticate to blob storage using OAuth 2.0 tokens, eliminating the need to store the storage account key on the machine. Option B is correct because a user delegation SAS is signed with Microsoft Entra ID credentials and can be generated without the account key, providing time-limited, scoped access to blob data.

Answer

The storage account access key.

Answer

A service SAS generated directly from the account key.

Answer

Anonymous public access to the container.

Question 6

A Windows VM and a Linux VM in Azure need to use the same shared folder for application artifacts. The team wants a managed file service instead of running a separate file server VM, and both operating systems must be able to mount the share using a standard protocol. Which solution should the administrator implement?

Accepted Answer

Create an Azure Files share and mount it over SMB from both virtual machines.. Azure Files provides a fully managed file share that supports both SMB and NFS protocols. Since the question requires a managed file service accessible by both Windows and Linux VMs using a standard protocol, the correct solution is to create an Azure Files share and mount it over SMB from both VMs. Windows natively supports SMB, and Linux can mount SMB shares using the CIFS-utils package, meeting the requirement without running a separate file server VM.

Answer

Create a blob container and mount it as a file system from both virtual machines.

Answer

Use an Azure managed disk and attach it to both virtual machines.

Answer

Create an Azure Files share and force the Linux VM to use NFS while the Windows VM uses SMB.

Question 7

A help desk group must use the Azure portal to start a virtual machine, stop or deallocate it, and see its current state, but they must not change any other VM settings. Which three Microsoft.Compute actions should be included in a custom role? Select three.

Accepted Answer

Microsoft.Compute/virtualMachines/read. Option A is correct because the Microsoft.Compute/virtualMachines/read permission is required to view the current state of a virtual machine in the Azure portal. Without this read action, the help desk group would not be able to see the VM's status, which is essential for their task of monitoring and managing the VM lifecycle.

Answer

Microsoft.Compute/virtualMachines/write

Answer

Microsoft.Compute/virtualMachines/delete

Question 8

Match each data-access pattern to the blob tier or required action.

Question 9

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Option B is correct because enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 10

A development team needs a single Azure Storage account for blob containers, Azure Files shares, and blob lifecycle rules. The account must support standard performance and allow future use of access tiers. Which account kind should you create?

Accepted Answer

StorageV2 because it supports blobs, Azure Files, lifecycle management, and access tiers.. StorageV2 (general-purpose v2) is the only account kind that supports blobs, Azure Files shares, lifecycle management policies, and all access tiers (hot, cool, archive) with standard performance. BlobStorage lacks Azure Files support, FileStorage is premium-only and does not support lifecycle rules, and BlockBlobStorage is premium-only and does not support Azure Files or lifecycle management.

Answer

BlobStorage because it is optimized for blobs and supports lifecycle management.

Answer

FileStorage because it is designed for file shares and can also host blob lifecycle rules.

Answer

BlockBlobStorage because it provides the best performance for lifecycle policies and file shares.

Question 11

Match each file-sharing requirement to the best Azure Files mounting or integration approach.

Question 12

A business-critical storage account must survive a zone outage in the primary region and also keep a read-only copy in the paired region for reporting if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS because it provides zone redundancy and read access to the secondary region.. Option B (RA-GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region, ensuring data survives a zone outage, with read-access geo-redundant storage (RA-GRS) to the paired region, providing a readable secondary copy for reporting if the primary region becomes unavailable. This meets both requirements: zone-level fault tolerance and read-only access to the secondary region during a primary outage.

Answer

ZRS because it protects against a single datacenter failure.

Answer

GZRS because it provides a readable secondary region by default.

Answer

RA-GRS because it provides zone redundancy and read access to the secondary region.

Question 13

A platform team created a BlobStorage account for application logs. Later they discovered the same account must also host an Azure Files share for a Linux automation server, and lifecycle rules must continue to manage blob tiers. Standard performance is sufficient. What should they do?

Accepted Answer

Recreate the storage as a StorageV2 general-purpose v2 account. A BlobStorage account is a specialized storage account that supports only block blobs and append blobs, not Azure Files shares. To host both blobs and Azure Files, you need a general-purpose v2 (StorageV2) account, which supports all Azure Storage services including blobs, files, queues, and tables, while also allowing lifecycle management policies for blob tiering. Recreating the account as StorageV2 meets both requirements without sacrificing blob lifecycle rules.

Answer

Keep the BlobStorage account and add a private endpoint

Answer

Convert the account to Premium Block Blob storage

Answer

Create a separate file server VM and keep the BlobStorage account unchanged

Question 14

A Windows VM mounts an Azure Files share by using SMB and identity-based authentication. Which two permission layers can affect access to folders in the share? Select two.

Accepted Answer

Azure RBAC permissions on the file share. Azure RBAC permissions on the file share (Option A) control whether a user or service principal can mount the share or perform management operations, such as listing or modifying share properties. When identity-based authentication is used (Kerberos or Azure AD Kerberos), RBAC roles like 'Storage File Data SMB Share Reader' or 'Contributor' are required to grant access at the share level before any file-level permissions apply.

Answer

Network security group rules on the storage account

Answer

Blob access tier settings

Answer

Route table next-hop selection

Question 15

A hub VNet contains a VPN gateway that provides access to on-premises resources. A spoke VNet is peered to the hub and must send on-premises traffic through the hub gateway without deploying its own gateway. What peering configuration is required?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. Option B is correct because to route spoke VNet traffic through the hub VPN gateway without deploying a separate gateway in the spoke, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to use the hub's VPN gateway for on-premises connectivity, leveraging the transitive routing capability of VNet peering.

Answer

Enable forwarded traffic on both peerings and disable gateway transit.

Answer

Create a second VPN gateway in the spoke and peer the two gateways.

Answer

Configure the spoke subnet with a service endpoint to the hub gateway subnet.