AZ-104 Implement and Manage Storage Practice Test 13 — 15 Questions

Question 1

Match each data-access pattern to the blob tier or required action.

Accepted Answer

Frequent read and write operations: Hot tier. Azure Blob Storage tiers are Hot (frequent access), Cool (infrequent, 30-day minimum), and Archive (rare, 180-day minimum). Rehydration is needed to access Archive blobs. Azure Files sync is used for replication.

Answer

Frequent read and write operations: Cool tier

Answer

Infrequent access with 30-day minimum storage duration: Archive tier

Question 2

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 3

A development team needs a single Azure Storage account for blob containers, Azure Files shares, and blob lifecycle rules. The account must support standard performance and allow future use of access tiers. Which account kind should you create?

Accepted Answer

StorageV2 because it supports blobs, Azure Files, lifecycle management, and access tiers.. StorageV2 (general-purpose v2) is the only account kind that supports blobs, Azure Files shares, lifecycle management policies, and all access tiers (hot, cool, archive) with standard performance. BlobStorage lacks Azure Files support, FileStorage is premium-only and does not support lifecycle rules, and BlockBlobStorage is premium-only and does not support Azure Files or lifecycle management.

Answer

BlobStorage because it is optimized for blobs and supports lifecycle management.

Answer

FileStorage because it is designed for file shares and can also host blob lifecycle rules.

Answer

BlockBlobStorage because it provides the best performance for lifecycle policies and file shares.

Question 4

Match each file-sharing requirement to the best Azure Files mounting or integration approach.

Accepted Answer

SMB: Requires storage account credentials and port 445 for mounting. SMB mounting requires storage account credentials; NFS needs private endpoint; REST API for programmatic access; Microsoft Entra Domain Services enables identity-based access; File Sync caches on-premises.

Answer

Azure AD DS: Used for programmatic access to Azure file shares

Answer

File Sync: Enables identity-based access to Azure file shares

Question 5

A business-critical storage account must survive a zone outage in the primary region and also keep a read-only copy in the paired region for reporting if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS because it provides zone redundancy and read access to the secondary region.. (RA-GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region, ensuring data survives a zone outage, with read-access geo-redundant storage (RA-GRS) to the paired region, providing a readable secondary copy for reporting if the primary region becomes unavailable. This meets both requirements: zone-level fault tolerance and read-only access to the secondary region during a primary outage.

Answer

ZRS because it protects against a single datacenter failure.

Answer

GZRS because it provides a readable secondary region by default.

Answer

RA-GRS because it provides zone redundancy and read access to the secondary region.

Question 6

A platform team created a BlobStorage account for application logs. Later they discovered the same account must also host an Azure Files share for a Linux automation server, and lifecycle rules must continue to manage blob tiers. Standard performance is sufficient. What should they do?

Accepted Answer

Recreate the storage as a StorageV2 general-purpose v2 account. A BlobStorage account is a specialized storage account that supports only block blobs and append blobs, not Azure Files shares. To host both blobs and Azure Files, you need a general-purpose v2 (StorageV2) account, which supports all Azure Storage services including blobs, files, queues, and tables, while also allowing lifecycle management policies for blob tiering. Recreating the account as StorageV2 meets both requirements without sacrificing blob lifecycle rules.

Answer

Keep the BlobStorage account and add a private endpoint

Answer

Convert the account to Premium Block Blob storage

Answer

Create a separate file server VM and keep the BlobStorage account unchanged

Question 7

A Windows VM mounts an Azure Files share by using SMB and identity-based authentication. Which two permission layers can affect access to folders in the share? Select two.

Accepted Answer

Azure RBAC permissions on the file share. Azure RBAC permissions on the file share (Option A) control whether a user or service principal can mount the share or perform management operations, such as listing or modifying share properties. When identity-based authentication is used (Kerberos or Microsoft Entra ID Kerberos), RBAC roles like 'Storage File Data SMB Share Reader' or 'Contributor' are required to grant access at the share level before any file-level permissions apply.

Answer

Network security group rules on the storage account

Answer

Blob access tier settings

Answer

Route table next-hop selection

Question 8

A hub VNet contains a VPN gateway that provides access to on-premises resources. A spoke VNet is peered to the hub and must send on-premises traffic through the hub gateway without deploying its own gateway. What peering configuration is required?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. To route spoke VNet traffic through the hub VPN gateway without deploying a separate gateway in the spoke, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to use the hub's VPN gateway for on-premises connectivity, leveraging the transitive routing capability of VNet peering.

Answer

Enable forwarded traffic on both peerings and disable gateway transit.

Answer

Create a second VPN gateway in the spoke and peer the two gateways.

Answer

Configure the spoke subnet with a service endpoint to the hub gateway subnet.

Question 9

Based on the exhibit, the security team wants AppSubnet to access an Azure Storage account through the public endpoint, but only that subnet should be allowed. They do not want a private IP or DNS changes. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to reach the storage account over the Azure backbone network using the public endpoint, without requiring a private IP or DNS changes. Adding AppSubnet as a network rule on the storage account restricts access exclusively to that subnet, fulfilling the security team's requirement.

Answer

Create a private endpoint for the storage account and disable public access.

Answer

Attach a route table that sends storage traffic to the internet.

Answer

Grant the subnet a Reader role assignment on the storage account.

Question 10

A support engineer finds a blob that was moved to the Archive tier by a lifecycle rule and must download it today. Which two actions are required before the blob can be read? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. A blob in the Archive tier is offline and cannot be read directly. You must change its access tier to Hot or Cool (a process called rehydration) to make it available for download. This tier change initiates an asynchronous operation that moves the blob from the archived state to an online tier.

Answer

Download the blob directly from Archive without any tier change.

Answer

Disable the lifecycle management policy for the storage account.

Answer

Create a new container and copy the archived blob into it.

Question 11

A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Microsoft Entra ID authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Microsoft Entra ID tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.

Answer

Store the storage account access key in an environment variable on the VM.

Answer

Generate a service SAS and copy it into the application configuration.

Answer

Assign the Contributor role on the resource group to the managed identity.

Question 12

Match each access scenario to the SAS or key type that best fits it.

Accepted Answer

Interactive logins: User delegation SAS. Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.

Answer

Interactive logins: Storage account access keys

Answer

Automated backups: User delegation SAS

Answer

Cross-tenant access: System-assigned managed identity

Question 13

An administrator is deploying a new storage account for an application. The account must support blob containers, an Azure Files share, lifecycle rules for blobs, and standard access tiers. The application does not need premium performance for a single data service. Which storage account kind should be chosen?

Accepted Answer

General-purpose v2, because it supports blobs, files, access tiers, and lifecycle management.. General-purpose v2 (GPv2) storage accounts are the correct choice because they support all storage object types (blobs, files, queues, tables), standard access tiers (hot, cool, archive), and lifecycle management policies for blobs. This meets all the stated requirements without needing premium performance for a single data service.

Answer

BlobStorage, because it is optimized only for block blob workloads.

Answer

General-purpose v1, because it can host any storage object type.

Answer

BlockBlobStorage, because it is the best choice for any application that stores files.

Question 14

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet must send on-premises traffic through the hub gateway without deploying its own gateway. Which peering settings are needed?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. It enables gateway transit on the hub-side peering connection and uses remote gateways on the spoke-side peering connection. This configuration allows the spoke VNet to route on-premises traffic through the hub's VPN gateway without deploying its own gateway, leveraging the hub as a transit point.

Answer

Enable forwarded traffic on both peerings and add a route table to the spoke subnet.

Answer

Create a private endpoint in the spoke VNet and route on-premises traffic through it.

Answer

Deploy a second VPN gateway in the spoke and connect it in active-active mode.

Question 15

A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?

Accepted Answer

A ReadOnly lock was applied to the storage account.. A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.

Answer

A CanNotDelete lock was applied to the storage account.

Answer

An Azure Policy audit assignment was applied to the storage account.

Answer

The account was moved to a different subscription.