AZ-104 Implement and Manage Storage Practice Test 13 — 15 Questions

Question 1

Based on the exhibit, the security team wants AppSubnet to access an Azure Storage account through the public endpoint, but only that subnet should be allowed. They do not want a private IP or DNS changes. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.. Option A is correct because enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to reach the storage account over the Azure backbone network using the public endpoint, without requiring a private IP or DNS changes. Adding AppSubnet as a network rule on the storage account restricts access exclusively to that subnet, fulfilling the security team's requirement.

Answer

Create a private endpoint for the storage account and disable public access.

Answer

Attach a route table that sends storage traffic to the internet.

Answer

Grant the subnet a Reader role assignment on the storage account.

Question 2

A support engineer finds a blob that was moved to the Archive tier by a lifecycle rule and must download it today. Which two actions are required before the blob can be read? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. Option A is correct because a blob in the Archive tier is offline and cannot be read directly. You must change its access tier to Hot or Cool (a process called rehydration) to make it available for download. This tier change initiates an asynchronous operation that moves the blob from the archived state to an online tier.

Answer

Download the blob directly from Archive without any tier change.

Answer

Disable the lifecycle management policy for the storage account.

Answer

Create a new container and copy the archived blob into it.

Question 3

A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure AD authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Azure AD tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.

Answer

Store the storage account access key in an environment variable on the VM.

Answer

Generate a service SAS and copy it into the application configuration.

Answer

Assign the Contributor role on the resource group to the managed identity.

Question 4

Match each access scenario to the SAS or key type that best fits it.

Question 5

An administrator is deploying a new storage account for an application. The account must support blob containers, an Azure Files share, lifecycle rules for blobs, and standard access tiers. The application does not need premium performance for a single data service. Which storage account kind should be chosen?

Accepted Answer

General-purpose v2, because it supports blobs, files, access tiers, and lifecycle management.. General-purpose v2 (GPv2) storage accounts are the correct choice because they support all storage object types (blobs, files, queues, tables), standard access tiers (hot, cool, archive), and lifecycle management policies for blobs. This meets all the stated requirements without needing premium performance for a single data service.

Answer

BlobStorage, because it is optimized only for block blob workloads.

Answer

General-purpose v1, because it can host any storage object type.

Answer

BlockBlobStorage, because it is the best choice for any application that stores files.

Question 6

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet must send on-premises traffic through the hub gateway without deploying its own gateway. Which peering settings are needed?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. Option B is correct because it enables gateway transit on the hub-side peering connection and uses remote gateways on the spoke-side peering connection. This configuration allows the spoke VNet to route on-premises traffic through the hub's VPN gateway without deploying its own gateway, leveraging the hub as a transit point.

Answer

Enable forwarded traffic on both peerings and add a route table to the spoke subnet.

Answer

Create a private endpoint in the spoke VNet and route on-premises traffic through it.

Answer

Deploy a second VPN gateway in the spoke and connect it in active-active mode.

Question 7

A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?

Accepted Answer

A ReadOnly lock was applied to the storage account.. A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.

Answer

A CanNotDelete lock was applied to the storage account.

Answer

An Azure Policy audit assignment was applied to the storage account.

Answer

The account was moved to a different subscription.

Question 8

A team wants a storage option that stays available if one availability zone in the primary region fails. Which two redundancy options meet that requirement? Select two.

Accepted Answer

Zone-redundant storage (ZRS).. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region. If one zone fails, the data remains accessible from the other zones, ensuring high availability without requiring failover to a secondary region.

Answer

Locally redundant storage (LRS).

Answer

Geo-redundant storage (GRS).

Answer

Read-access geo-redundant storage (RA-GRS).

Question 9

An analyst needs a blob that is currently in the Archive tier to be downloadable within the next hour. Which two actions should the administrator take? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. Option A is correct because to make a blob in the Archive tier accessible for download, you must first change its access tier to Hot or Cool. This initiates a rehydration process that moves the blob data from offline storage to an online tier, making it available for read operations. The rehydration can take up to 15 hours, but selecting High priority rehydration (Option B) can reduce this to under 1 hour, meeting the analyst's requirement.

Answer

Download the blob directly from the Archive tier without changing its tier.

Answer

Delete the blob and restore it from a soft delete snapshot.

Answer

Add a lifecycle rule to move the blob to Archive again after it is downloaded.

Question 10

A team wants one Azure Files share to be used by both Windows and Linux virtual machines. Which two mounting approaches are valid? Select two.

Accepted Answer

Map the share on Windows by using the built-in SMB client.. Option A is correct because Windows includes a built-in SMB client that can directly map an Azure Files share using its UNC path (e.g., \storageaccount.file.core.windows.net\sharename). This leverages the SMB 3.0 protocol, which Azure Files supports over the public internet with encryption, requiring no additional gateway or VPN.

Answer

Mount the share on Linux by using the Azure Blob service endpoint.

Answer

Use an Azure VPN gateway to make the file share mount possible.

Answer

Use an Azure load balancer to present the share to both VMs.

Question 11

A Windows VM and a Linux VM in Azure must use the same shared working folder for application files. The team does not want to run a separate file server, and both VMs must be able to mount the share by using native operating system tools. What should the administrator deploy?

Accepted Answer

An Azure Files share mounted from Windows by using SMB and from Linux by using SMB or the Azure Files mount command. Option B is correct because Azure Files provides fully managed SMB (Server Message Block) file shares that can be mounted natively from both Windows (using SMB) and Linux (using SMB or the dedicated Azure Files mount command). This meets the requirement of a shared working folder without needing a separate file server, and both operating systems can use their native tools to access the share.

Answer

An Azure Blob container mounted as a local NTFS volume on both VMs

Answer

A managed disk attached to both VMs in read-write mode

Answer

An Azure Queue storage account with application-level file synchronization

Question 12

An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet.. Enabling the Microsoft.Storage service endpoint on the subnet (A) ensures that traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network and uses the source IP of the subnet's virtual network, allowing the storage account firewall to identify the traffic. Adding the subnet to the storage account's virtual network rules (B) then explicitly permits only that subnet's traffic, denying all other public endpoint access. Together, these two configurations restrict access to the storage account's public endpoint exclusively to the specified subnet without requiring a private endpoint.

Answer

Create a private endpoint for the storage account.

Answer

Assign the Reader role to the subnet.

Answer

Turn on blob soft delete.

Question 13

A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Accepted Answer

Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.. Option B is correct because assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Azure AD, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.

Answer

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

Answer

Share the storage account access key with the service account and rotate it monthly.

Answer

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

Question 14

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Option A is correct because assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 15

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. Option A is correct because the storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

AZ-104 Implement and Manage Storage Practice Test 13 — 15 Questions

Exhibit

AZ-104 Implement and Manage Storage Practice Test 13 — 15 Questions

Exhibit