AZ-104 Implement and Manage Storage Practice Test 14 — 15 Questions

Question 1

A team enabled Azure Files for a Windows-based application. The app can reach the storage account, but the mount fails because users cannot authenticate with the share. The team does not want to use the storage account key. What is the best next step?

Accepted Answer

Grant the VM or user an Azure Files data-plane role, such as Storage File Data SMB Share Contributor, and use identity-based authentication.. Option B is correct because Azure Files supports identity-based authentication over SMB using either on-premises Active Directory Domain Services (AD DS) or Azure Active Directory Domain Services (Azure AD DS). By granting the VM or user the Storage File Data SMB Share Contributor role, the team enables Kerberos-based authentication, eliminating the need for the storage account key. This approach allows the mount to succeed while meeting the requirement to avoid using the shared key.

Answer

Turn off the storage account firewall and retry the mount anonymously.

Answer

Create a network security group rule that allows TCP 445 to the share.

Answer

Convert the storage account to a premium block blob account.

Question 2

A development team needs one storage account to host blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the account are correct? Select two.

Accepted Answer

It should be a General-purpose v2 storage account.. A General-purpose v2 (GPv2) storage account is required because it supports the latest storage features, including blob lifecycle management rules, blob containers, and Azure Files shares. GPv2 accounts provide the necessary REST API endpoints and management capabilities for lifecycle policies, which are not available in older account types like BlobStorage or General-purpose v1.

Answer

It must be a BlobStorage account.

Answer

It must use only zone-redundant storage to use lifecycle rules.

Answer

It cannot use lifecycle management for blobs.

Question 3

A lifecycle rule moved old audit logs to the Archive tier. A support engineer now needs to read one archived blob, and the download request fails with a message that the blob is archived. The engineer can wait several hours for the data to become available. What should the administrator do?

Accepted Answer

Change the blob tier from Archive to Hot or Cool to start rehydration.. Option B is correct because archived blobs in Azure Storage are offline and cannot be read directly. To access the data, the blob must first be rehydrated by changing its tier to Hot or Cool, which initiates an asynchronous copy of the blob data to an online tier. This process can take up to 15 hours, matching the engineer's ability to wait several hours.

Answer

Enable versioning on the storage account so the archived blob can be read immediately.

Answer

Move the blob to a different container in the same storage account.

Answer

Switch the storage account replication from LRS to ZRS.

Question 4

A company wants a storage account that keeps a readable copy in the secondary region and lets read operations continue if the primary region becomes unavailable. Which two redundancy options meet this requirement? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS). Read-access geo-redundant storage (RA-GRS) is correct because it provides geo-redundant replication (GRS) with the added ability to read from the secondary region at all times, even when the primary region is available. If the primary region becomes unavailable, read operations can continue using the readable copy in the secondary region, meeting the requirement for continuous read access.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 5

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Option B is correct because blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 6

Quarterly invoices were moved to the Archive tier by a lifecycle rule. An auditor now needs one specific blob available for download within the next hour. What should the administrator do?

Accepted Answer

Start a high-priority rehydration of the blob to the Hot tier, then wait for completion before downloading.. Option C is correct because blobs in the Archive tier are offline and must be rehydrated to an online tier (Hot or Cool) before they can be accessed. A high-priority rehydration completes within one hour, meeting the auditor's deadline. Changing a lifecycle rule (A) or directly setting the tier (B) does not initiate the necessary rehydration process, and copying an archived blob (D) fails because the blob is offline.

Answer

Change the lifecycle rule so the blob will automatically move back to Hot on the next run.

Answer

Set the blob directly to the Hot tier and download it immediately.

Answer

Copy the archived blob to another container by using the portal copy command.

Question 7

An Azure Automation job running on a VM uses a managed identity to upload and overwrite JSON files in one container named configs. The job must not list, delete, or modify any other containers in the storage account. Which role assignment is the best choice?

Accepted Answer

Storage Blob Data Contributor at the configs container scope. The Storage Blob Data Contributor role at the container scope grants the managed identity the necessary permissions to upload and overwrite blobs (including JSON files) within the 'configs' container, while explicitly preventing listing, deleting, or modifying other containers in the storage account. This role includes the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write' action, which allows overwriting existing blobs, but does not include any actions on the container itself (like listing or deleting containers) or on other containers. Scoping the role to the specific container ensures the principle of least privilege is strictly followed.

Answer

Storage Blob Data Owner at the storage account scope

Answer

Contributor at the resource group scope

Answer

Storage Queue Data Contributor at the storage account scope

Question 8

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows it to authenticate to Azure AD without storing any credentials. By assigning the Storage Blob Data Contributor role to that identity on the storage account or container, the VM can upload logs using Azure AD authentication, which satisfies the security policy forbidding storage account keys or long-lived SAS tokens.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.

Question 9

A contractor needs to upload files to one blob container for the next two hours. The contractor must not learn the storage account key, and access should expire automatically without manual cleanup. What is the best way to grant access?

Accepted Answer

Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.. A user delegation SAS is the correct choice because it is secured with Entra ID credentials rather than the storage account key, ensuring the contractor never learns the key. The SAS can be scoped to exactly the required container permissions and a two-hour expiry, providing automatic, time-limited access without manual cleanup. This approach aligns with the principle of least privilege and eliminates the need to share or rotate storage account keys.

Answer

Share the storage account key and ask the contractor to stop using it after two hours.

Answer

Create an account SAS with broad permissions and send it to the contractor by email.

Answer

Assign the contractor the Storage Blob Data Contributor role at the storage account scope.

Question 10

A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule allowing that subnet.. Option C is correct because a service endpoint on the subnet extends the virtual network identity to the storage account, allowing the storage firewall to restrict access to traffic originating from that specific subnet. This ensures the storage account remains reachable via its public endpoint, but only from the configured subnet, without requiring a private endpoint or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A public IP address for the subnet and a storage account firewall exception.

Answer

An NSG rule that permits outbound TCP 443 to the storage account.

Question 11

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 12

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Option B is correct because enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 13

Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.

Question 14

A reporting team wants a storage redundancy option that keeps a readable copy in the paired region. Which two choices provide read access to the secondary region? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS).. Read-access geo-redundant storage (RA-GRS) is correct because it provides geo-redundant storage (GRS) with the additional capability to read from the secondary region. This ensures that if the primary region becomes unavailable, the reporting team can still access a readable copy of the data in the paired region. RA-GRS replicates data asynchronously to a secondary region and allows read access to that secondary copy at all times.

Answer

Locally redundant storage (LRS).

Answer

Zone-redundant storage (ZRS).

Answer

Geo-redundant storage (GRS).

Question 15

A business stores audit logs in Azure Blob Storage. The account must remain available if an entire availability zone in the primary region fails, and analysts must still be able to read the data from the paired region if the primary region becomes unavailable. Which replication option should the administrator select?

Accepted Answer

Read-access geo-zone-redundant storage (RA-GZRS). C is correct because Read-access geo-zone-redundant storage (RA-GZRS) combines zone-redundancy within the primary region (surviving an entire zone failure) with geo-replication to a paired region, and crucially provides read access to the secondary region data even if the primary region is unavailable. This meets both requirements: availability during a zone failure and readable data from the paired region during a primary region outage.

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)