AZ-104 Implement and Manage Storage Practice Test 14 — 15 Questions

Question 1

A team wants a storage option that stays available if one availability zone in the primary region fails. Which two redundancy options meet that requirement? Select two.

Accepted Answer

Zone-redundant storage (ZRS).. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region. If one zone fails, the data remains accessible from the other zones, ensuring high availability without requiring failover to a secondary region.

Answer

Locally redundant storage (LRS).

Answer

Geo-redundant storage (GRS).

Answer

Read-access geo-redundant storage (RA-GRS).

Question 2

An analyst needs a blob that is currently in the Archive tier to be downloadable within the next hour. Which two actions should the administrator take? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. To make a blob in the Archive tier accessible for download, you must first change its access tier to Hot or Cool. This initiates a rehydration process that moves the blob data from offline storage to an online tier, making it available for read operations. The rehydration can take up to 15 hours, but selecting High priority rehydration (Option B) can reduce this to under 1 hour, meeting the analyst's requirement.

Answer

Download the blob directly from the Archive tier without changing its tier.

Answer

Delete the blob and restore it from a soft delete snapshot.

Answer

Add a lifecycle rule to move the blob to Archive again after it is downloaded.

Question 3

A team wants one Azure Files share to be used by both Windows and Linux virtual machines. Which two mounting approaches are valid? Select two.

Accepted Answer

Map the share on Windows by using the built-in SMB client.. Windows includes a built-in SMB client that can directly map an Azure Files share using its UNC path (e.g., \storageaccount.file.core.windows.net\sharename). This leverages the SMB 3.0 protocol, which Azure Files supports over the public internet with encryption, requiring no additional gateway or VPN.

Answer

Mount the share on Linux by using the Azure Blob service endpoint.

Answer

Use an Azure VPN gateway to make the file share mount possible.

Answer

Use an Azure load balancer to present the share to both VMs.

Question 4

A Windows VM and a Linux VM in Azure must use the same shared working folder for application files. The team does not want to run a separate file server, and both VMs must be able to mount the share by using native operating system tools. What should the administrator deploy?

Accepted Answer

An Azure Files share mounted from Windows by using SMB and from Linux by using SMB or the Azure Files mount command. Azure Files provides fully managed SMB (Server Message Block) file shares that can be mounted natively from both Windows (using SMB) and Linux (using SMB or the dedicated Azure Files mount command). This meets the requirement of a shared working folder without needing a separate file server, and both operating systems can use their native tools to access the share.

Answer

An Azure Blob container mounted as a local NTFS volume on both VMs

Answer

A managed disk attached to both VMs in read-write mode

Answer

An Azure Queue storage account with application-level file synchronization

Question 5

An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet.. Enabling the Microsoft.Storage service endpoint on the subnet (A) ensures that traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network and uses the source IP of the subnet's virtual network, allowing the storage account firewall to identify the traffic. Adding the subnet to the storage account's virtual network rules (B) then explicitly permits only that subnet's traffic, denying all other public endpoint access. Together, these two configurations restrict access to the storage account's public endpoint exclusively to the specified subnet without requiring a private endpoint.

Answer

Create a private endpoint for the storage account.

Answer

Assign the Reader role to the subnet.

Answer

Turn on blob soft delete.

Question 6

A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Accepted Answer

Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.. Assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Microsoft Entra ID, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.

Answer

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

Answer

Share the storage account access key with the service account and rotate it monthly.

Answer

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

Question 7

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Microsoft Entra ID, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 8

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. Option A (Storage account key) is correct because Azure Files SMB shares can always be mounted using the storage account name and its access key as the credential, regardless of whether the client is Windows or Linux and independent of any domain membership. Option B (Active Directory Domain Services credentials) is correct because both VMs are joined to the same AD DS domain, and Azure Files supports identity-based SMB authentication via AD DS (on-premises AD DS or Entra Domain Services) so domain users can mount the share with their Kerberos credentials. Option C (Blob SAS token) does not apply because SAS tokens are used for Azure Blob Storage REST access, not for SMB mounts of Azure Files. Option D (Network security group rule) is a network access control, not an authentication method. Option E (Azure resource lock) is a management-plane governance feature and has nothing to do with authenticating an SMB mount.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 9

A team enabled Azure Files for a Windows-based application. The app can reach the storage account, but the mount fails because users cannot authenticate with the share. The team does not want to use the storage account key. What is the best next step?

Accepted Answer

Grant the VM or user an Azure Files data-plane role, such as Storage File Data SMB Share Contributor, and use identity-based authentication.. Azure Files supports identity-based authentication over SMB using either on-premises Active Directory Domain Services (AD DS) or Microsoft Entra Domain Services (Microsoft Entra Domain Services). By granting the VM or user the Storage File Data SMB Share Contributor role, the team enables Kerberos-based authentication, eliminating the need for the storage account key. This approach allows the mount to succeed while meeting the requirement to avoid using the shared key.

Answer

Turn off the storage account firewall and retry the mount anonymously.

Answer

Create a network security group rule that allows TCP 445 to the share.

Answer

Convert the storage account to a premium block blob account.

Question 10

A development team needs one storage account to host blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the account are correct? Select two.

Accepted Answer

It should be a General-purpose v2 storage account.. A General-purpose v2 (GPv2) storage account is required because it supports the latest storage features, including blob lifecycle management rules, blob containers, and Azure Files shares. GPv2 accounts provide the necessary REST API endpoints and management capabilities for lifecycle policies, which are not available in older account types like BlobStorage or General-purpose v1.

Answer

It must be a BlobStorage account.

Answer

It must use only zone-redundant storage to use lifecycle rules.

Answer

It cannot use lifecycle management for blobs.

Question 11

A lifecycle rule moved old audit logs to the Archive tier. A support engineer now needs to read one archived blob, and the download request fails with a message that the blob is archived. The engineer can wait several hours for the data to become available. What should the administrator do?

Accepted Answer

Change the blob tier from Archive to Hot or Cool to start rehydration.. Archived blobs in Azure Storage are offline and cannot be read directly. To access the data, the blob must first be rehydrated by changing its tier to Hot or Cool, which initiates an asynchronous copy of the blob data to an online tier. This process can take up to 15 hours, matching the engineer's ability to wait several hours.

Answer

Enable versioning on the storage account so the archived blob can be read immediately.

Answer

Move the blob to a different container in the same storage account.

Answer

Switch the storage account replication from LRS to ZRS.

Question 12

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 13

Quarterly invoices were moved to the Archive tier by a lifecycle rule. An auditor now needs one specific blob available for download within the next hour. What should the administrator do?

Accepted Answer

Start a high-priority rehydration of the blob to the Hot tier, then wait for completion before downloading.. Blobs in the Archive tier are offline and must be rehydrated to an online tier (Hot or Cool) before they can be accessed. A high-priority rehydration completes within one hour, meeting the auditor's deadline. Changing a lifecycle rule (A) or directly setting the tier (B) does not initiate the necessary rehydration process, and copying an archived blob (D) fails because the blob is offline.

Answer

Change the lifecycle rule so the blob will automatically move back to Hot on the next run.

Answer

Set the blob directly to the Hot tier and download it immediately.

Answer

Copy the archived blob to another container by using the portal copy command.

Question 14

An Azure Automation job running on a VM uses a managed identity to upload and overwrite JSON files in one container named configs. The job must not list, delete, or modify any other containers in the storage account. Which role assignment is the best choice?

Accepted Answer

Storage Blob Data Contributor at the configs container scope. The Storage Blob Data Contributor role at the container scope grants the managed identity the necessary permissions to upload and overwrite blobs (including JSON files) within the 'configs' container, while explicitly preventing listing, deleting, or modifying other containers in the storage account. This role includes the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write' action, which allows overwriting existing blobs, but does not include any actions on the container itself (like listing or deleting containers) or on other containers. Scoping the role to the specific container ensures the principle of least privilege is strictly followed.

Answer

Storage Blob Data Owner at the storage account scope

Answer

Contributor at the resource group scope

Answer

Storage Queue Data Contributor at the storage account scope

Question 15

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. Option A is correct because enabling a system-assigned managed identity on the Azure VM creates a service principal in Microsoft Entra ID that the VM can use to obtain OAuth 2.0 tokens from the Instance Metadata Service (IMDS) without any stored credentials. Option B is correct because the identity must be granted a data-plane role such as Storage Blob Data Contributor on the storage account or container scope, which authorizes uploading blobs via Azure RBAC. Together, these actions let the VM authenticate to Blob Storage hourly without persisting the storage account key or a long-lived SAS token, satisfying the security policy. Option C is wrong because copying the access key into a VM configuration file is exactly the long-lived secret storage the policy forbids. Option D is wrong because the Reader role only permits control-plane read operations and does not grant blob data upload permissions. Option E is wrong because a non-expiring SAS token is a long-lived credential, which the policy explicitly prohibits storing on the VM.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.