AZ-104 Implement and Manage Storage Practice Test 14 — 15 Questions

Question 1

A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.. Assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Azure AD, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.

Answer

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

Answer

Share the storage account access key with the service account and rotate it monthly.

Answer

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

Question 2

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 3

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. The storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 4

A team enabled Azure Files for a Windows-based application. The app can reach the storage account, but the mount fails because users cannot authenticate with the share. The team does not want to use the storage account key. What is the best next step?

Accepted Answer

Grant the VM or user an Azure Files data-plane role, such as Storage File Data SMB Share Contributor, and use identity-based authentication.. Azure Files supports identity-based authentication over SMB using either on-premises Active Directory Domain Services (AD DS) or Azure Active Directory Domain Services (Azure AD DS). By granting the VM or user the Storage File Data SMB Share Contributor role, the team enables Kerberos-based authentication, eliminating the need for the storage account key. This approach allows the mount to succeed while meeting the requirement to avoid using the shared key.

Answer

Turn off the storage account firewall and retry the mount anonymously.

Answer

Create a network security group rule that allows TCP 445 to the share.

Answer

Convert the storage account to a premium block blob account.

Question 5

A development team needs one storage account to host blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the account are correct? Select two.

Accepted Answer

It should be a General-purpose v2 storage account.. A General-purpose v2 (GPv2) storage account is required because it supports the latest storage features, including blob lifecycle management rules, blob containers, and Azure Files shares. GPv2 accounts provide the necessary REST API endpoints and management capabilities for lifecycle policies, which are not available in older account types like BlobStorage or General-purpose v1.

Answer

It must be a BlobStorage account.

Answer

It must use only zone-redundant storage to use lifecycle rules.

Answer

It cannot use lifecycle management for blobs.

Question 6

A lifecycle rule moved old audit logs to the Archive tier. A support engineer now needs to read one archived blob, and the download request fails with a message that the blob is archived. The engineer can wait several hours for the data to become available. What should the administrator do?

Accepted Answer

Change the blob tier from Archive to Hot or Cool to start rehydration.. Archived blobs in Azure Storage are offline and cannot be read directly. To access the data, the blob must first be rehydrated by changing its tier to Hot or Cool, which initiates an asynchronous copy of the blob data to an online tier. This process can take up to 15 hours, matching the engineer's ability to wait several hours.

Answer

Enable versioning on the storage account so the archived blob can be read immediately.

Answer

Move the blob to a different container in the same storage account.

Answer

Switch the storage account replication from LRS to ZRS.

Question 7

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 8

Quarterly invoices were moved to the Archive tier by a lifecycle rule. An auditor now needs one specific blob available for download within the next hour. What should the administrator do?

Accepted Answer

Start a high-priority rehydration of the blob to the Hot tier, then wait for completion before downloading.. Blobs in the Archive tier are offline and must be rehydrated to an online tier (Hot or Cool) before they can be accessed. A high-priority rehydration completes within one hour, meeting the auditor's deadline. Changing a lifecycle rule (A) or directly setting the tier (B) does not initiate the necessary rehydration process, and copying an archived blob (D) fails because the blob is offline.

Answer

Change the lifecycle rule so the blob will automatically move back to Hot on the next run.

Answer

Set the blob directly to the Hot tier and download it immediately.

Answer

Copy the archived blob to another container by using the portal copy command.

Question 9

An Azure Automation job running on a VM uses a managed identity to upload and overwrite JSON files in one container named configs. The job must not list, delete, or modify any other containers in the storage account. Which role assignment is the best choice?

Accepted Answer

Storage Blob Data Contributor at the configs container scope. The Storage Blob Data Contributor role at the container scope grants the managed identity the necessary permissions to upload and overwrite blobs (including JSON files) within the 'configs' container, while explicitly preventing listing, deleting, or modifying other containers in the storage account. This role includes the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write' action, which allows overwriting existing blobs, but does not include any actions on the container itself (like listing or deleting containers) or on other containers. Scoping the role to the specific container ensures the principle of least privilege is strictly followed.

Answer

Storage Blob Data Owner at the storage account scope

Answer

Contributor at the resource group scope

Answer

Storage Queue Data Contributor at the storage account scope

Question 10

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows it to authenticate to Azure AD without storing any credentials. By assigning the Storage Blob Data Contributor role to that identity on the storage account or container, the VM can upload logs using Azure AD authentication, which satisfies the security policy forbidding storage account keys or long-lived SAS tokens.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.

Question 11

A contractor needs to upload files to one blob container for the next two hours. The contractor must not learn the storage account key, and access should expire automatically without manual cleanup. What is the best way to grant access?

Accepted Answer

Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.. A user delegation SAS is the correct choice because it is secured with Entra ID credentials rather than the storage account key, ensuring the contractor never learns the key. The SAS can be scoped to exactly the required container permissions and a two-hour expiry, providing automatic, time-limited access without manual cleanup. This approach aligns with the principle of least privilege and eliminates the need to share or rotate storage account keys.

Answer

Share the storage account key and ask the contractor to stop using it after two hours.

Answer

Create an account SAS with broad permissions and send it to the contractor by email.

Answer

Assign the contractor the Storage Blob Data Contributor role at the storage account scope.

Question 12

A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule allowing that subnet.. A service endpoint on the subnet extends the virtual network identity to the storage account, allowing the storage firewall to restrict access to traffic originating from that specific subnet. This ensures the storage account remains reachable via its public endpoint, but only from the configured subnet, without requiring a private endpoint or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A public IP address for the subnet and a storage account firewall exception.

Answer

An NSG rule that permits outbound TCP 443 to the storage account.

Question 13

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 14

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 15

Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.

Accepted Answer

SAS: Provides time-limited delegated access with specified permissions.. SAS provides delegated access; Azure AD authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Azure AD DS extends on-prem AD; Service SAS can include IP restrictions.

Answer

SAS: Uses Azure AD identities to authenticate.

Answer

Azure AD authentication: Provides anonymous read access.