AZ-104 Implement and Manage Storage Practice Test 15 — 15 Questions

Question 1

A lifecycle rule moved quarterly audit logs to the Archive tier. An auditor now needs one blob for an urgent investigation and wants it available for download as soon as the rehydration completes. What should the administrator do?

Accepted Answer

Change the blob access tier to Hot and wait for rehydration to finish before downloading it.. Option B is correct because changing the access tier of a blob from Archive to Hot initiates an asynchronous rehydration process that moves the blob data back to an online tier. Once rehydration completes, the blob becomes available for download. This is the standard method to make archived blobs accessible for immediate use.

Answer

Copy the blob directly from Archive tier to the client's local disk.

Answer

Assign the blob a shorter retention policy so it becomes accessible automatically.

Answer

Move the blob to the Cool tier and attempt the download immediately.

Question 2

A business-critical storage account must keep data available if one availability zone fails in the primary region. It must also keep a readable copy in the paired region so administrators can verify data during disaster recovery testing before failover. Which redundancy option should be selected?

Accepted Answer

RA-GZRS, because it provides zone redundancy in the primary region and read access to the secondary region.. D is correct because RA-GZRS (Read-Access Geo-Zone-Redundant Storage) provides synchronous replication across three Azure availability zones within the primary region, ensuring data remains available if one zone fails. It also asynchronously replicates data to the paired region, where a read-only copy is available for verification during disaster recovery testing without requiring a failover.

Answer

LRS, because it stores three copies in one datacenter and is the lowest-cost option.

Answer

ZRS, because it replicates data across zones in the same region but not to another region.

Answer

GRS, because it replicates to the paired region and supports a secondary copy for recovery.

Question 3

A company wants a single storage account for blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the required account are true? Select two.

Accepted Answer

It should be a general-purpose v2 storage account.. A general-purpose v2 (GPv2) storage account is required because it is the only account type that supports all Azure Storage data services—including blob containers and Azure Files—and also provides full support for blob lifecycle management policies. GPv2 accounts offer the lowest per-gigabyte storage prices for blobs and enable you to define rules to automatically tier or delete blobs based on age or other conditions.

Answer

It must be a premium block blob account.

Answer

It cannot use lifecycle management on blobs.

Answer

It can store only one type of Azure Storage data service at a time.

Question 4

An application on a VM in subnet AppSubnet must access a storage account over the public endpoint. The security team wants to allow traffic only from AppSubnet and does not want to deploy a private endpoint. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.. Option B is correct because enabling a Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, while still using the public endpoint. Then, configuring the storage account firewall to allow that virtual network restricts access exclusively to AppSubnet, meeting the security requirement without deploying a private endpoint.

Answer

Disable the storage account firewall and rely on the VM's source IP address.

Answer

Create a private endpoint and leave the firewall set to allow all networks.

Answer

Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.

Question 5

A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.. Option B is correct because a service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.

Answer

Create a private endpoint and disable public network access.

Answer

Generate a user delegation SAS token and distribute it only to the subnet.

Answer

Change the redundancy setting to ZRS and enable soft delete.

Question 6

Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

Accepted Answer

The Allow trusted Microsoft services to bypass this firewall setting. Option B is correct because the 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.

Answer

A service endpoint on the destination storage account subnet

Answer

A shared access signature with read permission

Answer

A private DNS zone linked to the workspace virtual network

Question 7

A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?

Accepted Answer

Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.. Option A is correct because Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.

Answer

Use a private endpoint and rely on network isolation instead of authentication.

Answer

Use the storage account access key because SMB requires shared-key authentication.

Answer

Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.

Question 8

A team needs one Azure Files share that can be mounted by both Windows and Linux VMs. The VMs are joined to the same on-premises Active Directory Domain Services domain, and the security team forbids storage account keys. The team also wants to manage access with existing AD group memberships. What should the administrator configure?

Accepted Answer

Use Azure Files over SMB and enable AD DS authentication. Option A is correct because Azure Files supports SMB protocol, which can be mounted by both Windows and Linux VMs. By enabling AD DS authentication, the administrator can use existing on-premises Active Directory group memberships to control access to the file share without requiring storage account keys, satisfying the security team's requirement.

Answer

Use a blob container and mount it through the Blob API

Answer

Use anonymous access on an Azure File share

Answer

Use a premium NFS file share with a shared access signature

Question 9

A storage account has public network access disabled. A VM in VNet-Prod must reach Blob storage by using the storage account name, but nslookup from the VM still returns the public endpoint address. What should the administrator do?

Accepted Answer

Create a private endpoint for the blob service and link the private DNS zone to VNet-Prod.. Option B is correct because the VM's nslookup returns the public endpoint address, indicating that DNS resolution is not pointing to the private IP of the storage account. Creating a private endpoint for the blob service assigns a private IP from the VNet-Prod subnet to the storage account, and linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-Prod ensures that DNS queries from the VM resolve the storage account name to that private IP, bypassing the public endpoint entirely.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep public network access disabled.

Answer

Add an inbound NSG rule that allows TCP 443 from the VM to the storage account.

Answer

Turn on the trusted Microsoft services exception for the storage account firewall.

Question 10

Match each workload requirement to the Azure storage account kind that best fits it.

Question 11

A Windows VM runs an application that uploads files to a blob container every hour. Security forbids storing storage account keys or long-lived SAS tokens on the VM. The application must be able to write only to that container and nothing else. What should the administrator configure?

Accepted Answer

Assign Storage Blob Data Contributor to the VM's managed identity at the container scope. Option C is correct because it uses Azure RBAC to grant the VM's managed identity the Storage Blob Data Contributor role at the container scope. This allows the application to write only to that specific container without requiring any storage account keys or SAS tokens on the VM, satisfying the security requirement. Managed identities provide an automatically managed service principal in Azure AD, enabling secure authentication to Azure services without storing credentials.

Answer

Store the storage account key in an environment variable on the VM

Answer

Create a service SAS with write permission on the storage account

Answer

Assign Contributor on the storage account to the VM's system-assigned identity

Question 12

A backup job from an Azure service must write to a storage account that has the network firewall set to deny all public traffic. The team does not want to create a private endpoint for this workload. What should the administrator enable?

Accepted Answer

Allow trusted Microsoft services to access the storage account. Option A is correct because Azure Storage firewalls include a special exception for 'Allow trusted Microsoft services to access this storage account'. When enabled, this exception permits Azure platform services—such as Azure Backup—to bypass the public network deny rule and write to the storage account without requiring a private endpoint. This works because the backup service runs on Microsoft-owned infrastructure that is authenticated and authorized at the control plane level, not via a public IP.

Answer

Add the backup server's public IP address to the storage firewall

Answer

Create a service endpoint on the subnet that hosts the backup job

Answer

Disable the storage account firewall temporarily during each backup window

Question 13

You are managing an Azure Storage account that hosts a large number of blobs. You need to ensure that data can be recovered if blobs are accidentally deleted or overwritten. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Enable blob versioning.. Soft delete for blobs preserves deleted blobs for a specified retention period, allowing recovery from accidental deletion. Blob versioning maintains previous versions of a blob, enabling restoration if a blob is overwritten or deleted. Point-in-time restore for block blobs allows reverting the container to an earlier state, recovering from bulk accidental modifications or deletions. Together, these three features provide comprehensive protection against accidental data loss.

Answer

Set the default access tier to Archive.

Answer

Enable Azure Defender for Storage.

Answer

Configure a lifecycle management policy to move blobs to the Cool tier.

Question 14

Your company plans to migrate on-premises file shares to Azure Files. You need to choose the appropriate Azure Files configuration for different scenarios. Which three of the following statements are correct? (Choose three.)

Accepted Answer

Azure Files supports NFS protocol only for Premium file shares.. Azure Files supports the SMB protocol, which is compatible with Windows, Linux, and macOS clients. This allows file shares to be mounted across different operating systems, making it a versatile solution for hybrid environments.

Answer

Azure Files requires a VPN or ExpressRoute for any access from on-premises.

Answer

Azure Files supports both SMB and NFS protocols for Standard file shares.

Answer

Azure file shares can be used as a backing store for Azure SQL Managed Instance databases.

Question 15

You are designing a disaster recovery strategy for Azure Blob Storage. The storage account is configured with geo-redundant storage (GRS). Which three of the following statements about GRS and failover are true? (Choose three.)

Accepted Answer

GRS provides three copies of your data within the primary region and three additional copies in the secondary region.. Geo-redundant storage (GRS) replicates data asynchronously to a paired secondary region, ensuring durability even during a regional outage. In such an outage, you can initiate a customer-managed failover to promote the secondary region as the new primary. GRS maintains three copies (LRS) in the primary region and three additional copies in the secondary region, providing six total replicas.

Answer

Once a failover is completed, you cannot fail back to the original primary region.

Answer

GRS guarantees zero data loss if a failover is triggered.

Answer

After a failover, the secondary region becomes the new primary and replication to the original primary is automatically established.