AZ-104 Implement and Manage Storage Practice Test 15 — 15 Questions

Question 1

A contractor needs to upload files to one blob container for the next two hours. The contractor must not learn the storage account key, and access should expire automatically without manual cleanup. What is the best way to grant access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.. A user delegation SAS is the correct choice because it is secured with Entra ID credentials rather than the storage account key, ensuring the contractor never learns the key. The SAS can be scoped to exactly the required container permissions and a two-hour expiry, providing automatic, time-limited access without manual cleanup. This approach aligns with the principle of least privilege and eliminates the need to share or rotate storage account keys.

Answer

Share the storage account key and ask the contractor to stop using it after two hours.

Answer

Create an account SAS with broad permissions and send it to the contractor by email.

Answer

Assign the contractor the Storage Blob Data Contributor role at the storage account scope.

Question 2

A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule allowing that subnet.. A service endpoint on the subnet extends the virtual network identity to the storage account, allowing the storage firewall to restrict access to traffic originating from that specific subnet. This ensures the storage account remains reachable via its public endpoint, but only from the configured subnet, without requiring a private endpoint or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A public IP address for the subnet and a storage account firewall exception.

Answer

An NSG rule that permits outbound TCP 443 to the storage account.

Question 3

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 4

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 5

Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.

Accepted Answer

SAS: Provides time-limited delegated access with specified permissions.. SAS provides delegated access; Microsoft Entra ID authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Microsoft Entra Domain Services extends on-prem AD; Service SAS can include IP restrictions.

Answer

SAS: Uses Azure AD identities to authenticate.

Answer

Azure AD authentication: Provides anonymous read access.

Question 6

A reporting team wants a storage redundancy option that keeps a readable copy in the paired region. Which two choices provide read access to the secondary region? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS).. Read-access geo-redundant storage (RA-GRS) is correct because it provides geo-redundant storage (GRS) with the additional capability to read from the secondary region. This ensures that if the primary region becomes unavailable, the reporting team can still access a readable copy of the data in the paired region. RA-GRS replicates data asynchronously to a secondary region and allows read access to that secondary copy at all times.

Answer

Locally redundant storage (LRS).

Answer

Zone-redundant storage (ZRS).

Answer

Geo-redundant storage (GRS).

Question 7

A business stores audit logs in Azure Blob Storage. The account must remain available if an entire availability zone in the primary region fails, and analysts must still be able to read the data from the paired region if the primary region becomes unavailable. Which replication option should the administrator select?

Accepted Answer

Read-access geo-zone-redundant storage (RA-GZRS). C is correct because Read-access geo-zone-redundant storage (RA-GZRS) combines zone-redundancy within the primary region (surviving an entire zone failure) with geo-replication to a paired region, and crucially provides read access to the secondary region data even if the primary region is unavailable. This meets both requirements: availability during a zone failure and readable data from the paired region during a primary region outage.

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 8

A lifecycle rule moved quarterly audit logs to the Archive tier. An auditor now needs one blob for an urgent investigation and wants it available for download as soon as the rehydration completes. What should the administrator do?

Accepted Answer

Change the blob access tier to Hot and wait for rehydration to finish before downloading it.. Changing the access tier of a blob from Archive to Hot initiates an asynchronous rehydration process that moves the blob data back to an online tier. Once rehydration completes, the blob becomes available for download. This is the standard method to make archived blobs accessible for immediate use.

Answer

Copy the blob directly from Archive tier to the client's local disk.

Answer

Assign the blob a shorter retention policy so it becomes accessible automatically.

Answer

Move the blob to the Cool tier and attempt the download immediately.

Question 9

A business-critical storage account must keep data available if one availability zone fails in the primary region. It must also keep a readable copy in the paired region so administrators can verify data during disaster recovery testing before failover. Which redundancy option should be selected?

Accepted Answer

RA-GZRS, because it provides zone redundancy in the primary region and read access to the secondary region.. D is correct because RA-GZRS (Read-Access Geo-Zone-Redundant Storage) provides synchronous replication across three Azure availability zones within the primary region, ensuring data remains available if one zone fails. It also asynchronously replicates data to the paired region, where a read-only copy is available for verification during disaster recovery testing without requiring a failover.

Answer

LRS, because it stores three copies in one datacenter and is the lowest-cost option.

Answer

ZRS, because it replicates data across zones in the same region but not to another region.

Answer

GRS, because it replicates to the paired region and supports a secondary copy for recovery.

Question 10

An application on a VM in subnet AppSubnet must access a storage account over the public endpoint. The security team wants to allow traffic only from AppSubnet and does not want to deploy a private endpoint. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.. Enabling a Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, while still using the public endpoint. Then, configuring the storage account firewall to allow that virtual network restricts access exclusively to AppSubnet, meeting the security requirement without deploying a private endpoint.

Answer

Disable the storage account firewall and rely on the VM's source IP address.

Answer

Create a private endpoint and leave the firewall set to allow all networks.

Answer

Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.

Question 11

A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.

Answer

Create a private endpoint and disable public network access.

Answer

Generate a user delegation SAS token and distribute it only to the subnet.

Answer

Change the redundancy setting to ZRS and enable soft delete.

Question 12

Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

Accepted Answer

The Allow trusted Microsoft services to bypass this firewall setting. The 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.

Answer

A service endpoint on the destination storage account subnet

Answer

A shared access signature with read permission

Answer

A private DNS zone linked to the workspace virtual network

Question 13

A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?

Accepted Answer

Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.

Answer

Use a private endpoint and rely on network isolation instead of authentication.

Answer

Use the storage account access key because SMB requires shared-key authentication.

Answer

Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.

Question 14

A team needs one Azure Files share that can be mounted by both Windows and Linux VMs. The VMs are joined to the same on-premises Active Directory Domain Services domain, and the security team forbids storage account keys. The team also wants to manage access with existing AD group memberships. What should the administrator configure?

Accepted Answer

Use Azure Files over SMB and enable AD DS authentication. Azure Files supports SMB protocol, which can be mounted by both Windows and Linux VMs. By enabling AD DS authentication, the administrator can use existing on-premises Active Directory group memberships to control access to the file share without requiring storage account keys, satisfying the security team's requirement.

Answer

Use a blob container and mount it through the Blob API

Answer

Use anonymous access on an Azure File share

Answer

Use a premium NFS file share with a shared access signature

Question 15

Match each workload requirement to the Azure storage account kind that best fits it.

Accepted Answer

General-purpose v2: Provides support for blobs, files, queues, tables, and VM disks. Suitable for most general-purpose workloads.. Each storage kind is tailored for specific workloads: GPv2 is the default, BlockBlobStorage for high throughput, FileStorage for premium files, and others for legacy or specialized needs.

Answer

General-purpose v2: Premium performance for block blob and append blob data, with low latency.

Answer

BlockBlobStorage: Legacy blob-only account type.