AZ-104 Implement and Manage Storage Practice Test 2 — 15 Questions

Question 1

A development team wants redundancy within the primary region but does not need replication to a secondary region. Which two Azure storage redundancy options meet this requirement? Select two.

Accepted Answer

LRS, because it keeps multiple copies in one datacenter and does not replicate to another region.. A and B are correct. LRS replicates data three times within a single datacenter in the primary region, providing redundancy against local hardware failures without any replication to a secondary region. ZRS replicates data across availability zones within the primary region, also without geo-replication. Both meet the requirement of intra-region redundancy only. GRS, RA-GRS, and RA-GZRS all replicate to a secondary region, so they do not meet the requirement.

Answer

GRS, because it replicates to a secondary region and therefore matches the requirement.

Answer

RA-GRS, because it adds read access to the secondary region and still remains single-region only.

Answer

RA-GZRS, because it combines zone redundancy with readable geo-replication to another region.

Question 2

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key. Which two temporary access methods can be used? Select two.

Accepted Answer

Service SAS, because it grants scoped access to a container or blob for a limited time.. A Service SAS (Shared Access Signature) allows you to delegate limited-time, scoped access to a specific container or blob without exposing the storage account key. It can be configured with a start time, expiry time, and permissions (e.g., write, read), making it ideal for a 12-hour upload window. This method ensures the partner can only access the designated container for the required duration. B User delegation SAS is also a valid temporary access method: it is issued with Microsoft Entra ID (Azure AD) and provides scoped, time-limited access to a container or blob without sharing the storage account key. The user delegation SAS is signed with the user's credentials rather than the account key, offering a more secure option for temporary access.

Answer

Storage account shared key, because it can be time-limited when copied into an email.

Answer

Anonymous access, because it can be enabled for the container and expires automatically after 12 hours.

Answer

Resource lock, because it can restrict the partner to one container without requiring any token.

Question 3

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. GZRS (Option C) is correct because it provides zone-redundant storage within the primary region, surviving a zone failure, and geo-replication to a secondary region, keeping data available during a regional outage. RA-GZRS (Option D) is also correct because it provides the same zone-redundancy and geo-replication as GZRS, and additionally allows read access to the secondary region, which also satisfies both requirements. Therefore, both C and D meet the stated requirement.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 4

A records team stores blobs that are read often during the first month and then rarely accessed later, but the files must stay online the whole time. Which two access tiers should they use for the active and inactive data sets? Select two.

Accepted Answer

Hot, because it is optimized for frequent reads and online access to active data.. Option A (Hot) is correct because the Hot access tier is optimized for frequent reads and provides the lowest access latency and highest storage cost, matching the blobs that are read often during the first month while remaining online. Option B (Cool) is correct because the Cool tier is designed for infrequent access data that must still be immediately available online, which fits the later rarely accessed files with a lower storage cost than Hot. Option C (Archive) is wrong because Archive is an offline tier requiring rehydration before the data can be read, so it cannot satisfy the requirement that files stay online the whole time. Option D (Premium block blob) is wrong because it is a performance-oriented tier for block blobs with high transaction rates and low latency, not a standard low-cost long-term retention tier. Option E (Cold) is wrong because Cold is an online infrequent-access tier, not an offline tier, and the scenario requires the inactive data to remain online anyway.

Answer

Archive, because it is best for data that must be opened immediately by users.

Answer

Premium block blob, because it is the standard tier for long-term retention and low-cost storage.

Answer

Cold, because it is intended for data that can stay offline until someone requests it.

Question 5

A media archive contains video files that are accessed only a few times per year, but they must remain online and readable immediately whenever an investigator requests them. Which blob access tier should the administrator choose to minimize storage cost?

Accepted Answer

Cold. The Cold tier is the correct choice because it provides online, immediately readable storage for data accessed only a few times per year, while offering lower storage costs than the Cool tier. Unlike the Archive tier, Cold tier data does not require a rehydration delay, ensuring instant access for investigators.

Answer

Hot

Answer

Cool

Answer

Archive

Question 6

A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.

Accepted Answer

Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.. Option A is correct because enabling a Microsoft.Storage service endpoint on the subnet routes traffic to the storage account over the Azure backbone and gives the subnet a private identity that the storage firewall can recognize. Option B is correct because the storage account's networking rules must explicitly allow that subnet (via its service endpoint) so the storage firewall permits only that subnet and denies everything else. Together, the service endpoint plus the storage firewall rule restrict access to the single subnet without a private endpoint. Option C is wrong because it requires a private endpoint, which the scenario explicitly excludes, and leaving the firewall open to all networks defeats the restriction. Option D is wrong because Azure RBAC roles control authorization of identities, not which networks can connect. Option E is wrong because disabling the public endpoint and relying on Internet routing does not limit access to one subnet and is not how storage network restrictions work.

Answer

Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.

Answer

Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.

Answer

Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.

Question 7

A platform team wants one Azure storage account for application logs in Blob containers and a shared working directory for a Windows admin VM and a Linux automation VM. The account must support blob lifecycle rules, standard performance, and future private endpoint access. Which storage account kind should the administrator create?

Accepted Answer

StorageV2 (general-purpose v2), because it supports blobs, Azure Files, lifecycle management, and modern network features.. StorageV2 (general-purpose v2) is the correct choice because it supports Blob storage, Azure Files (required for the shared working directory), blob lifecycle management rules, and advanced networking features like private endpoints. It also provides standard performance, meeting all stated requirements. Other storage kinds lack either Azure Files support or lifecycle management capabilities.

Answer

BlobStorage, because it is optimized for blob data and can store logs efficiently.

Answer

FileStorage, because it is the best option when Azure Files is required.

Answer

BlockBlobStorage, because it provides the highest performance for operational data.

Question 8

A company wants a storage account that keeps a readable copy in the secondary region and lets read operations continue if the primary region becomes unavailable. Which two redundancy options meet this requirement? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS). Both RA-GRS and RA-GZRS maintain a readable copy in the secondary region and allow read operations to continue if the primary becomes unavailable. RA-GRS provides geo-redundant replication with continuous read access to the secondary region, while RA-GZRS combines zone-redundant storage in the primary region with geo-redundant read access to the secondary region. Both meet the requirement. GRS alone does not provide read access until failover.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 9

A company wants a single storage account for blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the required account are true? Select two.

Accepted Answer

It should be a general-purpose v2 storage account.. Option A is correct because a general-purpose v2 (GPv2) storage account supports blobs, files, tables, and queues, and it is the account type that enables blob lifecycle management rules. Option B is correct because a single GPv2 account can simultaneously host blob containers and Azure Files shares, satisfying the requirement for one account serving both services. Option C is wrong because a premium block blob account supports only block blobs and does not support Azure Files shares or lifecycle management. Option D is wrong because lifecycle management policies are supported on GPv2 (and premium block blob) accounts for block and append blobs. Option E is wrong because a GPv2 account can host multiple Azure Storage data services (blob, file, table, queue) at the same time.

Answer

It must be a premium block blob account.

Answer

It cannot use lifecycle management on blobs.

Answer

It can store only one type of Azure Storage data service at a time.

Question 10

A storage account has public network access disabled. A VM in VNet-Prod must reach Blob storage by using the storage account name, but nslookup from the VM still returns the public endpoint address. What should the administrator do?

Accepted Answer

Create a private endpoint for the blob service and link the private DNS zone to VNet-Prod.. The VM's nslookup returns the public endpoint address, indicating that DNS resolution is not pointing to the private IP of the storage account. Creating a private endpoint for the blob service assigns a private IP from the VNet-Prod subnet to the storage account, and linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-Prod ensures that DNS queries from the VM resolve the storage account name to that private IP, bypassing the public endpoint entirely.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep public network access disabled.

Answer

Add an inbound NSG rule that allows TCP 443 from the VM to the storage account.

Answer

Turn on the trusted Microsoft services exception for the storage account firewall.

Question 11

A backup job from an Azure service must write to a storage account that has the network firewall set to deny all public traffic. The team does not want to create a private endpoint for this workload. What should the administrator enable?

Accepted Answer

Allow trusted Microsoft services to access the storage account. Azure Storage firewalls include a special exception for 'Allow trusted Microsoft services to access this storage account'. When enabled, this exception permits Azure platform services—such as Azure Backup—to bypass the public network deny rule and write to the storage account without requiring a private endpoint. This works because the backup service runs on Microsoft-owned infrastructure that is authenticated and authorized at the control plane level, not via a public IP.

Answer

Add the backup server's public IP address to the storage firewall

Answer

Create a service endpoint on the subnet that hosts the backup job

Answer

Disable the storage account firewall temporarily during each backup window

Question 12

Your company plans to migrate on-premises file shares to Azure Files. You need to choose the appropriate Azure Files configuration for different scenarios. Which three of the following statements are correct? (Choose three.)

Accepted Answer

Azure Files supports SMB protocol, which allows mounting file shares from Windows, Linux, and macOS clients.. Azure Files supports SMB protocol for Windows, Linux, and macOS clients. NFS protocol is supported only on Premium file shares. Azure file shares can be accessed over the internet using SMB 3.0 with encryption if port 445 is open.

Answer

Azure Files supports both SMB and NFS protocols for Standard file shares.

Answer

Azure Files requires a VPN or ExpressRoute for any access from on-premises.

Answer

Azure file shares can be used as a backing store for Azure SQL Managed Instance databases.

Question 13

You need to create a storage account that will store infrequently accessed data for at least 180 days. The data must be stored in the cool access tier to reduce costs, but you want to ensure that if the data is accessed, there is no early deletion penalty. Which storage account type should you create?

Accepted Answer

General-purpose v2 with the cool access tier set as the default blob access tier.. General-purpose v2 is the recommended account type for all new storage needs. It supports all access tiers, including cool, at both account and blob level. Setting the default tier to cool stores infrequently accessed data cost-effectively. Since the data is retained for 180 days, the 30-day minimum for cool tier is satisfied, avoiding early deletion charges. Other account types either lack tier support or are not optimal.

Answer

Blob Storage account with the cool access tier set as the default.

Answer

Premium block blob storage account with the cool access tier.

Answer

General-purpose v1 with the cool access tier enabled.

Question 14

You are configuring Azure File Sync on a Windows Server to synchronize a file share hosted on an Azure storage account. You need to ensure that the server can connect to the storage account and that the sync service can access the file share. Which two actions should you perform? (Choose two.)

Accepted Answer

Install the Azure File Sync agent on the Windows Server and register the server with a Storage Sync Service.. To set up Azure File Sync, you must install the Azure File Sync agent on the Windows Server and register it with a Storage Sync Service. Additionally, when creating a sync group and server endpoint, you need to provide credentials (storage account key or SAS token) to access the Azure file share. These two actions are essential for establishing synchronization.

Answer

Create a cloud tiering policy that defines which files are cached locally.

Answer

Configure the server to use a premium file share to improve performance.

Answer

Create a private endpoint for the storage account in the same virtual network as the server.

Question 15

You have a storage account named contosostore with a blob container named logs. The container has a lifecycle management rule that moves blobs to the archive tier after 30 days and deletes them after 365 days. A compliance officer requests that a specific blob named audit-2023.log be retained for 7 years and must be readable within 24 hours if requested. What should you do?

Accepted Answer

Set a time-based retention policy on the container with a retention interval of 7 years.. A time-based retention policy on the container prevents blobs from being modified or deleted for the specified interval. Because changing the access tier is a modification, the lifecycle rule cannot move the blob to archive, ensuring it remains readable within 24 hours. This policy also enforces the 7-year retention, satisfying both compliance and accessibility requirements.

Answer

Apply a legal hold to the blob.

Answer

Create a new lifecycle rule that moves the blob to the cool tier and sets a retention period of 7 years.

Answer

Move the blob to a separate container that has no lifecycle rules and enable soft delete.