AZ-104 Implement and Manage Storage Practice Test 2 — 15 Questions

Question 1

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key. Which two temporary access methods can be used? Select two.

Accepted Answer

Service SAS, because it grants scoped access to a container or blob for a limited time.. A Service SAS (Shared Access Signature) allows you to delegate limited-time, scoped access to a specific container or blob without exposing the storage account key. It can be configured with a start time, expiry time, and permissions (e.g., write, read), making it ideal for a 12-hour upload window. This method ensures the partner can only access the designated container for the required duration. B User delegation SAS is also a valid temporary access method: it is issued with Microsoft Entra ID (Azure AD) and provides scoped, time-limited access to a container or blob without sharing the storage account key. The user delegation SAS is signed with the user's credentials rather than the account key, offering a more secure option for temporary access.

Answer

Storage account shared key, because it can be time-limited when copied into an email.

Answer

Anonymous access, because it can be enabled for the container and expires automatically after 12 hours.

Answer

Resource lock, because it can restrict the partner to one container without requiring any token.

Question 2

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. GZRS (Option C) is correct because it provides zone-redundant storage within the primary region, surviving a zone failure, and geo-replication to a secondary region, keeping data available during a regional outage. RA-GZRS (Option D) is also correct because it provides the same zone-redundancy and geo-replication as GZRS, and additionally allows read access to the secondary region, which also satisfies both requirements. Therefore, both C and D meet the stated requirement.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 3

A company wants a storage account that keeps a readable copy in the secondary region and lets read operations continue if the primary region becomes unavailable. Which two redundancy options meet this requirement? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS). Both RA-GRS and RA-GZRS maintain a readable copy in the secondary region and allow read operations to continue if the primary becomes unavailable. RA-GRS provides geo-redundant replication with continuous read access to the secondary region, while RA-GZRS combines zone-redundant storage in the primary region with geo-redundant read access to the secondary region. Both meet the requirement. GRS alone does not provide read access until failover.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 4

A storage account has public network access disabled. A VM in VNet-Prod must reach Blob storage by using the storage account name, but nslookup from the VM still returns the public endpoint address. What should the administrator do?

Accepted Answer

Create a private endpoint for the blob service and link the private DNS zone to VNet-Prod.. The VM's nslookup returns the public endpoint address, indicating that DNS resolution is not pointing to the private IP of the storage account. Creating a private endpoint for the blob service assigns a private IP from the VNet-Prod subnet to the storage account, and linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-Prod ensures that DNS queries from the VM resolve the storage account name to that private IP, bypassing the public endpoint entirely.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep public network access disabled.

Answer

Add an inbound NSG rule that allows TCP 443 from the VM to the storage account.

Answer

Turn on the trusted Microsoft services exception for the storage account firewall.

Question 5

Your company plans to migrate on-premises file shares to Azure Files. You need to choose the appropriate Azure Files configuration for different scenarios. Which three of the following statements are correct? (Choose three.)

Accepted Answer

Azure file shares can be accessed over the internet using SMB 3.0 with encryption, provided port 445 is open.. Azure Files supports SMB protocol for Windows, Linux, and macOS clients. NFS protocol is supported only on Premium file shares. Azure file shares can be accessed over the internet using SMB 3.0 with encryption if port 445 is open.

Answer

Azure Files supports both SMB and NFS protocols for Standard file shares.

Answer

Azure file shares can be used as a backing store for Azure SQL Managed Instance databases.

Answer

Azure Files requires a VPN or ExpressRoute for any access from on-premises.

Question 6

Your company stores departmental documents in an Azure file share. Users need to be able to recover previous versions of files that were deleted or modified accidentally. You need a solution that supports recovery at the file share level without deploying additional virtual machines. What should you configure?

Accepted Answer

Create share snapshots for the Azure file share.. Azure file share snapshots provide point-in-time, read-only copies of the entire file share, allowing users to recover previous versions of files that were deleted or modified accidentally. This feature operates at the file share level without requiring any additional virtual machines, making it a straightforward and cost-effective solution for version recovery.

Answer

Enable blob versioning.

Answer

Configure Azure File Sync cloud tiering.

Answer

Enable immutable blob storage.

Question 7

A business-critical application uses an Azure storage account. The company requires that data remain available even if an entire Azure region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

GZRS. D (GZRS) is correct because it combines zone-redundant storage (ZRS) within a primary region with geo-redundant replication to a secondary region, ensuring data remains available even if an entire Azure region becomes unavailable. This meets the business-critical requirement for regional disaster recovery while maintaining high durability and availability.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 8

A partner needs temporary read-only access to a single blob in a storage account for the next 24 hours. The partner must not be able to list other blobs or write data. What should you provide?

Accepted Answer

A service SAS scoped to the blob with read permission and an expiry time.. A service SAS scoped to a specific blob with read permission and an expiry time provides the exact temporary, read-only access required. It restricts access to only that blob, prevents listing other blobs, and automatically expires after 24 hours, meeting all security and functional requirements.

Answer

The storage account access key.

Answer

A private endpoint to the storage account.

Answer

Contributor access to the storage account.

Question 9

You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?

Accepted Answer

A managed identity for VM-App01 and Azure RBAC on the storage account.. Using a managed identity for VM-App01 allows the application to authenticate to Azure Storage without storing any credentials in code or configuration files. The managed identity is automatically managed by Azure AD, and you grant it access to the blob container using Azure RBAC (e.g., the Storage Blob Data Contributor role). This eliminates the need for account keys or shared access signatures.

Answer

A shared access signature stored in a text file on VM-App01.

Answer

The storage account access key hard-coded in the application.

Answer

Anonymous public access for the blob container.

Question 10

You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct solution because it provides delegated, time-limited access to a specific Azure storage resource (such as a single blob) without exposing the storage account key. You can configure the SAS with read-only permissions, an expiration time, and apply it to a specific blob URL, meeting the requirement for temporary external read access.

Answer

A storage account access key

Answer

A resource lock

Answer

A private endpoint

Question 11

You have a storage account that stores infrequently accessed data that must remain available immediately when requested. You need to minimize storage costs. Which access tier should you use?

Accepted Answer

Cool. The Cool access tier is designed for data that is infrequently accessed but still requires immediate availability when requested, offering lower storage costs than the Hot tier while maintaining low latency access. Since the data must remain available immediately, the Archive tier is unsuitable due to its multi-hour retrieval latency, and the Premium tier is optimized for high-performance scenarios, not cost minimization.

Answer

Premium

Answer

Hot

Answer

Archive

Question 12

A company uses Azure Blob Storage for legal documents. The documents must not be modified or deleted for seven years after upload, even by administrators. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted for a specified retention period, even by administrators. This is the only Azure storage feature that provides legal hold or regulatory compliance for fixed records, such as legal documents that must remain unaltered for seven years.

Answer

Blob soft delete

Answer

Lifecycle management to move blobs to Archive

Answer

Blob versioning

Question 13

A storage account hosts blobs used by a public website. You need to reduce the risk of accidental deletion by developers while allowing updates to existing blobs. What should you configure?

Accepted Answer

Enable blob soft delete.. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. This meets the requirement to reduce risk from developers while still permitting updates to existing blobs, as soft delete only applies to delete operations, not overwrites.

Answer

Enable immutable storage for the container.

Answer

Move the account to premium performance.

Answer

Enable static website hosting only.

Question 14

You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.

Answer

The storage account access key

Answer

The connection string with the account key

Answer

A Recovery Services vault

Question 15

Users in Branch01 access an Azure file share over SMB. Performance is poor because frequently used files are downloaded repeatedly across the WAN. You need to keep a local cache on a Windows Server in Branch01 while keeping Azure Files as the central file share. What should you deploy?

Accepted Answer

Azure File Sync. Azure File Sync is the correct solution because it enables caching of Azure file shares on a Windows Server at the branch location, providing local access to frequently used files while keeping Azure Files as the central authoritative store. It uses a sync engine to maintain a local cache and leverages the SMB protocol for access, reducing WAN latency by serving files from the local server.

Answer

Blob versioning

Answer

Share snapshots

Answer

A private endpoint