AZ-104 Implement and Manage Storage Practice Test 2 — 15 Questions

Question 1

You need a storage redundancy option that keeps data available if an entire availability zone in the primary region fails, but you do not need cross-region replication. Which redundancy option should you choose?

Accepted Answer

ZRS. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a single region, ensuring data remains available if an entire zone fails. This meets the requirement of no cross-region replication while providing zone-level fault tolerance.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 2

You need to move infrequently accessed blob data automatically from the Hot tier to the Cool tier after 30 days to reduce cost. What should you configure?

Accepted Answer

Lifecycle management rules. Azure Blob Storage lifecycle management rules allow you to automatically transition blobs from the Hot tier to the Cool tier based on age or other conditions. By configuring a rule that moves blobs to the Cool tier after 30 days from creation or last modification, you reduce storage costs for infrequently accessed data without manual intervention.

Answer

Blob soft delete

Answer

A private endpoint

Answer

A CanNotDelete lock

Question 3

Your application stores compliance records in Azure Blob Storage. The records must remain in a write-once-read-many state for three years and must not be altered or deleted during that period. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a WORM (Write-Once, Read-Many) state, preventing any modification or deletion of blobs for a specified retention period. This meets the requirement of keeping compliance records unaltered for three years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Lifecycle management to move data to Archive

Answer

A shared access signature

Question 4

You need to allow recovery of previous versions of files stored in an Azure file share after accidental modification or deletion. Which feature should you configure?

Accepted Answer

Share snapshots for Azure Files. Share snapshots for Azure Files capture point-in-time, read-only copies of the file share, allowing you to recover previous versions of files after accidental modification or deletion. This feature is specifically designed for Azure file shares, not for blobs, and does not require any additional infrastructure.

Answer

Blob versioning

Answer

A shared access signature

Answer

Storage account failover

Question 5

You store long-term financial statements in Azure Blob Storage. The files are almost never accessed, but when they are needed they must be readable immediately without waiting for rehydration. You need to minimize cost. Which access tier should you use?

Accepted Answer

Cool. The Cool access tier is optimal for data that is infrequently accessed but must be available immediately when needed, offering lower storage costs than Hot while maintaining low-latency read access. Archive would require rehydration (taking hours) before reading, violating the requirement for immediate readability. Hot is more expensive for long-term storage of rarely accessed data, and Premium is designed for high-performance workloads, not cost-efficient archival.

Answer

Hot

Answer

Archive

Answer

Premium

Question 6

You need to choose a storage redundancy option that provides the lowest cost and protects data against local hardware failure within a single datacenter only. Which redundancy option should you select?

Accepted Answer

LRS. LRS (Locally Redundant Storage) replicates data three times within a single datacenter (or availability zone) in the same region, protecting against local hardware failures such as disk or server crashes. It is the lowest-cost redundancy option because it does not incur the additional replication costs of cross-zone or cross-region copying. This meets the requirement of protecting data against local hardware failure within a single datacenter only.

Answer

ZRS

Answer

GRS

Answer

GZRS

Question 7

You need to give a third-party auditor temporary read-only access to specific blobs in a container without sharing the storage account keys. Which feature should you use?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides delegated, time-limited, and permission-restricted access to specific Azure Storage resources—in this case, blobs—without exposing the storage account keys. You can generate a service-level SAS token scoped to individual blobs with read-only permissions and an expiration time, allowing the auditor to access only the required blobs. This meets the requirement for temporary, read-only access while maintaining security and granular control.

Answer

A storage account key

Answer

A resource lock

Answer

Blob versioning

Question 8

Your application stores regulatory records in Azure Blob Storage. The records must remain in a write-once-read-many state for four years and must not be altered or deleted during that time. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a write-once-read-many (WORM) state, ensuring that blobs cannot be modified or deleted for a specified duration. This directly meets the regulatory requirement of four-year retention without alteration or deletion, as the policy locks the data at the container level and prevents any changes until the retention period expires.

Answer

Blob soft delete

Answer

Lifecycle management to move data to Archive

Answer

A shared access signature

Question 9

A user deleted one Excel file from a file share backed up with Azure Backup. You want to restore only that file, not the entire share. What should you use?

Accepted Answer

A file-level restore from the backup recovery point. Azure Backup for Azure Files supports file-level restore from a recovery point. When you select a recovery point in the Azure portal, you can browse the file share contents and restore individual files or folders to the original or an alternate location, without restoring the entire share. This is achieved by mounting the recovery point as a read-only share via the SMB protocol, allowing you to copy the specific file.

Answer

A full VM restore

Answer

A metric alert rule

Answer

A private endpoint

Question 10

Based on the exhibit, which method should the administrator use to grant the partner time-limited access to one container?

Accepted Answer

Generate a user delegation SAS after authenticating with Microsoft Entra ID.. A user delegation SAS is secured with Microsoft Entra ID credentials and can be scoped to a specific container with a time-limited expiry, meeting the requirement for time-limited access to one container. Unlike a service SAS, which uses the storage account key and grants broader permissions, the user delegation SAS provides finer-grained control and does not expose the account key. This method is the recommended approach for granting delegated, time-bound access to Azure Storage resources.

Answer

Generate a service SAS by using the storage account key and email the URL to the partner.

Answer

Make the container public and remove the SAS requirement from the partner workflow.

Answer

Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.

Question 11

Before changing a managed data disk attached to a VM, you want a point-in-time copy that can be restored later if the change fails. What should you create?

Accepted Answer

Managed disk snapshot. A managed disk snapshot is a point-in-time, read-only copy of a managed disk that can be used to restore the disk to that exact state if a change fails. Snapshots are incremental, capturing only the changes since the last snapshot, and they exist independently of the source disk, allowing you to create a new disk from the snapshot for recovery.

Answer

Availability set

Answer

Image

Answer

Resource lock

Question 12

An application writes transaction logs to a storage account in a region that supports availability zones. The business wants the account to stay available if one datacenter or zone fails, but it does not need a secondary region replica. Which redundancy option should you choose?

Accepted Answer

ZRS, because it replicates synchronously across zones in the same region and survives a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region. This design ensures that if one datacenter or zone fails, the storage account remains available and durable without requiring a secondary region replica, exactly matching the business requirement.

Answer

LRS, because it keeps three copies within a single datacenter and is enough for any zone failure.

Answer

GRS, because it adds a geographically replicated secondary region for disaster recovery.

Answer

RA-GRS, because read access to the secondary region is the best protection against a zone failure.

Question 13

Match each blob tier or protection feature to the correct description.

Question 14

Based on the exhibit, what should the administrator do to prevent anyone from changing the retention settings after validation?

Accepted Answer

Lock the immutability policy after validation is complete.. Option A is correct because locking the immutability policy (also known as a legal hold or time-based retention policy) prevents any user—including administrators—from modifying or deleting the policy. Once locked, the retention settings become irrevocable, ensuring that data cannot be altered or overwritten during the specified retention period. This is a critical step for compliance with regulations such as SEC 17a-4 or FINRA.

Answer

Move the container to the Cool access tier to preserve the retention period.

Answer

Create a blob snapshot every day so the retention settings cannot be edited.

Answer

Enable container public access so the audit logs are easier to verify.

Question 15

A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?

Accepted Answer

A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.. Option B is correct because a system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.

Answer

The storage account access key in an application setting, because it works with any blob operation.

Answer

The Contributor role on the storage account, because it includes both management and data permissions.

Answer

A service endpoint on the subnet, because service endpoints are used for application authentication.