AZ-104 Implement and Manage Storage Practice Test 3 — 15 Questions

Question 1

A line-of-business application stores transaction logs in an Azure Storage account. The app must keep working if one availability zone in the primary region fails, and administrators want read access to the secondary copy if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it keeps the primary region zone-redundant and allows read access to the secondary copy.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) across availability zones in the primary region, ensuring continued operation if one zone fails, with geo-replication to a secondary region. Additionally, the 'RA' prefix enables read access to the secondary copy if the primary region becomes unavailable, meeting both requirements.

Answer

LRS, because it keeps three local copies in one datacenter and is the simplest choice.

Answer

RA-GRS, because it provides geo-replication and read access to the secondary region.

Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication.

Question 2

Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?

Accepted Answer

Assign Storage Blob Data Reader at the invoices container scope.. Option B is correct because assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.

Answer

Assign Reader at the storage account scope so John can view the storage account and its data.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Make the invoices container public and keep John's existing Contributor role.

Question 3

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 4

A reporting system requires a storage account that is zone resilient in the primary region and also keeps a geo-replicated secondary copy that can be read during an outage. Which redundancy option should you select?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous replication across three Azure availability zones in the primary region for zone resilience, asynchronous geo-replication to a secondary region for disaster recovery, and enables read access to the secondary copy during an outage. This meets all three requirements: zone resiliency, geo-replication, and readable secondary region.

Answer

ZRS, because it protects against zone failure and also provides a readable secondary region.

Answer

GRS, because it stores a secondary copy in another region but does not offer zone redundancy in the primary region.

Answer

LRS, because local replication is enough when the workload already has application-level retries.

Question 5

A lifecycle rule moves blobs to the archive tier after 90 days. A file was archived 2 weeks ago, and a reporting job now needs to read it tomorrow morning. What should you expect?

Accepted Answer

The file must be rehydrated to an online tier before it can be read, so access is delayed.. Option B is correct because blobs in the Azure Archive tier are offline and cannot be read directly. To access the data, you must first rehydrate the blob to an online tier (Hot, Cool, or Cold) using a copy or change-tier operation, which introduces a delay (typically up to 15 hours for standard priority rehydration). The file was archived only 2 weeks ago, so it is still in the Archive tier and requires rehydration before the reporting job can read it tomorrow morning.

Answer

The file is immediately readable, but only through the archive endpoint and at a higher request rate.

Answer

The file is permanently deleted when it enters archive, so the job must use a backup restore.

Answer

The file can be read immediately if the account has read-access geo-redundancy enabled.

Question 6

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 7

A company has 15 branch Windows file servers that must show the same shared drive content. Users should keep working during short WAN outages, and local servers should cache frequently used files. Which Azure feature should you deploy?

Accepted Answer

Azure File Sync, because it synchronizes on-premises file servers with an Azure file share and supports cloud tiering.. Azure File Sync is the correct choice because it synchronizes on-premises Windows file servers with an Azure file share, enabling multi-site file server consolidation. It supports cloud tiering, which caches frequently accessed files locally on each branch server while freeing up space by tiering cold data to the cloud. This ensures users can continue working during short WAN outages, as local caches provide access to synced files even when connectivity is lost.

Answer

Azure Blob Storage with lifecycle rules, because it can present files to multiple branches.

Answer

A private endpoint to Blob Storage, because it provides local caching for SMB file shares.

Answer

A managed disk shared across the branch servers, because it gives the same content to all locations.

Question 8

An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.

Accepted Answer

Create a user-assigned managed identity that can be attached to both Azure resources.. Option A is correct because a user-assigned managed identity provides a secure, credential-free authentication method for Azure resources. It allows both the Function App and Automation runbook to authenticate to Azure Storage without storing any secrets, meeting the requirement to avoid stored secrets.

Answer

Store the storage account access key in both app settings and runbook variables.

Answer

Assign Contributor on the storage account because it automatically includes all blob data permissions.

Answer

Use a shared SAS token without an expiration date for both workloads.

Question 9

A hub-and-spoke environment already has an Azure VPN gateway deployed in the hub VNet. A spoke VNet must send on-premises traffic through that existing gateway, and administrators must be able to manage the peering from either side without creating a separate gateway in the spoke. Which two peering settings are required? Select two.

Accepted Answer

Enable Allow gateway transit on the hub-to-spoke peering.. Option A is correct because enabling 'Allow gateway transit' on the hub-to-spoke peering allows the hub VNet to advertise its VPN gateway routes to the spoke VNet. This setting is configured on the peering from the hub side and is a prerequisite for the spoke to use the hub's gateway for on-premises connectivity.

Answer

Enable Allow forwarded traffic on both peerings as the only required setting.

Answer

Enable Allow gateway transit on the spoke-to-hub peering.

Answer

Create a user-defined route that points all on-premises prefixes to the hub VNet gateway.

Question 10

Match each blob access method or setting to its best use case.

Question 11

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.

Question 12

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.

Question 13

Based on the exhibit, which redundancy setting should you choose before deploying the storage account?

Accepted Answer

RA-GZRS, because it provides zone redundancy and read access to the secondary region.. RA-GRS (Read-Access Geo-Redundant Storage) is the correct choice because the exhibit shows a requirement for read access to the secondary region in the event of a primary region outage. RA-GRS provides zone-level redundancy within the primary region (using LRS for three copies) and asynchronously replicates data to a secondary region, where it is also stored with LRS. The 'RA' prefix enables read access to the secondary endpoint, allowing applications to serve read requests from the secondary region even when the primary is unavailable.

Answer

LRS, because it keeps three copies within one datacenter and is the least expensive option.

Answer

ZRS, because it replicates data across availability zones in the primary region.

Answer

GZRS, because it combines zone redundancy with geo-replication to another region.

Question 14

Match each Azure Storage redundancy option to the best description.

Question 15

Before changing a managed data disk on a production VM, you want a point-in-time copy that you can keep and restore later if needed. What should you create?

Accepted Answer

A managed disk snapshot. A managed disk snapshot captures a point-in-time, read-only copy of a managed disk. You can use it to restore the VM to that exact state by creating a new disk from the snapshot and attaching it to the VM. Snapshots are independent of the source disk's lifecycle, so you can keep them indefinitely for backup or recovery purposes.

Answer

An availability set

Answer

A load balancer backend pool

Answer

A resource lock