AZ-104 Implement and Manage Storage Practice Test 4 — 15 Questions

Question 1

A backup archive must survive a regional outage, and engineers need to read the secondary copy if the primary region is unavailable. Which two redundancy options meet both requirements? Select two.

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is correct because it provides geo-redundant replication (GRS) that replicates data to a secondary region, ensuring survival of a regional outage, and additionally enables read access to the secondary copy even when the primary region is unavailable. This meets both requirements: disaster recovery and read availability during primary region failure.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 2

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 3

A data-processing app reads blobs immediately after upload, and operations do not want any rehydration delay. Which three access tiers can be read directly? Select three.

Accepted Answer

Hot. The Hot, Cool, and Cold access tiers are designed for online data access, meaning blobs stored in these tiers can be read immediately without any rehydration delay. This is because the data is always stored on high-throughput, low-latency media and is immediately available for read operations. In contrast, the Archive tier requires a rehydration process (which can take hours) before data can be accessed, making it unsuitable for scenarios where blobs must be read immediately after upload.

Answer

Archive

Answer

Premium

Question 4

A workload must keep storage available if one availability zone in the primary region fails. Geo-failover is optional, but the account must still meet the zone-failure requirement. Which two redundancy options satisfy this? Select two.

Accepted Answer

ZRS. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three availability zones within a single region, ensuring durability and availability even if one zone fails. This meets the requirement of keeping storage available during a zone failure without relying on geo-failover.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 5

A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?

Accepted Answer

Assign a managed identity to the app and grant it storage permissions. Option B is correct because Azure Managed Identity provides an automatically managed service principal in Azure AD, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Azure AD token to securely access the blob container.

Answer

Embed the storage account key in the application settings

Answer

Use the public endpoint and anonymous access

Answer

Use an archive tier for the container

Question 6

A company wants its file share data to be automatically copied to a paired Azure region, and administrators want to read the secondary copy during a disaster test. Which redundancy option should they use?

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is correct because it replicates data to a paired secondary region asynchronously and provides read-only access to that secondary copy. This allows administrators to read the secondary copy during a disaster test without impacting the primary region. ZRS and LRS do not replicate to a paired region, and Cool is a tier, not a redundancy option.

Answer

ZRS

Answer

LRS

Answer

Cool

Question 7

A help desk engineer must be able to start, stop, and resize only VM-App01. The engineer must not gain access to any other virtual machines or resource groups in the subscription. What scope should you use for the Azure RBAC role assignment?

Accepted Answer

Assign the role at the virtual machine scope for VM-App01 only.. Option B is correct because Azure RBAC allows you to assign a role at the virtual machine scope, which restricts permissions to that specific resource only. By assigning a role like 'Virtual Machine Contributor' at the scope of VM-App01, the help desk engineer can start, stop, and resize only that VM without gaining access to any other VMs or resource groups in the subscription.

Answer

Assign the role at the subscription scope so the engineer can manage any VM in the subscription.

Answer

Assign the role at the resource group scope that contains VM-App01.

Answer

Assign the role at a management group scope so the team can standardize access.

Question 8

An engineering team stores build artifacts that are downloaded every day by developers for a week after release, then rarely after that. Which tier should the administrator choose for the period when the artifacts are still actively used?

Accepted Answer

Hot. The Hot tier is the correct choice for the period when build artifacts are actively used because it provides the lowest access latency and highest throughput, which is essential for daily downloads by developers. Azure Blob Storage's Hot tier is optimized for frequent access patterns (e.g., multiple times per day) and incurs no data retrieval costs, making it cost-effective for this high-access phase.

Answer

Archive

Answer

Cool

Answer

Cold

Question 9

A legal team stores scanned contracts in Blob Archive. Auditors will need to open several files next week for about five days and then the documents should return to the lowest practical storage cost. Which two actions should the administrator plan? Select two.

Accepted Answer

Initiate a rehydration to the Cool tier before the review window.. Option B is correct because blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to a hot or cool tier. Rehydrating to the Cool tier is appropriate for a five-day access window and avoids the higher cost of the Hot tier. After the review, moving the blobs back to Archive (Option D) ensures the lowest practical storage cost for long-term retention.

Answer

Download the blobs directly from Archive with a normal read operation.

Answer

Set the blobs to the Hot tier permanently as soon as the review starts.

Answer

Change the storage account redundancy to RA-GRS so the files can be read.

Question 10

A finance department wants several Windows virtual machines to map the same shared drive letter and work with the same files at the same time. Which Azure Storage service should you configure?

Accepted Answer

Azure Files share. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, allowing multiple Windows VMs to mount the same share with a consistent drive letter (e.g., Z:) and access the same files concurrently. This meets the finance department's requirement for shared access with a mapped drive letter, which Azure Blob storage cannot provide because it uses REST APIs rather than SMB.

Answer

Azure Blob container

Answer

Archive blob tier

Answer

Storage account access key only

Question 11

A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account.. A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.

Answer

A service endpoint on the subnet.

Answer

A public IP address with an NSG inbound allow rule.

Answer

A VPN gateway connection to the storage account.

Question 12

A legal department stores scanned contracts that are kept for compliance and are almost never opened. They want the lowest storage cost, and it is acceptable if files take time to become available before download. Which blob tier should you choose?

Accepted Answer

Archive. The Archive tier is designed for data that is rarely accessed and has the lowest storage cost among Azure Blob Storage tiers. It requires rehydration (which can take up to 15 hours) before files become available, making it ideal for compliance data that is almost never opened and where delayed access is acceptable.

Answer

Hot

Answer

Cool

Answer

Cold

Question 13

A team stores application logs in an Azure Storage account. The logs must remain available if an entire Azure availability zone in the primary region has an outage, but the team does not require a secondary region copy. Which redundancy option should you choose?

Accepted Answer

ZRS. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region, ensuring durability even if an entire zone fails. Since the requirement explicitly states no secondary region copy is needed, ZRS is the correct choice because it provides intra-region zone-level resilience without cross-region replication.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 14

A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Accepted Answer

Issue a shared access signature with read-only permissions and an expiration time. A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.

Answer

Create a new managed identity for the contractor

Answer

Give the contractor the storage account access key

Answer

Enable anonymous public access on the container

Question 15

A finance archive stores critical blobs in an Azure region that supports availability zones. The data must survive a single zone failure and also remain available if the primary region becomes unavailable. The team does not need a read-only endpoint in the secondary region during normal operations. Which two redundancy models satisfy the requirement? Select two.

Accepted Answer

GZRS. D (GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region to survive a single zone failure with geo-redundancy (GRS) to replicate data asynchronously to a secondary region, ensuring availability if the primary region becomes unavailable. Since the team does not need a read-only endpoint in the secondary region during normal operations, GZRS (which does not provide read access to the secondary region unless a failover occurs) meets the requirement without the extra cost or feature of RA-GZRS.

Answer

LRS

Answer

ZRS

Answer

GRS