AZ-104 Implement and Manage Storage Practice Test 4 — 15 Questions

Question 1

Before changing a managed data disk attached to a VM, you want a point-in-time copy that can be restored later if the change fails. What should you create?

Accepted Answer

Managed disk snapshot. A managed disk snapshot is a point-in-time, read-only copy of a managed disk that can be used to restore the disk to that exact state if a change fails. Snapshots are incremental, capturing only the changes since the last snapshot, and they exist independently of the source disk, allowing you to create a new disk from the snapshot for recovery.

Answer

Availability set

Answer

Image

Answer

Resource lock

Question 2

An application writes transaction logs to a storage account in a region that supports availability zones. The business wants the account to stay available if one datacenter or zone fails, but it does not need a secondary region replica. Which redundancy option should you choose?

Accepted Answer

ZRS, because it replicates synchronously across zones in the same region and survives a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region. This design ensures that if one datacenter or zone fails, the storage account remains available and durable without requiring a secondary region replica, exactly matching the business requirement.

Answer

LRS, because it keeps three copies within a single datacenter and is enough for any zone failure.

Answer

GRS, because it adds a geographically replicated secondary region for disaster recovery.

Answer

RA-GRS, because read access to the secondary region is the best protection against a zone failure.

Question 3

Match each blob tier or protection feature to the correct description.

Accepted Answer

Hot: Optimized for frequent access, low latency, highest storage cost, no access cost.. The hot, cool, and archive tiers differ in access frequency and cost structure. Soft delete, immutable storage, and point-in-time restore are protection features that prevent data loss or tampering.

Answer

Hot: Optimized for infrequent access, moderate latency.

Answer

Cool: Optimized for rare access, high latency.

Question 4

A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?

Accepted Answer

A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.

Answer

The storage account access key in an application setting, because it works with any blob operation.

Answer

The Contributor role on the storage account, because it includes both management and data permissions.

Answer

A service endpoint on the subnet, because service endpoints are used for application authentication.

Question 5

A line-of-business application stores transaction logs in an Azure Storage account. The app must keep working if one availability zone in the primary region fails, and administrators want read access to the secondary copy if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it keeps the primary region zone-redundant and allows read access to the secondary copy.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) across availability zones in the primary region, ensuring continued operation if one zone fails, with geo-replication to a secondary region. Additionally, the 'RA' prefix enables read access to the secondary copy if the primary region becomes unavailable, meeting both requirements.

Answer

LRS, because it keeps three local copies in one datacenter and is the simplest choice.

Answer

RA-GRS, because it provides geo-replication and read access to the secondary region.

Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication.

Question 6

Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?

Accepted Answer

Assign Storage Blob Data Reader at the invoices container scope.. Assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.

Answer

Assign Reader at the storage account scope so John can view the storage account and its data.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Make the invoices container public and keep John's existing Contributor role.

Question 7

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 8

A reporting system requires a storage account that is zone resilient in the primary region and also keeps a geo-replicated secondary copy that can be read during an outage. Which redundancy option should you select?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous replication across three Azure availability zones in the primary region for zone resilience, asynchronous geo-replication to a secondary region for disaster recovery, and enables read access to the secondary copy during an outage. This meets all three requirements: zone resiliency, geo-replication, and readable secondary region.

Answer

ZRS, because it protects against zone failure and also provides a readable secondary region.

Answer

GRS, because it stores a secondary copy in another region but does not offer zone redundancy in the primary region.

Answer

LRS, because local replication is enough when the workload already has application-level retries.

Question 9

A lifecycle rule moves blobs to the archive tier after 90 days. A file was archived 2 weeks ago, and a reporting job now needs to read it tomorrow morning. What should you expect?

Accepted Answer

The file must be rehydrated to an online tier before it can be read, so access is delayed.. Blobs in the Azure Archive tier are offline and cannot be read directly. To access the data, you must first rehydrate the blob to an online tier (Hot, Cool, or Cold) using a copy or change-tier operation, which introduces a delay (typically up to 15 hours for standard priority rehydration). The file was archived only 2 weeks ago, so it is still in the Archive tier and requires rehydration before the reporting job can read it tomorrow morning.

Answer

The file is immediately readable, but only through the archive endpoint and at a higher request rate.

Answer

The file is permanently deleted when it enters archive, so the job must use a backup restore.

Answer

The file can be read immediately if the account has read-access geo-redundancy enabled.

Question 10

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 11

A company has 15 branch Windows file servers that must show the same shared drive content. Users should keep working during short WAN outages, and local servers should cache frequently used files. Which Azure feature should you deploy?

Accepted Answer

Azure File Sync, because it synchronizes on-premises file servers with an Azure file share and supports cloud tiering.. Azure File Sync is the correct choice because it synchronizes on-premises Windows file servers with an Azure file share, enabling multi-site file server consolidation. It supports cloud tiering, which caches frequently accessed files locally on each branch server while freeing up space by tiering cold data to the cloud. This ensures users can continue working during short WAN outages, as local caches provide access to synced files even when connectivity is lost.

Answer

Azure Blob Storage with lifecycle rules, because it can present files to multiple branches.

Answer

A private endpoint to Blob Storage, because it provides local caching for SMB file shares.

Answer

A managed disk shared across the branch servers, because it gives the same content to all locations.

Question 12

An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.

Accepted Answer

Create a user-assigned managed identity that can be attached to both Azure resources.. A user-assigned managed identity provides a secure, credential-free authentication method for Azure resources. It allows both the Function App and Automation runbook to authenticate to Azure Storage without storing any secrets, meeting the requirement to avoid stored secrets.

Answer

Store the storage account access key in both app settings and runbook variables.

Answer

Assign Contributor on the storage account because it automatically includes all blob data permissions.

Answer

Use a shared SAS token without an expiration date for both workloads.

Question 13

Match each blob access method or setting to its best use case.

Accepted Answer

Public endpoint with anonymous access: Best use case for public content accessible without authentication. Public endpoint with anonymous access is for public content. Private endpoint with managed identity provides secure VM access. SAS tokens grant time-limited restricted access. Azure AD with RBAC centralizes identity management. Storage account key gives full admin control. Immutable storage with legal hold ensures data cannot be altered or deleted.

Answer

Private endpoint with managed identity: Best use case for public internet access from VMs

Answer

Immutable storage with legal hold: Best use case for temporary data that can be deleted

Question 14

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.

Question 15

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.