AZ-104 Implement and Manage Storage Practice Test 5 — 15 Questions

Question 1

A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Accepted Answer

Add a storage network rule for the subnet or use a private endpoint. Option B is correct because Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.

Answer

Enable anonymous blob access

Answer

Move the container to the Archive tier

Answer

Assign the Contributor role to the subnet

Question 2

A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?

Accepted Answer

A service SAS scoped to the container with write permission and an expiry time in six hours.. A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.

Answer

The storage account access key, because it is easier to revoke later.

Answer

A shared key rotation policy, because it grants time-limited access to one container.

Answer

A user-assigned managed identity assigned to the contractor’s laptop.

Question 3

A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key and wants the access to expire automatically. Which two actions should the administrator take? Select two.

Accepted Answer

Generate a user delegation SAS for the contractor.. A user delegation SAS is secured with Azure AD credentials rather than the storage account key, allowing the administrator to grant time-limited access without exposing the key. Setting the SAS expiry to six hours ensures the contractor's access automatically expires after the required duration, meeting both security and time-bound requirements.

Answer

Generate a service SAS by using the account key.

Answer

Enable anonymous blob access on the container.

Answer

Create a storage account access key specifically for the contractor.

Question 4

An employee accidentally deletes several folders from an Azure file share. The administrator must recover only those folders from yesterday, not roll back the whole share. What should the administrator use?

Accepted Answer

The latest Azure file share snapshot. Azure file share snapshots capture the state of the share at a point in time. By mounting a snapshot taken yesterday, the administrator can browse the snapshot's directory structure and copy only the deleted folders back to the live share, without affecting other files. This provides granular recovery without rolling back the entire share.

Answer

The storage account access key

Answer

A shared access signature

Answer

A private endpoint to the storage account

Question 5

A web app already reads blobs by using a managed identity. Security now requires blocking any future requests that use shared key authorization, while the app must continue to work without storing secrets. Which two changes should the administrator make? Select two.

Accepted Answer

Disable shared key access on the storage account.. Option A is correct because disabling shared key access on the storage account enforces the security requirement to block future requests that use shared key authorization. This setting, when enabled, rejects any request that does not use Azure AD authentication, such as those signed with storage account keys or SAS tokens. Since the web app already uses a managed identity, it can continue to authenticate via Azure AD without storing secrets, ensuring the app works seamlessly after the change.

Answer

Replace the managed identity with a storage account key in the app settings.

Answer

Remove all network rules from the storage account.

Answer

Create a service SAS and embed it in the code.

Question 6

A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?

Accepted Answer

A service principal for the pipeline, with certificate-based or federated authentication.. Option C is correct because the on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Azure AD and deploy ARM templates. This aligns with the principle of using Azure AD application credentials for non-Azure workloads.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity attached to the on-premises server.

Answer

A shared access signature for the target resource group.

Question 7

A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the RG-App scope.. Option B is correct because the required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.

Answer

Assign the built-in Virtual Machine Contributor role at the subscription scope.

Answer

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Answer

Assign the built-in Contributor role at the resource group scope.

Question 8

A finance department shares a resource group containing a critical VM and a storage account. Administrators must still be able to update settings and apply patches, but no one should accidentally delete the resources. Which lock should be applied at the resource group level?

Accepted Answer

CanNotDelete lock.. The CanNotDelete lock (option B) is correct because it prevents users from deleting the resource group or its resources, while still allowing read and update operations. This meets the requirement that administrators can update settings and apply patches, but accidental deletion is blocked. ReadOnly locks would block all write operations, including patching, which is too restrictive for this scenario.

Answer

ReadOnly lock, because it is the most restrictive option.

Answer

A policy assignment that denies delete operations.

Answer

No lock, because RBAC permissions already prevent deletion.

Question 9

A finance team stores application blobs in an Azure Storage account. The data must remain available if a single availability zone in the region is lost, and the team does not need automatic read access from another region. Which redundancy option best meets the requirement?

Accepted Answer

Zone-redundant storage (ZRS), which replicates data across availability zones in the same region.. Zone-redundant storage (ZRS) replicates your data synchronously across three Azure availability zones within the primary region. This ensures that if a single zone fails, the data remains available and durable without requiring any manual intervention or failover, meeting the requirement of no automatic read access from another region.

Answer

Locally redundant storage (LRS), which keeps three copies in one datacenter only.

Answer

Geo-redundant storage (GRS), which replicates data to a paired region and supports failover.

Answer

Read-access geo-redundant storage (RA-GRS), which allows reads from the secondary region.

Question 10

A hub VNet already has a VPN gateway connected to on-premises networks. A new spoke VNet must reach those on-premises networks through the existing gateway without deploying another gateway. Which peering settings are required?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. Option A is correct because to allow a spoke VNet to use the hub VNet's VPN gateway without deploying its own, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to route traffic destined for on-premises networks through the hub's VPN gateway, leveraging the existing site-to-site VPN connection.

Answer

Enable forwarded traffic on both peerings and leave gateway settings disabled.

Answer

Enable use remote gateways on the hub peering and gateway transit on the spoke peering.

Answer

Create a private endpoint between the two VNets.

Question 11

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials instead of a storage account key. The organization already has domain-joined Windows servers in the environment. What should the administrator configure on the storage account?

Accepted Answer

Enable Azure Files identity-based authentication with Active Directory Domain Services.. Option A is correct because Azure Files supports identity-based authentication over SMB using Active Directory Domain Services (AD DS). By enabling this on the storage account, the administrator can mount the file share using existing domain credentials instead of a storage account key, provided the client VM is domain-joined and the share is configured with appropriate NTFS permissions. This eliminates the need to manage or expose storage account keys.

Answer

Enable blob soft delete and mount the share with a blob container SAS token.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Create a shared access signature for the file share and map it as a local drive.

Question 12

An archive team stores legal exhibits in Azure Blob Storage. The files are downloaded only during quarterly audits, but when an auditor needs one, it must be readable immediately without waiting for a rehydration job. The team wants the lowest practical cost after the first 30 days and does not want to move blobs manually each quarter. What should the administrator configure?

Accepted Answer

Use a lifecycle management rule to move the blobs to Cool tier after 30 days.. Option B is correct because Azure Blob Storage lifecycle management rules can automatically move blobs from Hot to Cool tier after 30 days, reducing storage costs while keeping data immediately accessible. Cool tier offers lower storage costs than Hot tier with the same low-latency read access, satisfying the requirement for instant auditor access without manual intervention.

Answer

Keep the blobs in Hot tier permanently and delete them manually after each audit cycle.

Answer

Move the blobs to Archive tier after 30 days and rehydrate them when audits begin.

Answer

Store the files in Premium block blob storage and use snapshots for audit recovery.

Question 13

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 14

A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Accepted Answer

Create a private endpoint for the storage account in the subnet. A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.

Answer

Enable blob versioning on the storage account

Answer

Assign a ReadOnly lock to the storage account

Answer

Enable a shared access signature

Question 15

A media company stores project video assets in Azure Blob Storage. The business requires the data to survive a single availability zone outage in the primary region. In addition, if the primary region becomes unavailable, operations staff must still be able to read the most recently replicated copy from the secondary region right away, even if writes are temporarily unavailable. Which redundancy option best meets this requirement?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region to survive a single availability zone outage, and geo-redundant storage (GRS) to replicate data to a secondary region. The 'RA' prefix enables read access to the secondary region immediately after a primary region failure, allowing operations staff to read the most recently replicated copy even if writes are temporarily unavailable.

Answer

ZRS

Answer

GZRS

Answer

RA-GRS