AZ-104 Implement and Manage Storage Practice Test 5 — 15 Questions

Question 1

Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?

Accepted Answer

Assign Storage Blob Data Reader at the invoices container scope.. Assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.

Answer

Assign Reader at the storage account scope so John can view the storage account and its data.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Make the invoices container public and keep John's existing Contributor role.

Question 2

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 3

A reporting system requires a storage account that is zone resilient in the primary region and also keeps a geo-replicated secondary copy that can be read during an outage. Which redundancy option should you select?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous replication across three Azure availability zones in the primary region for zone resilience, asynchronous geo-replication to a secondary region for disaster recovery, and enables read access to the secondary copy during an outage. This meets all three requirements: zone resiliency, geo-replication, and readable secondary region.

Answer

ZRS, because it protects against zone failure and also provides a readable secondary region.

Answer

GRS, because it stores a secondary copy in another region but does not offer zone redundancy in the primary region.

Answer

LRS, because local replication is enough when the workload already has application-level retries.

Question 4

A lifecycle rule moves blobs to the archive tier after 90 days. A file was archived 2 weeks ago, and a reporting job now needs to read it tomorrow morning. What should you expect?

Accepted Answer

The file must be rehydrated to an online tier before it can be read, so access is delayed.. Blobs in the Azure Archive tier are offline and cannot be read directly. To access the data, you must first rehydrate the blob to an online tier (Hot, Cool, or Cold) using a copy or change-tier operation, which introduces a delay (typically up to 15 hours for standard priority rehydration). The file was archived only 2 weeks ago, so it is still in the Archive tier and requires rehydration before the reporting job can read it tomorrow morning.

Answer

The file is immediately readable, but only through the archive endpoint and at a higher request rate.

Answer

The file is permanently deleted when it enters archive, so the job must use a backup restore.

Answer

The file can be read immediately if the account has read-access geo-redundancy enabled.

Question 5

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 6

A company has 15 branch Windows file servers that must show the same shared drive content. Users should keep working during short WAN outages, and local servers should cache frequently used files. Which Azure feature should you deploy?

Accepted Answer

Azure File Sync, because it synchronizes on-premises file servers with an Azure file share and supports cloud tiering.. Azure File Sync is the correct choice because it synchronizes on-premises Windows file servers with an Azure file share, enabling multi-site file server consolidation. It supports cloud tiering, which caches frequently accessed files locally on each branch server while freeing up space by tiering cold data to the cloud. This ensures users can continue working during short WAN outages, as local caches provide access to synced files even when connectivity is lost.

Answer

Azure Blob Storage with lifecycle rules, because it can present files to multiple branches.

Answer

A private endpoint to Blob Storage, because it provides local caching for SMB file shares.

Answer

A managed disk shared across the branch servers, because it gives the same content to all locations.

Question 7

An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.

Accepted Answer

Create a user-assigned managed identity that can be attached to both Azure resources.. Option A is correct because a user-assigned managed identity can be attached to multiple Azure resources, such as both the Function App and the Automation runbook, allowing them to authenticate to Azure Storage without storing any secrets in code or configuration. Option B is correct because Storage Blob Data Contributor is the least-privileged built-in role that grants the required upload, read, and delete operations on blobs, and scoping it to the target container limits access to only that container. Option C is incorrect because storing the storage account access key in app settings and runbook variables uses stored secrets, which the scenario explicitly forbids. Option D is incorrect because the Contributor role is a control-plane role that does not grant blob data-plane permissions and is broader than necessary. Option E is incorrect because a non-expiring shared SAS token is a stored secret and violates the requirement to avoid stored secrets and minimize permissions.

Answer

Store the storage account access key in both app settings and runbook variables.

Answer

Assign Contributor on the storage account because it automatically includes all blob data permissions.

Answer

Use a shared SAS token without an expiration date for both workloads.

Question 8

Match each blob access method or setting to its best use case.

Accepted Answer

Public endpoint with anonymous access: Best use case for public content accessible without authentication. Public endpoint with anonymous access is for public content. Private endpoint with managed identity provides secure VM access. SAS tokens grant time-limited restricted access. Microsoft Entra ID with RBAC centralizes identity management. Storage account key gives full admin control. Immutable storage with legal hold ensures data cannot be altered or deleted.

Answer

Private endpoint with managed identity: Best use case for public internet access from VMs

Answer

Immutable storage with legal hold: Best use case for temporary data that can be deleted

Question 9

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.

Question 10

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.

Question 11

Match each Azure Storage redundancy option to the best description.

Accepted Answer

LRS: Data is replicated three times within a single data center.. Each redundancy option provides increasing durability and availability: LRS is lowest cost, ZRS protects against zone failure, GRS adds geo-replication, RA-GRS allows read from secondary, GZRS combines zone and geo, RA-GZRS adds read access to secondary.

Answer

RA-GRS: Data is replicated across availability zones and also to a secondary region with read access from secondary.

Answer

RA-GZRS: Data is replicated to a secondary region and supports read access from that secondary.

Question 12

Before changing a managed data disk on a production VM, you want a point-in-time copy that you can keep and restore later if needed. What should you create?

Accepted Answer

A managed disk snapshot. A managed disk snapshot captures a point-in-time, read-only copy of a managed disk. You can use it to restore the VM to that exact state by creating a new disk from the snapshot and attaching it to the VM. Snapshots are independent of the source disk's lifecycle, so you can keep them indefinitely for backup or recovery purposes.

Answer

An availability set

Answer

A load balancer backend pool

Answer

A resource lock

Question 13

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 14

A data-processing app reads blobs immediately after upload, and operations do not want any rehydration delay. Which three access tiers can be read directly? Select three.

Accepted Answer

Hot. The Hot, Cool, and Cold access tiers are designed for online data access, meaning blobs stored in these tiers can be read immediately without any rehydration delay. This is because the data is always stored on high-throughput, low-latency media and is immediately available for read operations. In contrast, the Archive tier requires a rehydration process (which can take hours) before data can be accessed, making it unsuitable for scenarios where blobs must be read immediately after upload.

Answer