AZ-104 Implement and Manage Storage Practice Test 5 — 15 Questions

Question 1

Match each Azure Storage redundancy option to the best description.

Accepted Answer

LRS: Data is replicated three times within a single data center.. Each redundancy option provides increasing durability and availability: LRS is lowest cost, ZRS protects against zone failure, GRS adds geo-replication, RA-GRS allows read from secondary, GZRS combines zone and geo, RA-GZRS adds read access to secondary.

Answer

RA-GRS: Data is replicated across availability zones and also to a secondary region with read access from secondary.

Answer

RA-GZRS: Data is replicated to a secondary region and supports read access from that secondary.

Question 2

Before changing a managed data disk on a production VM, you want a point-in-time copy that you can keep and restore later if needed. What should you create?

Accepted Answer

A managed disk snapshot. A managed disk snapshot captures a point-in-time, read-only copy of a managed disk. You can use it to restore the VM to that exact state by creating a new disk from the snapshot and attaching it to the VM. Snapshots are independent of the source disk's lifecycle, so you can keep them indefinitely for backup or recovery purposes.

Answer

An availability set

Answer

A load balancer backend pool

Answer

A resource lock

Question 3

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 4

A data-processing app reads blobs immediately after upload, and operations do not want any rehydration delay. Which three access tiers can be read directly? Select three.

Accepted Answer

Hot. The Hot, Cool, and Cold access tiers are designed for online data access, meaning blobs stored in these tiers can be read immediately without any rehydration delay. This is because the data is always stored on high-throughput, low-latency media and is immediately available for read operations. In contrast, the Archive tier requires a rehydration process (which can take hours) before data can be accessed, making it unsuitable for scenarios where blobs must be read immediately after upload.

Answer

Archive

Answer

Premium

Question 5

A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?

Accepted Answer

Assign a managed identity to the app and grant it storage permissions. Azure Managed Identity provides an automatically managed service principal in Azure AD, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Azure AD token to securely access the blob container.

Answer

Embed the storage account key in the application settings

Answer

Use the public endpoint and anonymous access

Answer

Use an archive tier for the container

Question 6

A company wants its file share data to be automatically copied to a paired Azure region, and administrators want to read the secondary copy during a disaster test. Which redundancy option should they use?

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is correct because it replicates data to a paired secondary region asynchronously and provides read-only access to that secondary copy. This allows administrators to read the secondary copy during a disaster test without impacting the primary region. ZRS and LRS do not replicate to a paired region, and Cool is a tier, not a redundancy option.

Answer

ZRS

Answer

LRS

Answer

Cool

Question 7

A help desk engineer must be able to start, stop, and resize only VM-App01. The engineer must not gain access to any other virtual machines or resource groups in the subscription. What scope should you use for the Azure RBAC role assignment?

Accepted Answer

Assign the role at the virtual machine scope for VM-App01 only.. Azure RBAC allows you to assign a role at the virtual machine scope, which restricts permissions to that specific resource only. By assigning a role like 'Virtual Machine Contributor' at the scope of VM-App01, the help desk engineer can start, stop, and resize only that VM without gaining access to any other VMs or resource groups in the subscription.

Answer

Assign the role at the subscription scope so the engineer can manage any VM in the subscription.

Answer

Assign the role at the resource group scope that contains VM-App01.

Answer

Assign the role at a management group scope so the team can standardize access.

Question 8

An engineering team stores build artifacts that are downloaded every day by developers for a week after release, then rarely after that. Which tier should the administrator choose for the period when the artifacts are still actively used?

Accepted Answer

Hot. The Hot tier is the correct choice for the period when build artifacts are actively used because it provides the lowest access latency and highest throughput, which is essential for daily downloads by developers. Azure Blob Storage's Hot tier is optimized for frequent access patterns (e.g., multiple times per day) and incurs no data retrieval costs, making it cost-effective for this high-access phase.

Answer

Archive

Answer

Cool

Answer

Cold

Question 9

A legal team stores scanned contracts in Blob Archive. Auditors will need to open several files next week for about five days and then the documents should return to the lowest practical storage cost. Which two actions should the administrator plan? Select two.

Accepted Answer

Initiate a rehydration to the Cool tier before the review window.. Blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to a hot or cool tier. Rehydrating to the Cool tier is appropriate for a five-day access window and avoids the higher cost of the Hot tier. After the review, moving the blobs back to Archive (Option D) ensures the lowest practical storage cost for long-term retention.

Answer

Download the blobs directly from Archive with a normal read operation.

Answer

Set the blobs to the Hot tier permanently as soon as the review starts.

Answer

Change the storage account redundancy to RA-GRS so the files can be read.

Question 10

A finance department wants several Windows virtual machines to map the same shared drive letter and work with the same files at the same time. Which Azure Storage service should you configure?

Accepted Answer

Azure Files share. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, allowing multiple Windows VMs to mount the same share with a consistent drive letter (e.g., Z:) and access the same files concurrently. This meets the finance department's requirement for shared access with a mapped drive letter, which Azure Blob storage cannot provide because it uses REST APIs rather than SMB.

Answer

Azure Blob container

Answer

Archive blob tier

Answer

Storage account access key only

Question 11

A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account.. A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.

Answer

A service endpoint on the subnet.

Answer

A public IP address with an NSG inbound allow rule.

Answer

A VPN gateway connection to the storage account.

Question 12

A team stores application logs in an Azure Storage account. The logs must remain available if an entire Azure availability zone in the primary region has an outage, but the team does not require a secondary region copy. Which redundancy option should you choose?

Accepted Answer

ZRS. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region, ensuring durability even if an entire zone fails. Since the requirement explicitly states no secondary region copy is needed, ZRS is the correct choice because it provides intra-region zone-level resilience without cross-region replication.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 13

A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Accepted Answer

Issue a shared access signature with read-only permissions and an expiration time. A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.

Answer

Create a new managed identity for the contractor

Answer

Give the contractor the storage account access key

Answer

Enable anonymous public access on the container

Question 14

A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Accepted Answer

Add a storage network rule for the subnet or use a private endpoint. Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.

Answer

Enable anonymous blob access

Answer

Move the container to the Archive tier

Answer

Assign the Contributor role to the subnet

Question 15

A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?

Accepted Answer

A service SAS scoped to the container with write permission and an expiry time in six hours.. A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.

Answer

The storage account access key, because it is easier to revoke later.

Answer

A shared key rotation policy, because it grants time-limited access to one container.

Answer

A user-assigned managed identity assigned to the contractor’s laptop.