AZ-104 Implement and Manage Storage Practice Test 6 — 15 Questions

Question 1

A finance department stores spreadsheets in an Azure file share. Yesterday a user deleted a subfolder tree, but other folders were modified after that point and must not be rolled back. The administrator wants to restore only the deleted subfolder tree to its state from yesterday. What should the administrator use?

Accepted Answer

Use the Azure Files snapshot taken before the deletion and copy back only the required folders.. Option B is correct because Azure Files supports snapshot-based restore at the share level. By taking a snapshot before the deletion, the administrator can mount that snapshot as a read-only copy of the share, then copy back only the deleted subfolder tree without affecting any modifications made to other folders after the snapshot was taken. This meets the requirement of restoring only the deleted content while preserving later changes.

Answer

Restore the entire share from Azure Backup to the yesterday recovery point.

Answer

Enable blob soft delete on the storage account and then recover the folders.

Answer

Create a new file share and use synchronization to merge the deleted content.

Question 2

An application uploads documents by using one of the storage account access keys. The team wants to rotate keys without interrupting uploads. Which process should the administrator follow?

Accepted Answer

Switch the app to the secondary key, regenerate the primary key, and then update the app back later.. Option B is correct because it follows the safe key rotation pattern: switch the application to use the secondary key, regenerate the primary key (which invalidates the old primary key), and then later update the application back to the primary key if desired. This ensures the application never loses access during the rotation, as it always has a valid key in use.

Answer

Regenerate both keys at the same time so the account is fully refreshed.

Answer

Disable shared key authorization before rotating the keys.

Answer

Delete the storage account and create a new one with the same name.

Question 3

A monthly report file must automatically move to a cheaper online tier after 90 days in Azure Blob Storage. Which feature should the administrator configure?

Accepted Answer

Blob lifecycle management. Blob lifecycle management is the correct feature because it allows administrators to define rules that automatically transition blobs to a cheaper access tier (e.g., from Hot to Cool) after a specified number of days. This policy operates at the storage account or container level and can move data to the Cool or Archive tier based on age, meeting the requirement of moving the report file after 90 days without manual intervention.

Answer

Archive rehydration policy

Answer

Snapshot retention

Answer

Storage account failover

Question 4

A Windows file server VM must mount an Azure file share by using domain credentials instead of a storage account key. The organization already manages users in Active Directory Domain Services. Which authentication option should be configured for Azure Files?

Accepted Answer

Identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined Windows VMs to mount Azure file shares using their existing domain credentials instead of a storage account key. This enables Kerberos-based authentication and preserves NTFS permissions, meeting the requirement to avoid shared key access.

Answer

Shared key authentication, because it is the default for Azure file shares.

Answer

A service SAS created for the share and mapped as a network drive.

Answer

Anonymous access with public network restrictions disabled.

Question 5

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.

Question 6

A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?

Accepted Answer

Use a file share snapshot and copy the deleted folder tree back into the live share.. Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.

Answer

Delete the current share and restore the whole share from the most recent backup.

Answer

Change the share’s access tier from Hot to Cool and then refresh the folder view.

Answer

Enable soft delete for blobs in the same storage account and recover the folder from there.

Question 7

A legal department archived a 120-GB blob three weeks ago. They now need the file available for review later today, and waiting more than a day would delay a court filing. What should the administrator do to make the blob readable as quickly as possible?

Accepted Answer

Start rehydration from Archive and choose High priority.. Option B is correct because rehydrating a blob from the Archive tier with High priority typically makes the blob readable within 1 hour, meeting the urgent same-day requirement. The Archive tier is offline, so the blob must be rehydrated (changed to an online tier like Hot or Cool) before it can be accessed. High-priority rehydration is designed for time-sensitive scenarios like this court filing deadline.

Answer

Copy the blob to a new container and leave it in the Archive tier until the users need it.

Answer

Change the access tier from Archive directly to Cool and then download the blob immediately.

Answer

Enable soft delete on the container and restore the blob from deleted items.

Question 8

A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.. Option A is correct because assigning the Storage Blob Data Reader role to the managed identity enables Azure RBAC-based, secretless access to blobs. This aligns with the requirement to use managed identities for authentication, eliminating the need for keys or SAS tokens. Option B is correct because disabling shared key access on the storage account enforces the security policy that no future requests can authenticate using shared keys, while the managed identity continues to work via Azure AD authentication.

Answer

Generate a service SAS and place it in an app setting.

Answer

Rotate the storage account keys weekly.

Answer

Grant Reader access to the resource group because it includes the storage account.

Question 9

An archive of legal documents is accessed only a few times each month, but when someone needs a document it must open immediately without a rehydration wait. Which access tier should be used?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must be available immediately when needed, with a lower storage cost than Hot tier but higher access costs. Since the archive is accessed only a few times per month and requires instant retrieval without rehydration delay, Cool tier meets both requirements, whereas Archive tier would impose a rehydration wait of up to 15 hours.

Answer

Hot tier

Answer

Archive tier

Answer

Geo-redundant storage (GRS)

Question 10

A blob was moved to the Archive tier last month. A project team now needs the file available later today, and they expect to read it several times during review. What should the administrator do first?

Accepted Answer

Start a rehydration request and move the blob to the Hot tier with high priority.. Option B is correct because a blob in the Archive tier is offline and must be rehydrated (changed to Hot or Cool) before it can be accessed. Using high-priority rehydration ensures the blob becomes available within 1 hour, which meets the requirement for later today. The Hot tier is appropriate since the team expects to read the blob several times, providing low-latency access without incurring read costs from Cool tier.

Answer

Copy the blob directly from Archive to a local machine and reopen it there.

Answer

Change the blob to the Cool tier immediately and expect it to become available within minutes.

Answer

Create a lifecycle rule to move the blob back to Hot automatically on the next day.

Question 11

A compliance team wants newly uploaded monthly reports to remain in the Hot tier for 90 days and then move automatically to a cheaper online tier without becoming offline. Which two configurations should the administrator use? Select two.

Accepted Answer

Create a blob lifecycle management rule.. Option A is correct because Azure Blob Lifecycle Management rules allow administrators to automate tier transitions for blobs based on age or other conditions. Option B is correct because transitioning from Hot to Cool after 90 days meets the requirement of moving to a cheaper online tier (Cool is online and less expensive than Hot) while keeping the data accessible without becoming offline.

Answer

Transition the blobs to Archive after 90 days so they cost less than Cool.

Answer

Use file share snapshots because lifecycle rules do not apply to blobs.

Answer

Enable soft delete on the container to change access tiers automatically.

Question 12

A 180-GB blob is in the Archive tier. A legal team needs the file available later today and expects to open it several times during review. Which two actions should the administrator take? Select two.

Accepted Answer

Initiate rehydration of the blob to the Hot tier.. Rehydrating the blob from Archive to Hot tier makes it immediately accessible for frequent reads, as the Hot tier is optimized for high access rates. The legal team needs to open the file several times later today, so Hot tier is appropriate. Option A is correct because it explicitly initiates the rehydration process to a tier that supports frequent access.

Answer

Leave the blob in Archive and rely on first access to trigger rehydration.

Answer

Copy the blob to a new container and keep it in Archive.

Answer

Apply a lifecycle rule that moves the blob to Cool after rehydration completes.

Question 13

A company has an Azure Storage account that stores application files in Blob Storage. VMs in AppSubnet must access the blobs by using the standard storage account name, but traffic must stay private and the public endpoint must not be used. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the blob service in AppSubnet.. Option A is correct because a private endpoint assigns the blob service a private IP address from the AppSubnet, allowing VMs to access the storage account using the standard storage account name (e.g., mystorageaccount.blob.core.windows.net) while keeping all traffic within the Microsoft Azure backbone network and bypassing the public endpoint entirely. This satisfies the requirement that traffic must stay private and the public endpoint must not be used.

Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.

Answer

Generate a shared access signature and email it to the VMs.

Answer

Add a virtual network rule to the storage account and keep the public endpoint open.

Question 14

A finance team stores monthly invoice PDFs in Azure and wants the data to remain available if an entire availability zone in the region fails. They do not need read access to a secondary region, and they want to keep the storage service simple. Which redundancy option should they choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS), because it replicates data across zones in the same region.. Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within the same region, ensuring durability even if an entire zone fails. This meets the requirement for intra-region zone failure protection without needing a secondary region, and it keeps the storage service simple by avoiding the complexity of geo-replication.

Answer

Locally redundant storage (LRS), because it protects against a single disk failure inside one datacenter.

Answer

Geo-redundant storage (GRS), because it automatically provides the lowest-cost cross-region protection.

Answer

Geo-zone-redundant storage (GZRS), because it is required whenever zone resilience is needed.

Question 15

A 180-GB blob was moved to the Archive tier last week. A legal team now needs the file available later today for repeated review, and they are willing to pay more to shorten the wait. Which action should the administrator take first?

Accepted Answer

Rehydrate the blob to Hot tier by using High priority.. The Archive tier requires rehydration (changing the blob tier) before the data can be accessed. Rehydrating to the Hot tier with High priority is the fastest method, typically completing within 1 hour, which meets the legal team's need for later today. Standard priority rehydration can take up to 15 hours, making it too slow for the required timeline.

Answer

Rehydrate the blob to Cool tier by using Standard priority.

Answer

Copy the blob into another Archive tier container and wait for replication.

Answer

Change the storage account redundancy to ZRS so the blob becomes accessible faster.