AZ-104 Implement and Manage Storage Practice Test 7 — 15 Questions

Question 1

A legal team archived a 200-GB blob last quarter. They now need to open it repeatedly later today for review, and waiting more than a day would delay the case. Which two actions should the administrator take? Select two.

Accepted Answer

Start a rehydration request and target the Hot tier.. Option A is correct because rehydrating a blob from the Archive tier to the Hot tier makes it accessible for frequent reads. The Hot tier is optimized for high-frequency access, which matches the legal team's need to open the blob repeatedly later today. Rehydration is the only way to change the blob's tier from Archive to an online tier like Hot.

Answer

Copy the blob directly while it remains in the Archive tier.

Answer

Change the blob back to the Archive tier after the request starts.

Answer

Take a snapshot first and expect it to make the archived blob readable immediately.

Question 2

A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.

Answer

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Answer

A shared access signature that is limited to the subnet.

Answer

Storage account access keys, because they bind access to one subnet automatically.

Question 3

A legal team stores archived case files in Azure Blob Storage. The files are rarely read, but they must remain online and available immediately when needed. Which access tier should the administrator use?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must remain online with low-latency retrieval. Archived case files that are rarely read but need immediate availability fit this profile, as Cool tier offers lower storage costs than Hot tier while still providing millisecond access times.

Answer

Hot tier

Answer

Archive tier

Answer

Premium tier

Question 4

A developer can access an Azure Blob container from the portal using Microsoft Entra sign-in, but their custom app gets a 403 error when reading the same blob. The storage account is configured to use Azure AD authorization. What is the most likely fix?

Accepted Answer

Assign the user the Storage Blob Data Reader role on the container or storage account.. The developer can authenticate via the portal because the portal uses the user's own Microsoft Entra identity, which may have implicit permissions (e.g., via group membership or subscription-level Reader). However, the custom app must explicitly be granted the Storage Blob Data Reader role on the container or storage account to authorize data plane operations (reading blobs). Without this role assignment, the app's identity lacks the RBAC permission to perform blob read operations, resulting in a 403 error.

Answer

Assign the user the Reader role on the subscription.

Answer

Enable shared key access so the app can bypass Azure AD permissions.

Answer

Move the container to the Hot tier so Azure AD authentication can succeed.

Question 5

A batch job fails with a blob read error after the administrator moved a 200-GB blob to the archive tier. The file must be available again within a few hours, and the administrator wants the least disruptive recovery. What should be done?

Accepted Answer

Change the blob tier to Hot or Cool and wait for the rehydration process to finish.. Option B is correct because moving a blob to the archive tier makes it offline; to read it, you must first rehydrate it by changing the tier to Hot or Cool. Rehydration typically completes within a few hours (up to 15 hours for archive), meeting the requirement. This is the least disruptive method as it avoids data loss or additional uploads.

Answer

Delete the archived blob and upload a new copy from backup.

Answer

Enable soft delete on the storage account and retry the read operation.

Answer

Convert the storage account to premium performance.

Question 6

An on-premises ERP server connected to Azure through a site-to-site VPN must read and write blobs in a storage account by using the storage account's private IP address. Public network access must be blocked. Which storage configuration should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Option B is correct because a private endpoint assigns the storage account a private IP address from the on-premises subnet (connected via VPN), enabling the ERP server to communicate with the storage account over the private network. Disabling public network access ensures that all traffic must traverse the private endpoint, blocking any internet-based access. This meets the requirement of using the storage account's private IP address while preventing public exposure.

Answer

Configure a service endpoint on the on-premises subnet and leave public access enabled.

Answer

Issue a container SAS and publish the storage account public DNS name.

Answer

Enable SMB multichannel on the storage account.

Question 7

A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall.. Option B is correct because a service endpoint extends the virtual network private address space to the storage account, allowing traffic from the specified subnet to reach the storage account via the Azure backbone while keeping the public endpoint accessible. By adding a virtual network rule on the storage account firewall, you restrict access to only traffic originating from that subnet, meeting the requirement of allowing only that subnet through the public endpoint.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Place the subnet behind a NAT gateway and use a shared public IP.

Answer

Add a VPN gateway and route storage traffic through the branch office.

Question 8

A user accidentally deleted a folder tree from an Azure file share. The administrator needs to restore only the deleted folders to the state they had yesterday, not roll back the whole share. Which feature should be used?

Accepted Answer

Use a file share snapshot and copy the needed folders back from it.. Azure file share snapshots provide a point-in-time, read-only copy of the share. By mounting a snapshot taken yesterday, the administrator can browse the folder tree and copy only the deleted folders back to the live share, restoring them without affecting other data. This is the only option that allows granular, folder-level recovery without rolling back the entire share or storage account.

Answer

Restore the entire storage account from an account-level backup.

Answer

Enable blob versioning on the storage account and recover the folders from versions.

Answer

Create a shared access signature with read permissions and use it to recover the folder tree.

Question 9

A records archive stores thousands of blobs that are usually read-only. The administrator wants blobs older than 90 days to move automatically to a lower-cost online tier without manual intervention. Which solution should be configured?

Accepted Answer

Create a blob lifecycle management policy with a rule that moves blobs after 90 days.. Option B is correct because Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost access tier (e.g., from Hot to Cool or from Cool to Archive) based on the age of the blob. In this scenario, a rule can be configured to move blobs older than 90 days to the Cool or Archive tier without any manual intervention, meeting the requirement for automated cost optimization.

Answer

Manually change each blob tier when the archive team remembers to review it.

Answer

Enable object replication so the blobs are copied to another storage account.

Answer

Move the account to the Archive access tier and leave it there permanently.

Question 10

A finance application stores monthly invoice PDFs in Azure Blob Storage. The business wants the data to remain available if one availability zone in the region becomes unavailable, but it does not require a secondary region for read access. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it replicates data across zones in the same region and stays available through a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring that if one zone becomes unavailable, the data remains accessible from the other zones. This meets the business requirement of staying available during a zone outage without needing a secondary region for read access.

Answer

LRS, because it keeps three copies within a single datacenter and is the least expensive option.

Answer

GRS, because it keeps a readable copy in the paired region and is always the best choice for resilience.

Answer

RA-GRS, because it provides read access to the secondary region and is required for zone-level resilience.

Question 11

A finance team stores monthly reports in Azure Blob Storage. The data must remain available if one datacenter in the Azure region fails, but the company does not need read access from a secondary region. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, ensuring durability even if one datacenter (zone) fails. Since the requirement specifies no need for read access from a secondary region, ZRS meets the high-availability need without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 12

A finance application stores monthly invoice PDFs in Azure Blob Storage. The data must survive a single availability zone outage in the region, and the storage account must be reachable only through a private IP from AppSubnet. Public network access must not be available. Which three actions should the administrator take? Select three.

Accepted Answer

Create the storage account with zone-redundant storage (ZRS).. Option A is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring data durability even if one entire zone fails. This meets the requirement to survive a single availability zone outage.

Answer

Use locally redundant storage (LRS) because it stays inside one datacenter.

Answer

Enable a service endpoint on AppSubnet instead of using a private endpoint.

Question 13

A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?

Accepted Answer

Azure Files identity-based authentication using Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.

Answer

Shared key authorization, because it is the only method supported by Azure Files.

Answer

A user delegation SAS, because it maps the share automatically to domain accounts.

Answer

Anonymous access, because Windows file servers can mount Azure shares without authentication.

Question 14

An application team plans to store block blobs for application logs, lifecycle them to cooler tiers over time, and use Azure Monitor diagnostic exports from several Azure resources into the same storage account. They also want access tier controls and general-purpose features in one place. Which storage account type should the administrator create?

Accepted Answer

StorageV2 general-purpose account, because it supports blobs, tiering, and broad Azure integrations.. A StorageV2 general-purpose account (B) is the correct choice because it supports block blobs, lifecycle management policies for tiering to cool, cold, and archive tiers, and integrates seamlessly with Azure Monitor diagnostic exports. Unlike specialized accounts, StorageV2 provides a unified platform for blobs, files, queues, and tables, meeting the team's need for access tier controls and general-purpose features in one place.

Answer

BlobStorage account, because it is optimized for storing only unstructured blobs.

Answer

FileStorage account, because it supports any Azure diagnostic data format and access tiers.

Answer

BlockBlobStorage account, because it is required whenever logs are exported from Azure Monitor.

Question 15

A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Accepted Answer

Disable shared key access on the storage account. Option B is correct because disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.

Answer

Rotate the storage account keys every 24 hours

Answer

Require secure transfer for the storage account

Answer

Create a private endpoint for the storage account