AZ-104 Implement and Manage Storage Practice Test 7 — 15 Questions

Question 1

A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a file share snapshot and copy the deleted folder tree back into the live share.. Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.

Answer

Delete the current share and restore the whole share from the most recent backup.

Answer

Change the share’s access tier from Hot to Cool and then refresh the folder view.

Answer

Enable soft delete for blobs in the same storage account and recover the folder from there.

Question 2

A legal department archived a 120-GB blob three weeks ago. They now need the file available for review later today, and waiting more than a day would delay a court filing. What should the administrator do to make the blob readable as quickly as possible?

Accepted Answer

Start rehydration from Archive and choose High priority.. Rehydrating a blob from the Archive tier with High priority typically makes the blob readable within 1 hour, meeting the urgent same-day requirement. The Archive tier is offline, so the blob must be rehydrated (changed to an online tier like Hot or Cool) before it can be accessed. High-priority rehydration is designed for time-sensitive scenarios like this court filing deadline.

Answer

Copy the blob to a new container and leave it in the Archive tier until the users need it.

Answer

Change the access tier from Archive directly to Cool and then download the blob immediately.

Answer

Enable soft delete on the container and restore the blob from deleted items.

Question 3

A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.. Assigning the Storage Blob Data Reader role to the managed identity enables Azure RBAC-based, secretless access to blobs. This aligns with the requirement to use managed identities for authentication, eliminating the need for keys or SAS tokens. Option B is correct because disabling shared key access on the storage account enforces the security policy that no future requests can authenticate using shared keys, while the managed identity continues to work via Azure AD authentication.

Answer

Generate a service SAS and place it in an app setting.

Answer

Rotate the storage account keys weekly.

Answer

Grant Reader access to the resource group because it includes the storage account.

Question 4

An archive of legal documents is accessed only a few times each month, but when someone needs a document it must open immediately without a rehydration wait. Which access tier should be used?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must be available immediately when needed, with a lower storage cost than Hot tier but higher access costs. Since the archive is accessed only a few times per month and requires instant retrieval without rehydration delay, Cool tier meets both requirements, whereas Archive tier would impose a rehydration wait of up to 15 hours.

Answer

Hot tier

Answer

Archive tier

Answer

Geo-redundant storage (GRS)

Question 5

A blob was moved to the Archive tier last month. A project team now needs the file available later today, and they expect to read it several times during review. What should the administrator do first?

Accepted Answer

Start a rehydration request and move the blob to the Hot tier with high priority.. A blob in the Archive tier is offline and must be rehydrated (changed to Hot or Cool) before it can be accessed. Using high-priority rehydration ensures the blob becomes available within 1 hour, which meets the requirement for later today. The Hot tier is appropriate since the team expects to read the blob several times, providing low-latency access without incurring read costs from Cool tier.

Answer

Copy the blob directly from Archive to a local machine and reopen it there.

Answer

Change the blob to the Cool tier immediately and expect it to become available within minutes.

Answer

Create a lifecycle rule to move the blob back to Hot automatically on the next day.

Question 6

A compliance team wants newly uploaded monthly reports to remain in the Hot tier for 90 days and then move automatically to a cheaper online tier without becoming offline. Which two configurations should the administrator use? Select two.

Accepted Answer

Create a blob lifecycle management rule.. Azure Blob Lifecycle Management rules allow administrators to automate tier transitions for blobs based on age or other conditions. Option B is correct because transitioning from Hot to Cool after 90 days meets the requirement of moving to a cheaper online tier (Cool is online and less expensive than Hot) while keeping the data accessible without becoming offline.

Answer

Transition the blobs to Archive after 90 days so they cost less than Cool.

Answer

Use file share snapshots because lifecycle rules do not apply to blobs.

Answer

Enable soft delete on the container to change access tiers automatically.

Question 7

A company has an Azure Storage account that stores application files in Blob Storage. VMs in AppSubnet must access the blobs by using the standard storage account name, but traffic must stay private and the public endpoint must not be used. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the blob service in AppSubnet.. A private endpoint assigns the blob service a private IP address from the AppSubnet, allowing VMs to access the storage account using the standard storage account name (e.g., mystorageaccount.blob.core.windows.net) while keeping all traffic within the Microsoft Azure backbone network and bypassing the public endpoint entirely. This satisfies the requirement that traffic must stay private and the public endpoint must not be used.

Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.

Answer

Generate a shared access signature and email it to the VMs.

Answer

Add a virtual network rule to the storage account and keep the public endpoint open.

Question 8

A finance team stores monthly invoice PDFs in Azure and wants the data to remain available if an entire availability zone in the region fails. They do not need read access to a secondary region, and they want to keep the storage service simple. Which redundancy option should they choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS), because it replicates data across zones in the same region.. Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within the same region, ensuring durability even if an entire zone fails. This meets the requirement for intra-region zone failure protection without needing a secondary region, and it keeps the storage service simple by avoiding the complexity of geo-replication.

Answer

Locally redundant storage (LRS), because it protects against a single disk failure inside one datacenter.

Answer

Geo-redundant storage (GRS), because it automatically provides the lowest-cost cross-region protection.

Answer

Geo-zone-redundant storage (GZRS), because it is required whenever zone resilience is needed.

Question 9

A 180-GB blob was moved to the Archive tier last week. A legal team now needs the file available later today for repeated review, and they are willing to pay more to shorten the wait. Which action should the administrator take first?

Accepted Answer

Rehydrate the blob to Hot tier by using High priority.. The Archive tier requires rehydration (changing the blob tier) before the data can be accessed. Rehydrating to the Hot tier with High priority is the fastest method, typically completing within 1 hour, which meets the legal team's need for later today. Standard priority rehydration can take up to 15 hours, making it too slow for the required timeline.

Answer

Rehydrate the blob to Cool tier by using Standard priority.

Answer

Copy the blob into another Archive tier container and wait for replication.

Answer

Change the storage account redundancy to ZRS so the blob becomes accessible faster.

Question 10

A legal team archived a 200-GB blob last quarter. They now need to open it repeatedly later today for review, and waiting more than a day would delay the case. Which two actions should the administrator take? Select two.

Accepted Answer

Start a rehydration request and target the Hot tier.. Rehydrating a blob from the Archive tier to the Hot tier makes it accessible for frequent reads. The Hot tier is optimized for high-frequency access, which matches the legal team's need to open the blob repeatedly later today. Rehydration is the only way to change the blob's tier from Archive to an online tier like Hot.

Answer

Copy the blob directly while it remains in the Archive tier.

Answer

Change the blob back to the Archive tier after the request starts.

Answer

Take a snapshot first and expect it to make the archived blob readable immediately.

Question 11

A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.

Answer

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Answer

A shared access signature that is limited to the subnet.

Answer

Storage account access keys, because they bind access to one subnet automatically.

Question 12

A legal team stores archived case files in Azure Blob Storage. The files are rarely read, but they must remain online and available immediately when needed. Which access tier should the administrator use?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must remain online with low-latency retrieval. Archived case files that are rarely read but need immediate availability fit this profile, as Cool tier offers lower storage costs than Hot tier while still providing millisecond access times.

Answer

Hot tier

Answer

Archive tier

Answer

Premium tier

Question 13

A developer can access an Azure Blob container from the portal using Microsoft Entra sign-in, but their custom app gets a 403 error when reading the same blob. The storage account is configured to use Azure AD authorization. What is the most likely fix?

Accepted Answer

Assign the user the Storage Blob Data Reader role on the container or storage account.. The developer can authenticate via the portal because the portal uses the user's own Microsoft Entra identity, which may have implicit permissions (e.g., via group membership or subscription-level Reader). However, the custom app must explicitly be granted the Storage Blob Data Reader role on the container or storage account to authorize data plane operations (reading blobs). Without this role assignment, the app's identity lacks the RBAC permission to perform blob read operations, resulting in a 403 error.

Answer

Assign the user the Reader role on the subscription.

Answer

Enable shared key access so the app can bypass Azure AD permissions.

Answer

Move the container to the Hot tier so Azure AD authentication can succeed.

Question 14

A batch job fails with a blob read error after the administrator moved a 200-GB blob to the archive tier. The file must be available again within a few hours, and the administrator wants the least disruptive recovery. What should be done?

Accepted Answer

Change the blob tier to Hot or Cool and wait for the rehydration process to finish.. Moving a blob to the archive tier makes it offline; to read it, you must first rehydrate it by changing the tier to Hot or Cool. Rehydration typically completes within a few hours (up to 15 hours for archive), meeting the requirement. This is the least disruptive method as it avoids data loss or additional uploads.

Answer

Delete the archived blob and upload a new copy from backup.

Answer

Enable soft delete on the storage account and retry the read operation.

Answer

Convert the storage account to premium performance.

Question 15

A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall.. A service endpoint extends the virtual network private address space to the storage account, allowing traffic from the specified subnet to reach the storage account via the Azure backbone while keeping the public endpoint accessible. By adding a virtual network rule on the storage account firewall, you restrict access to only traffic originating from that subnet, meeting the requirement of allowing only that subnet through the public endpoint.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Place the subnet behind a NAT gateway and use a shared public IP.

Answer

Add a VPN gateway and route storage traffic through the branch office.