AZ-104 Implement and Manage Storage Practice Test 8 — 15 Questions

Question 1

A user accidentally deleted a folder tree from an Azure file share. The administrator needs to restore only the deleted folders to the state they had yesterday, not roll back the whole share. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a file share snapshot and copy the needed folders back from it.. Azure file share snapshots provide a point-in-time, read-only copy of the share. By mounting a snapshot taken yesterday, the administrator can browse the folder tree and copy only the deleted folders back to the live share, restoring them without affecting other data. This is the only option that allows granular, folder-level recovery without rolling back the entire share or storage account.

Answer

Restore the entire storage account from an account-level backup.

Answer

Enable blob versioning on the storage account and recover the folders from versions.

Answer

Create a shared access signature with read permissions and use it to recover the folder tree.

Question 2

A records archive stores thousands of blobs that are usually read-only. The administrator wants blobs older than 90 days to move automatically to a lower-cost online tier without manual intervention. Which solution should be configured?

Accepted Answer

Create a blob lifecycle management policy with a rule that moves blobs after 90 days.. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost access tier (e.g., from Hot to Cool or from Cool to Archive) based on the age of the blob. In this scenario, a rule can be configured to move blobs older than 90 days to the Cool or Archive tier without any manual intervention, meeting the requirement for automated cost optimization.

Answer

Manually change each blob tier when the archive team remembers to review it.

Answer

Enable object replication so the blobs are copied to another storage account.

Answer

Move the account to the Archive access tier and leave it there permanently.

Question 3

A finance application stores monthly invoice PDFs in Azure Blob Storage. The business wants the data to remain available if one availability zone in the region becomes unavailable, but it does not require a secondary region for read access. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it replicates data across zones in the same region and stays available through a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring that if one zone becomes unavailable, the data remains accessible from the other zones. This meets the business requirement of staying available during a zone outage without needing a secondary region for read access.

Answer

LRS, because it keeps three copies within a single datacenter and is the least expensive option.

Answer

GRS, because it keeps a readable copy in the paired region and is always the best choice for resilience.

Answer

RA-GRS, because it provides read access to the secondary region and is required for zone-level resilience.

Question 4

A finance team stores monthly reports in Azure Blob Storage. The data must remain available if one datacenter in the Azure region fails, but the company does not need read access from a secondary region. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, ensuring durability even if one datacenter (zone) fails. Since the requirement specifies no need for read access from a secondary region, ZRS meets the high-availability need without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 5

A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?

Accepted Answer

Azure Files identity-based authentication using Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.

Answer

Shared key authorization, because it is the only method supported by Azure Files.

Answer

A user delegation SAS, because it maps the share automatically to domain accounts.

Answer

Anonymous access, because Windows file servers can mount Azure shares without authentication.

Question 6

An application team plans to store block blobs for application logs, lifecycle them to cooler tiers over time, and use Azure Monitor diagnostic exports from several Azure resources into the same storage account. They also want access tier controls and general-purpose features in one place. Which storage account type should the administrator create?

Accepted Answer

StorageV2 general-purpose account, because it supports blobs, tiering, and broad Azure integrations.. A StorageV2 general-purpose account (B) is the correct choice because it supports block blobs, lifecycle management policies for tiering to cool, cold, and archive tiers, and integrates seamlessly with Azure Monitor diagnostic exports. Unlike specialized accounts, StorageV2 provides a unified platform for blobs, files, queues, and tables, meeting the team's need for access tier controls and general-purpose features in one place.

Answer

BlobStorage account, because it is optimized for storing only unstructured blobs.

Answer

FileStorage account, because it supports any Azure diagnostic data format and access tiers.

Answer

BlockBlobStorage account, because it is required whenever logs are exported from Azure Monitor.

Question 7

A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Accepted Answer

Disable shared key access on the storage account. Disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.

Answer

Rotate the storage account keys every 24 hours

Answer

Require secure transfer for the storage account

Answer

Create a private endpoint for the storage account

Question 8

A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key, and the access token should keep working even if the storage account keys are rotated later. Which access mechanism should be issued?

Accepted Answer

A user delegation SAS signed through Microsoft Entra authentication. A user delegation SAS is signed with Microsoft Entra credentials rather than the storage account key, so it remains valid even if the storage account keys are rotated. This meets the requirement to avoid sharing the account key while providing temporary, scoped access for exactly six hours. The contractor can upload files without the administrator exposing the account key or needing to manage key rotation.

Answer

An account SAS signed with the storage account key

Answer

A service SAS signed with the storage account key

Answer

The storage account access key itself in a temporary script variable

Question 9

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Blob Storage account over a private IP, and the storage account must not accept public network traffic. Which configuration should the administrator deploy?

Accepted Answer

A private endpoint for the storage account in an Azure VNet reachable through the VPN.. A private endpoint assigns the storage account a private IP from an Azure VNet, making it accessible over the site-to-site VPN without traversing the public internet. This satisfies the requirement for private IP access and allows the storage account to block all public network traffic by disabling public network access in the firewall settings.

Answer

A service endpoint on the on-premises network and a storage account firewall exception.

Answer

A NAT gateway on the subnet that hosts the storage account.

Answer

An application security group applied to the storage account.

Question 10

A user deleted a nested folder tree from an Azure file share yesterday. Other folders in the share were updated after the deletion and must not be rolled back. Which two actions should the administrator take? Select two.

Accepted Answer

Open a snapshot taken before the deletion.. Azure file share snapshots provide a point-in-time, read-only copy of the entire share. By opening a snapshot taken before the deletion, the administrator can browse the exact folder tree as it existed at that time. Option C is correct because the administrator can copy only the deleted folder tree from the snapshot back into the live share, leaving all other folders (including those updated after the deletion) intact.

Answer

Restore the entire file share from the latest snapshot.

Answer

Convert the file share to the Hot access tier.

Answer

Delete the newer folders so the share matches the snapshot exactly.

Question 11

Based on the exhibit, what should the administrator configure to meet the storage access requirement?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that subnet on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to be routed directly to the storage account over the Azure backbone network, bypassing the internet. By then configuring the storage account firewall to allow access only from that subnet, the administrator ensures that only resources within AppSubnet can access the storage account, meeting the requirement for restricted access.

Answer

Create a private endpoint and disable all public network access.

Answer

Create a VPN gateway between the subnet and the storage account.

Answer

Attach a NAT gateway to the subnet and add a route table entry.

Question 12

A web app currently accesses Azure Blob Storage by using the storage account key in a connection string. Security now requires blocking any new requests that use shared key authorization, while Microsoft Entra-based access must continue to work. Which storage account setting should the administrator change?

Accepted Answer

Disable shared key authorization on the storage account.. Disabling shared key authorization on the storage account explicitly blocks all requests that use the storage account key (shared key) for authentication, while still allowing requests authenticated via Microsoft Entra ID (formerly Azure AD). This directly meets the security requirement to block new requests using shared key authorization without affecting Entra-based access.

Answer

Set the storage account network access to selected networks only.

Answer

Rotate the account keys and leave all authentication methods enabled.

Answer

Enable object replication for the storage account.

Question 13

A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

Accepted Answer

A shared access signature scoped to the container and expiration time. A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.

Answer

A new storage account access key

Answer

A management group assignment

Answer

A private endpoint for the contractor

Question 14

A healthcare application stores files that must be protected against a single datacenter outage in the region. The team does not need a secondary region for read access, and they want the simplest resilient option. Which storage redundancy should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, protecting against a complete datacenter outage without requiring a secondary region. This meets the requirement for the simplest resilient option that guards against a single datacenter failure while avoiding the complexity and cost of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-zone-redundant storage (GZRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 15

A blob was moved to the Archive tier last month. A user now needs to open the file within a few hours. What should the administrator do first?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool, which initiates a rehydration process that makes the blob available for reading. Since the user needs the file within a few hours, rehydration typically completes within that timeframe (up to 15 hours for Archive to Cool/Hot).

Answer

Download the blob directly from the Archive tier

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Enable versioning on the storage account