AZ-104 Implement and Manage Storage Practice Test 9 — 15 Questions

Question 1

A legal department stores project video assets in Azure Blob Storage. The files are reviewed only during quarterly audits, but when someone needs a file it must open immediately without waiting for rehydration. Which access tier should the administrator use for the blobs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cool, because it is for infrequent access while still keeping blobs online and immediately available.. The Cool access tier is designed for data that is infrequently accessed but must remain immediately available (online) without any rehydration delay. Since the legal department needs instant access during quarterly audits, Cool meets the requirement of low retrieval cost while keeping blobs online, unlike Archive which requires hours-long rehydration.

Answer

Hot, because it is optimized for frequent access and always costs the least to retrieve.

Answer

Archive, because it is the cheapest choice for data that is rarely used and can be restored instantly.

Answer

Premium, because it is intended for workload bursts and gives the best long-term storage economics.

Question 2

A reporting application stores files in Azure Blob Storage. The business wants the secondary region to be readable if the primary region becomes unavailable. Which redundancy option should you use?

Accepted Answer

RA-GRS, because it provides geo-replication with read access to the secondary endpoint.. (RA-GRS) is correct because it provides geo-replication by asynchronously copying data to a secondary region and enables read access to that secondary endpoint. If the primary region becomes unavailable, the application can continue reading from the secondary region, meeting the business requirement for readable secondary access during a primary outage.

Answer

LRS, because it stores all copies in one region only.

Answer

ZRS, because it replicates across availability zones.

Answer

Archive, because archived blobs are stored cheaply for long-term retention.

Question 3

A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Accepted Answer

Create a user delegation SAS with write permission and a short expiration time. A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Azure AD credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.

Answer

Grant the partner Contributor access on the storage account

Answer

Share the storage account access key and let the partner create their own token

Answer

Enable anonymous public write access on the container

Question 4

A compliance team keeps signed contract scans in blob storage. The files are usually not accessed, but when they are needed they must be available immediately without waiting for rehydration. The team wants the lowest-cost online tier that still allows immediate reads. Which access tier should you choose?

Accepted Answer

Cold. The Cold tier (C) is correct because it is the lowest-cost online access tier that provides immediate read access without requiring rehydration. Unlike the Archive tier, Cold tier data is always online and can be read instantly, while still offering lower storage costs than Cool or Hot tiers for data that is rarely accessed.

Answer

Hot

Answer

Cool

Answer

Archive

Question 5

A storage account must be accessible only from one Azure subnet. The security team does not want a private endpoint or private DNS zone, and they are fine with the storage account continuing to use its public FQDN. Which configuration should you use?

Accepted Answer

Create a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the Azure Storage service, allowing the storage account firewall to restrict access to traffic originating from the specific subnet. This meets the requirement of limiting access to one Azure subnet without using a private endpoint or DNS zone, and the storage account continues to use its public FQDN.

Answer

Create a private endpoint for the storage account and disable public network access.

Answer

Use an NSG rule to allow only the subnet to reach port 443 on the storage account.

Answer

Associate a route table that sends storage traffic to an Azure firewall appliance.

Question 6

A partner organization needs write access to a single blob container for 24 hours. You want to avoid sharing the storage account key and minimize access scope. Which access mechanism should you provide?

Accepted Answer

A user delegation SAS. A user delegation SAS is the correct choice because it provides time-limited, delegated access to a specific blob container using Azure AD credentials, without exposing the storage account key. It allows you to grant write access for exactly 24 hours to a single container, minimizing the access scope as required.

Answer

A storage account key

Answer

A container stored access policy without a token

Answer

An Azure Policy assignment

Question 7

A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity for the app and grant it a storage data role. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Azure AD authentication, eliminating the need for passwords or access keys.

Answer

Store the storage account key in the app configuration and use it from the application

Answer

Create an anonymous public container so the app can upload without authentication

Answer

Use a shared access signature generated from the storage account root key

Question 8

An administrator moved old log blobs to the Archive tier last month. An auditor now needs one blob for review later today. What must happen before the blob can be opened?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool (rehydrate it), which can take up to 15 hours depending on the rehydration priority. Only after rehydration completes can the blob be downloaded and opened.

Answer

Download the blob directly from the Archive tier and open it immediately

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Copy the blob to another container without changing its tier

Question 9

An analytics platform stores daily export files in Azure Blob Storage. The business wants the storage account to survive a failure of any one availability zone and also keep a replicated copy in a paired region for disaster recovery. No one needs to read from the secondary region unless a disaster recovery event occurs. Which redundancy option should be used?

Accepted Answer

GZRS. C is correct because GZRS (Geo-Zone-Redundant Storage) combines zone-redundant storage (ZRS) within the primary region, ensuring the storage account survives any single availability zone failure, with geo-redundant replication to a paired region for disaster recovery. The secondary region copy is read-only unless a failover is initiated, matching the requirement that no one reads from the secondary region unless a disaster recovery event occurs.

Answer

ZRS

Answer

GRS

Answer

RA-GRS

Question 10

An administrator moved a blob to the Archive tier last month. A user needs to open it tomorrow. What must happen before the file can be read?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. To read a blob in the Archive tier, it must first be rehydrated to the Hot or Cool tier. This process, called rehydration, changes the blob's tier and makes it accessible for reading. Until rehydration completes, the blob remains offline and cannot be read.

Answer

Create a snapshot of the archived blob

Answer

Enable versioning on the storage account

Answer

Move the storage account to LRS redundancy

Question 11

An analytics team stores exported reports in a storage account. They want the data to survive a zone failure and a regional outage, and if the primary region becomes unavailable they also want read-only access to the replica while failover is being planned. Which redundancy option should you select?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region with geo-redundant replication to a secondary region, and crucially provides read-only access to the secondary replica even when the primary region is available. This meets the requirement for data survival during both a zone failure and a regional outage, while allowing read-only access to the replica during failover planning.

Answer

GZRS

Answer

RA-GRS

Answer

ZRS

Question 12

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key, and the access should expire automatically. Which access method should you use?

Accepted Answer

Shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. You can set an expiry time of 12 hours, and the SAS token can be generated with only the permissions needed (e.g., write). Once the token expires, access is automatically revoked, meeting the requirement for automatic expiration.

Answer

Role assignment in Azure RBAC

Answer

Private endpoint

Answer

Storage account lock

Question 13

A storage account must be accessible only from one virtual network, and the storage service must have a private IP address inside that network. Public network access should be disabled. Which solution should the administrator use?

Accepted Answer

Create a private endpoint for the storage account in the virtual network. A private endpoint assigns the storage account a private IP address from the virtual network's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone. This ensures the storage account is accessible only from that virtual network and allows public network access to be disabled, meeting both requirements.

Answer

Add a storage firewall rule that allows the subnet's public IP range

Answer

Configure a service endpoint for the subnet and keep public access enabled

Answer

Peer the virtual network to the storage account's region

Question 14

A partner company needs to upload files to a single blob container for the next 24 hours. The partner should not receive the storage account key, and the access should be limited to that container only. Which access mechanism should you provide?

Accepted Answer

A container-level SAS token with write permission and a 24-hour expiry.. A container-level SAS token with write permission and a 24-hour expiry is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. The SAS token is generated with the container as the resource scope, write permission (add/create), and an expiry time of 24 hours, meeting all requirements: no key sharing, container-only access, and time-bound access.

Answer

The storage account key, because it is easier for external users to use.

Answer

A management group role assignment, because RBAC can restrict access to one blob container.

Answer

A private endpoint, because it grants the partner write access over a private IP.

Question 15

An Azure Files share must stay available if one availability zone in its primary region fails. The business does not need replication to another region. Which redundancy option should you choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates your Azure Files share across three Azure availability zones within the primary region. This ensures the share remains available if one zone fails, without requiring replication to another region. LRS only replicates within a single data center, while GRS and RA-GRS involve secondary region replication, which the business does not need.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)