AZ-104 Implement and Manage Storage Practice Test 9 — 15 Questions

Question 1

A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable shared key access on the storage account. Disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.

Answer

Rotate the storage account keys every 24 hours

Answer

Require secure transfer for the storage account

Answer

Create a private endpoint for the storage account

Question 2

A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key, and the access token should keep working even if the storage account keys are rotated later. Which access mechanism should be issued?

Accepted Answer

A user delegation SAS signed through Microsoft Entra authentication. A user delegation SAS is signed with Microsoft Entra credentials rather than the storage account key, so it remains valid even if the storage account keys are rotated. This meets the requirement to avoid sharing the account key while providing temporary, scoped access for exactly six hours. The contractor can upload files without the administrator exposing the account key or needing to manage key rotation.

Answer

An account SAS signed with the storage account key

Answer

A service SAS signed with the storage account key

Answer

The storage account access key itself in a temporary script variable

Question 3

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Blob Storage account over a private IP, and the storage account must not accept public network traffic. Which configuration should the administrator deploy?

Accepted Answer

A private endpoint for the storage account in an Azure VNet reachable through the VPN.. A private endpoint assigns the storage account a private IP from an Azure VNet, making it accessible over the site-to-site VPN without traversing the public internet. This satisfies the requirement for private IP access and allows the storage account to block all public network traffic by disabling public network access in the firewall settings.

Answer

A service endpoint on the on-premises network and a storage account firewall exception.

Answer

A NAT gateway on the subnet that hosts the storage account.

Answer

An application security group applied to the storage account.

Question 4

A user deleted a nested folder tree from an Azure file share yesterday. Other folders in the share were updated after the deletion and must not be rolled back. Which two actions should the administrator take? Select two.

Accepted Answer

Open a snapshot taken before the deletion.. Azure file share snapshots provide a point-in-time, read-only copy of the entire share. By opening a snapshot taken before the deletion, the administrator can browse the exact folder tree as it existed at that time. Option C is correct because the administrator can copy only the deleted folder tree from the snapshot back into the live share, leaving all other folders (including those updated after the deletion) intact.

Answer

Restore the entire file share from the latest snapshot.

Answer

Convert the file share to the Hot access tier.

Answer

Delete the newer folders so the share matches the snapshot exactly.

Question 5

Based on the exhibit, what should the administrator configure to meet the storage access requirement?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that subnet on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to be routed directly to the storage account over the Azure backbone network, bypassing the internet. By then configuring the storage account firewall to allow access only from that subnet, the administrator ensures that only resources within AppSubnet can access the storage account, meeting the requirement for restricted access.

Answer

Create a private endpoint and disable all public network access.

Answer

Create a VPN gateway between the subnet and the storage account.

Answer

Attach a NAT gateway to the subnet and add a route table entry.

Question 6

A web app currently accesses Azure Blob Storage by using the storage account key in a connection string. Security now requires blocking any new requests that use shared key authorization, while Microsoft Entra-based access must continue to work. Which storage account setting should the administrator change?

Accepted Answer

Disable shared key authorization on the storage account.. Disabling shared key authorization on the storage account explicitly blocks all requests that use the storage account key (shared key) for authentication, while still allowing requests authenticated via Microsoft Entra ID (formerly Azure AD). This directly meets the security requirement to block new requests using shared key authorization without affecting Entra-based access.

Answer

Set the storage account network access to selected networks only.

Answer

Rotate the account keys and leave all authentication methods enabled.

Answer

Enable object replication for the storage account.

Question 7

A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

Accepted Answer

A shared access signature scoped to the container and expiration time. A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.

Answer

A new storage account access key

Answer

A management group assignment

Answer

A private endpoint for the contractor

Question 8

A healthcare application stores files that must be protected against a single datacenter outage in the region. The team does not need a secondary region for read access, and they want the simplest resilient option. Which storage redundancy should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, protecting against a complete datacenter outage without requiring a secondary region. This meets the requirement for the simplest resilient option that guards against a single datacenter failure while avoiding the complexity and cost of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-zone-redundant storage (GZRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 9

A blob was moved to the Archive tier last month. A user now needs to open the file within a few hours. What should the administrator do first?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool, which initiates a rehydration process that makes the blob available for reading. Since the user needs the file within a few hours, rehydration typically completes within that timeframe (up to 15 hours for Archive to Cool/Hot).

Answer

Download the blob directly from the Archive tier

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Enable versioning on the storage account

Question 10

A legal department stores project video assets in Azure Blob Storage. The files are reviewed only during quarterly audits, but when someone needs a file it must open immediately without waiting for rehydration. Which access tier should the administrator use for the blobs?

Accepted Answer

Cool, because it is for infrequent access while still keeping blobs online and immediately available.. The Cool access tier is designed for data that is infrequently accessed but must remain immediately available (online) without any rehydration delay. Since the legal department needs instant access during quarterly audits, Cool meets the requirement of low retrieval cost while keeping blobs online, unlike Archive which requires hours-long rehydration.

Answer

Hot, because it is optimized for frequent access and always costs the least to retrieve.

Answer

Archive, because it is the cheapest choice for data that is rarely used and can be restored instantly.

Answer

Premium, because it is intended for workload bursts and gives the best long-term storage economics.

Question 11

A reporting application stores files in Azure Blob Storage. The business wants the secondary region to be readable if the primary region becomes unavailable. Which redundancy option should you use?

Accepted Answer

RA-GRS, because it provides geo-replication with read access to the secondary endpoint.. (RA-GRS) is correct because it provides geo-replication by asynchronously copying data to a secondary region and enables read access to that secondary endpoint. If the primary region becomes unavailable, the application can continue reading from the secondary region, meeting the business requirement for readable secondary access during a primary outage.

Answer

LRS, because it stores all copies in one region only.

Answer

ZRS, because it replicates across availability zones.

Answer

Archive, because archived blobs are stored cheaply for long-term retention.

Question 12

A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Accepted Answer

Create a user delegation SAS with write permission and a short expiration time. A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Microsoft Entra ID credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.

Answer

Grant the partner Contributor access on the storage account

Answer

Share the storage account access key and let the partner create their own token

Answer

Enable anonymous public write access on the container

Question 13

A compliance team keeps signed contract scans in blob storage. The files are usually not accessed, but when they are needed they must be available immediately without waiting for rehydration. The team wants the lowest-cost online tier that still allows immediate reads. Which access tier should you choose?

Accepted Answer

Cold. The Cold tier (C) is correct because it is the lowest-cost online access tier that provides immediate read access without requiring rehydration. Unlike the Archive tier, Cold tier data is always online and can be read instantly, while still offering lower storage costs than Cool or Hot tiers for data that is rarely accessed.

Answer

Hot

Answer

Cool

Answer