AZ-104 Implement and Manage Storage Practice Test 9 — 15 Questions

Question 1

A partner organization needs write access to a single blob container for 24 hours. You want to avoid sharing the storage account key and minimize access scope. Which access mechanism should you provide?

Accepted Answer

A user delegation SAS. A user delegation SAS is the correct choice because it provides time-limited, delegated access to a specific blob container using Azure AD credentials, without exposing the storage account key. It allows you to grant write access for exactly 24 hours to a single container, minimizing the access scope as required.

Answer

A storage account key

Answer

A container stored access policy without a token

Answer

An Azure Policy assignment

Question 2

A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity for the app and grant it a storage data role. Option B is correct because a system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Azure AD authentication, eliminating the need for passwords or access keys.

Answer

Store the storage account key in the app configuration and use it from the application

Answer

Create an anonymous public container so the app can upload without authentication

Answer

Use a shared access signature generated from the storage account root key

Question 3

An administrator moved old log blobs to the Archive tier last month. An auditor now needs one blob for review later today. What must happen before the blob can be opened?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool (rehydrate it), which can take up to 15 hours depending on the rehydration priority. Only after rehydration completes can the blob be downloaded and opened.

Answer

Download the blob directly from the Archive tier and open it immediately

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Copy the blob to another container without changing its tier

Question 4

An analytics platform stores daily export files in Azure Blob Storage. The business wants the storage account to survive a failure of any one availability zone and also keep a replicated copy in a paired region for disaster recovery. No one needs to read from the secondary region unless a disaster recovery event occurs. Which redundancy option should be used?

Accepted Answer

GZRS. C is correct because GZRS (Geo-Zone-Redundant Storage) combines zone-redundant storage (ZRS) within the primary region, ensuring the storage account survives any single availability zone failure, with geo-redundant replication to a paired region for disaster recovery. The secondary region copy is read-only unless a failover is initiated, matching the requirement that no one reads from the secondary region unless a disaster recovery event occurs.

Answer

ZRS

Answer

GRS

Answer

RA-GRS

Question 5

An administrator moved a blob to the Archive tier last month. A user needs to open it tomorrow. What must happen before the file can be read?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. To read a blob in the Archive tier, it must first be rehydrated to the Hot or Cool tier. This process, called rehydration, changes the blob's tier and makes it accessible for reading. Until rehydration completes, the blob remains offline and cannot be read.

Answer

Create a snapshot of the archived blob

Answer

Enable versioning on the storage account

Answer

Move the storage account to LRS redundancy

Question 6

An analytics team stores exported reports in a storage account. They want the data to survive a zone failure and a regional outage, and if the primary region becomes unavailable they also want read-only access to the replica while failover is being planned. Which redundancy option should you select?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region with geo-redundant replication to a secondary region, and crucially provides read-only access to the secondary replica even when the primary region is available. This meets the requirement for data survival during both a zone failure and a regional outage, while allowing read-only access to the replica during failover planning.

Answer

GZRS

Answer

RA-GRS

Answer

ZRS

Question 7

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key, and the access should expire automatically. Which access method should you use?

Accepted Answer

Shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. You can set an expiry time of 12 hours, and the SAS token can be generated with only the permissions needed (e.g., write). Once the token expires, access is automatically revoked, meeting the requirement for automatic expiration.

Answer

Role assignment in Azure RBAC

Answer

Private endpoint

Answer

Storage account lock

Question 8

A storage account must be accessible only from one virtual network, and the storage service must have a private IP address inside that network. Public network access should be disabled. Which solution should the administrator use?

Accepted Answer

Create a private endpoint for the storage account in the virtual network. Option C is correct because a private endpoint assigns the storage account a private IP address from the virtual network's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone. This ensures the storage account is accessible only from that virtual network and allows public network access to be disabled, meeting both requirements.

Answer

Add a storage firewall rule that allows the subnet's public IP range

Answer

Configure a service endpoint for the subnet and keep public access enabled

Answer

Peer the virtual network to the storage account's region

Question 9

A partner company needs to upload files to a single blob container for the next 24 hours. The partner should not receive the storage account key, and the access should be limited to that container only. Which access mechanism should you provide?

Accepted Answer

A container-level SAS token with write permission and a 24-hour expiry.. A container-level SAS token with write permission and a 24-hour expiry is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. The SAS token is generated with the container as the resource scope, write permission (add/create), and an expiry time of 24 hours, meeting all requirements: no key sharing, container-only access, and time-bound access.

Answer

The storage account key, because it is easier for external users to use.

Answer

A management group role assignment, because RBAC can restrict access to one blob container.

Answer

A private endpoint, because it grants the partner write access over a private IP.

Question 10

An Azure Files share must stay available if one availability zone in its primary region fails. The business does not need replication to another region. Which redundancy option should you choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates your Azure Files share across three Azure availability zones within the primary region. This ensures the share remains available if one zone fails, without requiring replication to another region. LRS only replicates within a single data center, while GRS and RA-GRS involve secondary region replication, which the business does not need.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 11

A reporting team stores read-only analytics files in Azure Blob Storage. The files must replicate to a paired region so they survive a regional outage, and analysts want to read the secondary copy through the secondary endpoint without waiting for failover. Which redundancy option should the administrator choose?

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is the correct choice because it replicates data to a paired secondary region (geo-redundancy) and enables read access to the secondary copy via the secondary endpoint without requiring a failover. This meets the requirement for both regional disaster recovery and immediate read access to the secondary copy.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 12

A company hosts documents in Azure Blob Storage. The files must remain available if one availability zone in the region fails. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it stores copies across multiple availability zones in the region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for high availability within a single region without relying on a secondary region.

Answer

LRS, because it keeps three copies within one datacenter.

Answer

GRS, because it automatically makes the account available in another region for reads.

Answer

RA-GRS, because it is the only option that keeps a secondary copy.

Question 13

A development subnet must access an Azure Storage account privately, but the security team does not want to create a private IP in the VNet. They only want the subnet identity to be extended to the storage service. Which feature should the administrator configure?

Accepted Answer

Service endpoint. A service endpoint extends the VNet identity to the Azure Storage service, allowing traffic from the subnet to reach the storage account over the Azure backbone network without requiring a private IP. This meets the requirement of private access without creating a private IP in the VNet, as the subnet's identity is used for access control via the storage account firewall.

Answer

Private endpoint

Answer

Azure Front Door

Answer

Network security group outbound rule

Question 14

A media archive stores large video files that must survive a zone failure in the primary region and also be replicated to a paired region for disaster recovery. The archive team does not want anyone to read from the secondary region during normal operations, and cost should be lower than the read-access variant. Which redundancy option should you configure?

Accepted Answer

GZRS, because it adds zone redundancy and geo-replication without enabling secondary read access.. GZRS (Geo-Zone-Redundant Storage) is correct because it combines zone redundancy (three copies across availability zones in the primary region) with geo-replication to a paired secondary region, but crucially does not enable read access to the secondary region by default. This satisfies the requirement to survive a zone failure, provide disaster recovery to a paired region, and prevent reads from the secondary during normal operations, all at a lower cost than RA-GRS which includes secondary read access.

Answer

LRS, because it keeps copies in a single datacenter and is the lowest-cost option.

Answer

ZRS, because it protects against zone failures but not regional outages.

Answer

RA-GRS, because the read-access copy is needed whenever data is replicated to another region.

Question 15

A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. The identity is automatically managed by Azure AD, and the App Service can use it to obtain an OAuth 2.0 token for accessing blob storage via RBAC. This eliminates the need for manual credential rotation and secret storage.

Answer

A storage account access key stored in Key Vault

Answer

A shared access signature embedded in the application settings

Answer

A service endpoint on the App Service integration subnet