AZ-204 Develop for Azure storage Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?

Accepted Answer

Read, write, and delete access to blobs in container c1.. The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.

Answer

Full management access to the storage account.

Answer

Read access to all containers in the storage account.

Answer

Read-only access to blobs in container c1.

Question 2

You are a developer for a healthcare company that stores patient diagnostic images in Azure Blob Storage. The images are uploaded by medical devices and must be retained for 7 years due to regulatory requirements. After 7 years, the data must be permanently deleted. The images are accessed infrequently after the first month. You need to design a storage lifecycle management policy to minimize costs while meeting compliance. The storage account uses general-purpose v2 with LRS. The container is named 'diagnostics'. Which of the following policies should you implement?

Accepted Answer

Move blobs to Cool tier after 30 days, move to Archive tier after 90 days, and delete after 7 years.. It aligns with the access pattern: blobs are moved to the Cool tier after 30 days (when infrequent access begins), then to the Archive tier after 90 days for long-term, low-cost storage, and finally deleted after 7 years to meet regulatory retention and deletion requirements. This minimizes costs by using the most cost-effective tier for each stage of the data lifecycle.

Answer

Move blobs to Cool tier after 30 days, and delete after 30 days.

Answer

Move blobs to Archive tier immediately after upload, and delete after 7 years.

Answer

Move blobs to Cool tier after 1 year, and delete after 7 years.

Question 3

You are developing a real-time analytics application that ingests IoT sensor data every second. The data is written to Azure Blob Storage as small JSON files (each ~1 KB). The application also needs to query the data based on device ID and timestamp. You need to design a storage solution that allows efficient querying without writing custom code for indexing. You have decided to use Azure Data Lake Storage Gen2. What should you do to optimize query performance?

Accepted Answer

Use a folder structure like /deviceid/yyyy/mm/dd/hh/ and set the device ID as the partition key.. Azure Data Lake Storage Gen2 supports hierarchical namespaces, which allow you to organize data into folders and subfolders. By structuring the path as /deviceid/yyyy/mm/dd/hh/, you effectively partition the data by device ID and time, enabling efficient querying with tools like Azure Synapse or PolyBase without custom indexing. This leverages the directory structure as a natural partition key, minimizing the data scanned during queries.

Answer

Use Append Blobs to combine small writes into larger blobs.

Answer

Store all JSON files in a single folder and use Azure Data Lake Analytics to query.

Answer

Store the data in Azure SQL Database instead of Blob Storage.

Question 4

You have an application that stores user profile pictures in Azure Blob Storage. Users upload images via a web app. You need to ensure that the images are served securely over HTTPS and that only authenticated users can access them. The web app uses Azure App Service with built-in authentication. You want to avoid storing any access keys in the web app's configuration. What should you do to grant the web app access to the blobs?

Accepted Answer

Enable system-assigned managed identity on the App Service and assign the 'Storage Blob Data Reader' role on the blob container.. Enabling a system-assigned managed identity on the App Service allows it to authenticate to Azure Storage without storing any credentials. By assigning the 'Storage Blob Data Reader' role on the blob container, the web app can securely access blobs using Microsoft Entra ID authentication, which is the recommended approach for server-side access. This avoids storing access keys or SAS tokens in configuration, meeting the security requirement.

Answer

Store the storage account access key in the web app's configuration.

Answer

Enable anonymous public read access on the blob container.

Answer

Generate a SAS token with long expiration and store it in the web app's configuration.

Question 5

You develop an application that stores large binary files (up to 1 GB) in Azure Blob Storage. The application must minimize latency when reading these files from different geographic regions. The files are updated infrequently (once per month) and must be read-only for the application. You need to configure the storage account for optimal read performance and cost. What should you use?

Accepted Answer

Use Azure Blob Storage with read-access geo-redundant storage (RA-GRS) and serve reads from the secondary region.. Read-access geo-redundant storage (RA-GRS) provides a secondary read-only endpoint in a paired region, allowing the application to read from the closest region to minimize latency. Since files are updated infrequently (once per month) and are read-only, RA-GRS offers cost-effective geo-distributed read performance without the premium cost of CDN or Premium Blob Storage.

Answer

Use Azure Blob Storage with Premium Block Blob Storage and enable geo-replication.

Answer

Use Azure Blob Storage with a Content Delivery Network (CDN) endpoint.

Answer

Use Azure Files with a Premium tier and geo-redundant storage.

Question 6

You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?

Accepted Answer

Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.. Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.

Answer

Use Azure Information Protection to encrypt the blobs with a customer-managed key.

Answer

Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.

Answer

Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.

Question 7

You need to implement a solution for storing and retrieving large amounts of unstructured data (e.g., images, videos, backups) in Azure, with high durability and availability. The solution must allow access from anywhere via HTTP/HTTPS and support both public and private access. Which TWO Azure storage services should you consider?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Blob Storage is purpose-built for storing large amounts of unstructured data such as images, videos, and backups, offering high durability (99.9999999999% with RA-GRS) and availability. It supports access via HTTP/HTTPS from anywhere, and provides both public (anonymous) and private (SAS tokens, RBAC) access controls, making it the primary choice for this scenario.

Answer

Azure Table Storage

Answer

Azure Queue Storage

Answer

Azure Files

Question 8

You are designing a data archiving solution for compliance. Data must be stored for 7 years, with immediate deletion prohibited until the retention period expires. The solution must minimize storage costs while ensuring data is not modifiable. Which THREE Azure features should you combine?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is the correct foundational service because it supports immutable storage, which enforces a WORM (Write Once, Read Many) policy. This ensures data cannot be modified or deleted during the retention period, meeting compliance requirements. Combined with time-based retention policies and cool/archive tiers, it provides a cost-effective, unmodifiable archive solution.

Answer

Azure Files

Answer

Azure Backup

Question 9

Refer to the exhibit. You are analyzing the Azure Blob Storage service properties configured for a storage account. A web application hosted at https://www.contoso.com attempts to make a PUT request to a blob. The request fails with a CORS error. What is the most likely cause?

Accepted Answer

The request's Origin header does not match the allowed origin.. The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request. Since the question states the request fails with a CORS error and the exhibit shows allowed origins that do not include https://www.contoso.com, this is the most likely cause.

Answer

The request includes a header that is not in the allowed headers list.

Answer

The CORS rule does not include the DELETE method.

Answer

The exposedHeaders list does not include a required response header.

Question 10

Your company develops a REST API for a global e-commerce platform that stores product images in Azure Blob Storage. The API uses shared access signatures (SAS) to grant temporary read access to the images. The security team requires that SAS tokens be generated using a user delegation key derived from the application's Microsoft Entra ID credentials, not from the storage account key. Additionally, the SAS must be scoped to a specific container and have a maximum validity of 1 hour. You need to implement the SAS generation in the API using the Azure Storage SDK for .NET. The application authenticates with Microsoft Entra ID using a managed identity assigned to the Azure App Service hosting the API. Which approach should you use?

Accepted Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync, then create a BlobSasBuilder with the key and call ToSasQueryParameters.. It follows the required pattern for generating a user delegation SAS: authenticate with managed identity via a BlobServiceClient, call GetUserDelegationKeyAsync to obtain a key derived from Microsoft Entra ID (not the storage account key), then use BlobSasBuilder with that key to call ToSasQueryParameters, which produces a SAS token query string scoped to a specific container with a 1-hour validity. This meets the security team's requirement of using Entra ID credentials and avoids exposing the storage account key.

Answer

Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync to get a key, and then call BlobSasBuilder.GenerateSas using the key.

Answer

Use the StorageSharedKeyCredential with the storage account key to create a BlobSasBuilder and generate a SAS token.

Answer

Use DefaultAzureCredential to authenticate, then call GenerateUserDelegationSas on the BlobContainerClient.

Question 11

You are building a serverless application that processes images uploaded to an Azure Blob Storage container. When a new blob is added, an Azure Function (PowerShell) is triggered to generate a thumbnail and store it in a different container. The function must run with the least privilege necessary. The function uses a managed identity assigned to the function app. You need to grant the function access to read blobs from the source container and write blobs to the destination container. The storage account already has a private endpoint configured. What is the correct way to assign permissions?

Accepted Answer

Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.. It uses Azure RBAC roles scoped to individual containers, granting the function app's managed identity exactly the permissions needed: 'Storage Blob Data Reader' for reading from the source container and 'Storage Blob Data Contributor' for writing to the destination container. This follows the principle of least privilege, avoids over-permissioning, and works seamlessly with private endpoints since RBAC does not depend on network paths.

Answer

Generate a SAS token for the source container with read permission and for the destination container with write permission, and store them in Key Vault for the function to retrieve.

Answer

Add the function app's managed identity to the storage account's Access Control (IAM) with the 'Storage Blob Data Owner' role on the entire storage account.

Answer

Use the storage account connection string in the function app settings and access the blobs using the connection string.

Question 12

You are developing a .NET Core application that stores user profile images in Azure Blob Storage. The images are accessed frequently in the first week after upload, then rarely afterwards. You need to minimize storage costs while maintaining immediate access for the first week. What should you do?

Accepted Answer

Implement a lifecycle management policy to move blobs to Cool tier 7 days after creation.. Azure Blob Storage lifecycle management policies allow you to automatically transition blobs to a cooler tier (Cool) after a specified number of days, minimizing storage costs while maintaining immediate access for the first week. This policy is applied at the storage account level and requires no manual intervention or scheduled jobs, ensuring that blobs remain in the Hot tier for the first 7 days (frequent access) and then move to Cool tier (lower cost, still immediate access).

Answer

Manually change the blob tier to Cool after 7 days using a scheduled job.

Answer

Set the default access tier of the storage account to Cool.

Answer

Store blobs in Archive tier and use rehydration when needed.

Question 13

Your company stores sensitive financial documents in Azure Blob Storage. You need to ensure that only authorized users can access the blobs, and you must avoid exposing storage account keys. You want to generate time-limited URLs that grant access to specific blobs. What should you use?

Accepted Answer

Shared Access Signatures (SAS). Shared Access Signatures (SAS) are the correct choice because they allow you to delegate access to specific blobs with granular permissions (read, write, delete) and enforce a time-limited validity period, all without exposing the storage account keys. This directly meets the requirement of generating time-limited URLs for authorized access while keeping the account keys secure.

Answer

Storage account access keys

Answer

Azure role-based access control (RBAC)

Answer

Managed identities for Azure resources

Question 14

You are designing a solution that stores large media files (up to 5 GB each) in Azure Blob Storage. The application must support concurrent uploads with the ability to pause and resume. You need to ensure efficient use of network bandwidth and provide progress reporting. Which approach should you use?

Accepted Answer

Use the Azure Storage SDK to upload blobs in blocks, and implement pause/resume logic using block IDs.. Azure Blob Storage supports block blobs, which allow you to upload large files in independent blocks. By using the Azure Storage SDK, you can assign unique block IDs to each block, enabling pause/resume by tracking which block IDs have been committed. This approach also provides fine-grained progress reporting per block and efficient network bandwidth usage through parallel uploads.

Answer

Use AzCopy with the --resume parameter.

Answer

Use Page blobs with 512-byte pages.

Answer

Use Append blobs and append data in chunks.

Question 15

You are reviewing a lifecycle management rule configured on an Azure Storage account. The rule is defined as shown in the exhibit. You notice that blobs tagged with project=temp are not being moved to the Archive tier as expected. What is the most likely cause?

Accepted Answer

The condition uses an incorrect operator for age.. The lifecycle management rule uses the condition 'age > 30' which is an incorrect operator. Azure lifecycle management rules require the operator 'daysElapsedSinceModificationGreaterThan' or similar, not a generic 'age >' syntax. This invalid operator causes the rule to fail to evaluate correctly, so blobs tagged with project=temp are not moved to Archive tier.

Answer

The rule does not include a filter for blob index tags.

Answer

The Archive tier is not supported for this storage account type.

Answer

Block blobs cannot be moved to the Archive tier.