A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

A new storage account access key

An access key grants broad account-level access and is much wider than the contractor needs.

A management group assignment

Management groups control governance over subscriptions, not temporary file upload access to blob storage.

A private endpoint for the contractor

Private endpoints control network access paths, but they do not provide temporary user authorization by themselves.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A shared access signature scoped to the container and expiration time — A shared access signature is the right tool when you want to grant temporary, scoped access to one storage resource without giving away the account key. It can be limited to a container, specific permissions, and a short expiration window such as six hours. This makes it ideal for contractors or integrations that need narrow, time-limited access. Why others are wrong: A storage account key gives far broader access than needed and is harder to control safely. Management groups are unrelated to storage data access. A private endpoint changes how traffic reaches the service, but it does not authorize a contractor by itself or replace a temporary access token.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.