A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Create a new managed identity for the contractor

Managed identities are assigned to Azure resources, not to external contractors without a resource in your subscription.

Give the contractor the storage account access key

An account key provides broad access and is not limited to a single container or short time window.

Enable anonymous public access on the container

Anonymous access would make the content publicly reachable and is not appropriate for controlled temporary access.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Issue a shared access signature with read-only permissions and an expiration time — A shared access signature is ideal for temporary, limited access because it can be scoped to a single container, specific permissions such as read only, and a short expiration time. This allows you to grant access to someone outside your tenant without exposing the storage account key. It is a common operational choice when you need controlled, time-bound access. Why others are wrong: Managed identities are for Azure resources and do not fit an external contractor scenario. Sharing the storage account key would give much broader access than needed and would be difficult to revoke cleanly. Anonymous public access would remove control entirely, which conflicts with the requirement for temporary read-only access.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.