AZ-104 Implement and Manage Storage Practice Question
A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?
⚠ Common exam trap
Watch out — candidates often confuse managed identities (designed for Azure resources, not external users) with user accounts, or mistakenly think that sharing the account key is acceptable for temporary access, overlooking the severe security risk and lack of scoping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Issue a shared access signature with read-only permissions and an expiration time
A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new managed identity for the contractor
Why it's wrong here
Managed identities (formerly Azure AD Managed Service Identities) are Azure Active Directory identities that are automatically managed by Azure and are designed to be attached to Azure resources, such as virtual machines, App Services, or Azure Functions, so those resources can authenticate to services like Azure Storage. A contractor is an external human user, not an Azure resource, and you cannot create a managed identity for them in your subscription. Even if you tried to assign a managed identity to some resource, you would also need to configure role-based access control (RBAC) for that identity, and it would still not be tied to a single blob with a time limit. This approach simply does not fit the scenario of granting a person temporary external access.
When this WOULD be correct
A question where a virtual machine needs temporary read-only access to a blob container without storing credentials. The correct answer would be to assign a managed identity to the VM and grant it RBAC permissions.
- ✗
Give the contractor the storage account access key
Why it's wrong here
The storage account access key is a master key that grants full administrative control over the entire storage account, including all containers, blobs, queues, tables, and the ability to modify access policies. Handing it to an external contractor violates the principle of least privilege and creates a severe security risk because that key does not expire and is not scoped to a single blob or time window. If the key is leaked or misused, the entire account is compromised, and rotating the key would potentially disrupt all applications that depend on it. This option is functionally the opposite of temporary, read-only, single-blob access.
When this WOULD be correct
A question where a user needs full administrative access to a storage account for an indefinite period, and the user is trusted within the organization, such as a storage administrator managing all storage resources.
- ✓
Issue a shared access signature with read-only permissions and an expiration time
Why this is correct
A shared access signature (SAS) is the correct approach because it lets you delegate limited permissions to a specific Azure Storage resource—here, a single blob—without exposing the account key. By setting read-only permissions (r) and a short expiration time, you enforce both the scope and the duration of the contractor's access. A SAS can also be restricted to a particular IP range or service version, adding another layer of control. The token is appended to the blob URL, making it easy to share while keeping the underlying storage account secured.
- ✗
Enable anonymous public access on the container
Why it's wrong here
Enabling anonymous public access on the container would make every blob inside that container publicly readable by anyone who knows the container's URL, with no expiration, no authentication, and no ability to restrict to a single blob. This is a permanent and broad security policy change that would persist after the contractor's work is done, violating the temporary and controlled nature of the request. Azure Storage also requires you to explicitly disable public access at the account level to enable any container-level anonymous access, and by default such access is disallowed. Public access exposes the data to the entire internet, which is an unacceptable risk for a one-off contractor engagement.
When this WOULD be correct
A question where the requirement is to allow public read-only access to a blob container for all users (e.g., for hosting static website assets) without authentication or time limits.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Issue a shared access signature with read-only permissions and an expiration timeCorrect answer▾
Why this is correct
A shared access signature (SAS) is the correct approach because it lets you delegate limited permissions to a specific Azure Storage resource—here, a single blob—without exposing the account key. By setting read-only permissions (r) and a short expiration time, you enforce both the scope and the duration of the contractor's access. A SAS can also be restricted to a particular IP range or service version, adding another layer of control. The token is appended to the blob URL, making it easy to share while keeping the underlying storage account secured.
✗Create a new managed identity for the contractorWrong answer — click to see why▾
Why this is wrong here
Managed identities are for Azure resources to authenticate to other services, not for external users without an Azure account. They cannot be assigned to a contractor who lacks a user identity in the tenant.
★ When this WOULD be the correct answer
A question where a virtual machine needs temporary read-only access to a blob container without storing credentials. The correct answer would be to assign a managed identity to the VM and grant it RBAC permissions.
Why candidates choose this
Candidates may confuse managed identities with service principals or think they can be used for any identity, including external users, because they provide secure access without managing keys.
✗Give the contractor the storage account access keyWrong answer — click to see why▾
Why this is wrong here
The storage account access key grants full administrative access to the entire storage account, not read-only access to a single blob container, and it does not expire after three hours.
★ When this WOULD be the correct answer
A question where a user needs full administrative access to a storage account for an indefinite period, and the user is trusted within the organization, such as a storage administrator managing all storage resources.
Why candidates choose this
Candidates may think the access key is a simple way to grant access without setting up Azure AD accounts, overlooking that it provides excessive permissions and lacks time-bound expiration.
✗Enable anonymous public access on the containerWrong answer — click to see why▾
Why this is wrong here
Enabling anonymous public access on the container would grant read access to anyone on the internet without time restriction, violating the temporary and controlled access requirement.
★ When this WOULD be the correct answer
A question where the requirement is to allow public read-only access to a blob container for all users (e.g., for hosting static website assets) without authentication or time limits.
Why candidates choose this
Candidates may think anonymous access is a quick way to grant read access without managing credentials, overlooking the lack of time restriction and security implications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.