AZ-104 Implement and Manage Storage Practice Question
A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?
⚠ Common exam trap
Watch out — candidates often confuse a service SAS with a stored access policy, or they mistakenly think a managed identity can be assigned to an external device, when in reality managed identities are only for Azure resources and require Azure AD integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A service SAS scoped to the container with write permission and an expiry time in six hours.
A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A service SAS scoped to the container with write permission and an expiry time in six hours.
Why this is correct
A service SAS can be scoped to a single container, limited to the needed permissions, and set to expire automatically. That makes it the best fit for temporary contractor upload access without exposing the full storage account key.
- ✗
The storage account access key, because it is easier to revoke later.
Why it's wrong here
The storage account access key grants full administrative control over the entire storage account, including all containers, blobs, queues, tables, and the ability to modify access policies. It is not scoped to a specific container or permission level, so using it for a contractor violates least privilege and exposes the whole account. Revoking it later requires regenerating the key, which can disrupt any application still relying on it, making it harder, not easier, to manage temporary access.
When this WOULD be correct
A question where the administrator needs to grant full access to all storage account resources (e.g., multiple containers, tables, queues) to a trusted internal team for an indefinite period, and key revocation is a planned administrative action.
- ✗
A shared key rotation policy, because it grants time-limited access to one container.
Why it's wrong here
A shared key rotation policy is a management procedure for periodically regenerating the storage account's access keys, not a credential or access delegation mechanism. It does not scope permissions to a single container, nor does it assign an expiry to a contractor's access; rotating the shared keys would invalidate access for every client using the account, providing neither granularity nor time-bound control for a one-time upload task.
When this WOULD be correct
If the question asked for a method to automatically rotate storage account keys on a schedule to meet compliance requirements, then a shared key rotation policy would be correct.
- ✗
A user-assigned managed identity assigned to the contractor’s laptop.
Why it's wrong here
A user-assigned managed identity is an Azure Active Directory identity intended for authenticating Azure resources such as virtual machines, App Services, or Azure Functions; it cannot be assigned to a contractor's laptop because the laptop is an external non-Azure device. Even if the identity were somehow used, it would not automatically possess write permissions on the storage container—explicit RBAC or SAS assignment would still be required, and managed identity credentials are not designed for external, time-limited delegation scenarios.
When this WOULD be correct
A user-assigned managed identity would be correct if the contractor's workload runs on an Azure VM or Azure App Service that needs to access the blob container, and the administrator wants to avoid managing credentials while granting minimum permissions via role-based access control (RBAC).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A service SAS scoped to the container with write permission and an expiry time in six hours.Correct answer▾
Why this is correct
A service SAS can be scoped to a single container, limited to the needed permissions, and set to expire automatically. That makes it the best fit for temporary contractor upload access without exposing the full storage account key.
✗The storage account access key, because it is easier to revoke later.Wrong answer — click to see why▾
Why this is wrong here
The storage account access key grants full access to the entire storage account, not just one container, and does not have a built-in time limit. This violates the requirement to grant only minimum permissions and avoid sharing the key.
★ When this WOULD be the correct answer
A question where the administrator needs to grant full access to all storage account resources (e.g., multiple containers, tables, queues) to a trusted internal team for an indefinite period, and key revocation is a planned administrative action.
Why candidates choose this
Candidates may think the access key is simple to use and revoke, overlooking that it provides excessive permissions and cannot be scoped to a single container or time-bound.
✗A shared key rotation policy, because it grants time-limited access to one container.Wrong answer — click to see why▾
Why this is wrong here
A shared key rotation policy is not a valid Azure access method; it refers to rotating storage account keys, not granting time-limited access to a specific container.
★ When this WOULD be the correct answer
If the question asked for a method to automatically rotate storage account keys on a schedule to meet compliance requirements, then a shared key rotation policy would be correct.
Why candidates choose this
Candidates may confuse 'shared key rotation policy' with a SAS policy or think it provides time-limited access, but it is not a real access control mechanism for containers.
✗A user-assigned managed identity assigned to the contractor’s laptop.Wrong answer — click to see why▾
Why this is wrong here
A user-assigned managed identity cannot be assigned to a contractor's laptop; managed identities are designed for Azure resources like VMs or App Services, not external devices. It also requires complex authentication setup and does not inherently provide time-limited access to a specific container.
★ When this WOULD be the correct answer
A user-assigned managed identity would be correct if the contractor's workload runs on an Azure VM or Azure App Service that needs to access the blob container, and the administrator wants to avoid managing credentials while granting minimum permissions via role-based access control (RBAC).
Why candidates choose this
Candidates may think managed identities provide a secure, keyless way to grant permissions, but they overlook that managed identities are not assignable to non-Azure devices like laptops.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.