A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key and wants the access to expire automatically. Which two actions should the administrator take? Select two.

Generate a service SAS by using the account key.

A service SAS depends on the storage account key, which the requirement explicitly says must not be shared.

Enable anonymous blob access on the container.

Anonymous access removes authentication entirely and would expose the container far beyond the contractor requirement.

Create a storage account access key specifically for the contractor.

Storage account keys are high-privilege secrets and are not intended to be issued to individual contractors.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Generate a user delegation SAS for the contractor. — The safest way to grant temporary upload access without exposing the storage account key is to use a user delegation SAS. That type of SAS is generated through Microsoft Entra authentication rather than via a shared key. Setting the SAS to expire in six hours ensures the contractor loses access automatically when the task window ends. Together, those actions meet the minimum-access and time-bound requirements. Why others are wrong: A service SAS still depends on the storage account key. Anonymous access bypasses authentication entirely and is far too permissive. Issuing a storage account key would defeat the security goal because that key can access much more than one container and is difficult to scope tightly.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.