AZ-104 Implement and Manage Storage Practice Question
A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key, and the access token should keep working even if the storage account keys are rotated later. Which access mechanism should be issued?
⚠ Common exam trap
It's easy for candidates to confuse service SAS and user delegation SAS, assuming both are tied to the account key, but only service SAS is; user delegation SAS uses Entra ID and survives key rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A user delegation SAS signed through Microsoft Entra authentication
A user delegation SAS is signed with Microsoft Entra credentials rather than the storage account key, so it remains valid even if the storage account keys are rotated. This meets the requirement to avoid sharing the account key while providing temporary, scoped access for exactly six hours. The contractor can upload files without the administrator exposing the account key or needing to manage key rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An account SAS signed with the storage account key
Why it's wrong here
An account SAS is signed with the storage account key but grants access to one or more storage services and permits account-level operations, not just container-scoped uploads. This is broader than needed for a single blob container and still relies on the shared account key, so rotating that key invalidates all SAS tokens derived from it. It also lacks support for Microsoft Entra identity-based authorization, so it fails the security requirement of avoiding key-based credentials.
When this WOULD be correct
If the question required a SAS that provides access to multiple services (e.g., blobs, queues, tables) or to the entire storage account, and key rotation is not a concern, an account SAS signed with the storage account key would be appropriate.
- ✗
A service SAS signed with the storage account key
Why it's wrong here
A service SAS is scoped to a single resource such as a container or blob, but it is signed with the storage account shared key. This means the signer must possess the account key, and if that key is rotated or compromised, the SAS is invalidated. It also cannot be revoked independently without re-signing, and it does not use Microsoft Entra identity-based authorization, so the principle of least privilege is still tied to a shared secret.
- ✓
A user delegation SAS signed through Microsoft Entra authentication
Why this is correct
A user delegation SAS is signed with a user delegation key obtained from Microsoft Entra ID (Azure AD), not with the storage account key. The signing principal must have the RBAC permission Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey, and the resulting SAS is scoped to the container with granular permissions and a short validity window. This provides a revocable, isolated credential that avoids exposing the storage account key, making it the correct choice for a temporary contractor upload.
- ✗
The storage account access key itself in a temporary script variable
Why it's wrong here
Sharing the storage account access key outright grants unrestricted full access to all storage services, data, and even management operations in the account. It is a long-lived shared secret with no granular scoping, so placing it in a temporary script variable does not limit the contractor's access. Rotating the key later is disruptive and may break other applications, and the key cannot be revoked or audited at the container level, violating the principle of least privilege.
When this WOULD be correct
If the question required granting full, unrestricted access to the storage account for a short period and there was no concern about key rotation or security best practices, providing the account key in a script variable could be a quick solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A user delegation SAS signed through Microsoft Entra authenticationCorrect answer▾
Why this is correct
A user delegation SAS is signed with a user delegation key obtained from Microsoft Entra ID (Azure AD), not with the storage account key. The signing principal must have the RBAC permission Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey, and the resulting SAS is scoped to the container with granular permissions and a short validity window. This provides a revocable, isolated credential that avoids exposing the storage account key, making it the correct choice for a temporary contractor upload.
✗An account SAS signed with the storage account keyWrong answer — click to see why▾
Why this is wrong here
An account SAS signed with the storage account key would be invalidated if the storage account keys are rotated, which violates the requirement that the access token must keep working after key rotation.
★ When this WOULD be the correct answer
If the question required a SAS that provides access to multiple services (e.g., blobs, queues, tables) or to the entire storage account, and key rotation is not a concern, an account SAS signed with the storage account key would be appropriate.
Why candidates choose this
Candidates may think an account SAS is more flexible and secure than sharing the key directly, but they overlook that it is still tied to the storage account key and will break upon key rotation.
✗The storage account access key itself in a temporary script variableWrong answer — click to see why▾
Why this is wrong here
Sharing the storage account key itself violates the requirement to avoid sharing the key, and rotating the key would invalidate any temporary script variable using it, failing the requirement that the access token keeps working after key rotation.
★ When this WOULD be the correct answer
If the question required granting full, unrestricted access to the storage account for a short period and there was no concern about key rotation or security best practices, providing the account key in a script variable could be a quick solution.
Why candidates choose this
Candidates may think using the account key directly is simpler and more straightforward than setting up SAS or delegation, especially when the access is temporary and they overlook the key rotation and security requirements.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.