AZ-104 Implement and Manage Storage Practice Question
A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?
⚠ Common exam trap
It's easy for candidates to confuse disabling shared key access with rotating keys or enabling secure transfer, not realizing that only disabling shared key access actually blocks the authorization method itself, while the other options address key freshness or transport encryption, not authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable shared key access on the storage account
Disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rotate the storage account keys every 24 hours
Why it's wrong here
Rotating the storage account keys updates the shared secrets that clients use for shared key authentication, but it does not disable the shared key authorization mechanism itself. The legacy application would continue to work until the next rotation invalidates its current key, after which it would fail unless it is updated to fetch the new key. This approach merely shortens the lifetime of any leaked key; it leaves the storage account still accepting shared key credentials, so it does not satisfy the requirement to stop key-based access.
When this WOULD be correct
This would be correct in a scenario where the requirement is to periodically update the account key to minimize the risk of key compromise, without disabling shared key access entirely.
- ✓
Disable shared key access on the storage account
Why this is correct
Disabling shared key access sets the storage account's AllowSharedKeyAccess property to false, causing the Azure Storage resource provider to reject any request authenticated with the account access keys. This forces all requests to use identity-based authentication, such as Azure AD credentials, managed identities, or service principals. It is the only option that actually enforces a change in authentication method at the authorization level, directly preventing the legacy app from using its stored account key.
- ✗
Require secure transfer for the storage account
Why it's wrong here
Requiring secure transfer enforces the use of HTTPS for all traffic to the storage account, ensuring that data is encrypted in transit between the client and the service. This setting improves transport security and helps prevent man-in-the-middle attacks, but it has no effect on the authentication methods the storage account accepts. The legacy app's account keys would still be valid for authorization, just sent over an encrypted channel, so shared key access remains fully functional.
When this WOULD be correct
This option would be correct in a scenario where the question asks: 'An organization needs to ensure that all data transferred to Azure Storage is encrypted over the network. Which setting should be enabled?'
- ✗
Create a private endpoint for the storage account
Why it's wrong here
Creating a private endpoint maps the storage account to a private IP address inside your virtual network, routing traffic over the Microsoft backbone instead of the public internet. This is a network-isolation control that eliminates public network exposure, but it does not intercept or alter how the caller authenticates to the storage service. The legacy application would still be able to authenticate with its account keys over this private connection, so shared key access remains enabled and usable.
When this WOULD be correct
This option would be correct in a scenario where the requirement is to ensure that all traffic to the storage account goes through a private network, eliminating exposure to the public internet, while still allowing authorized access via Microsoft Entra ID or shared keys.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Disable shared key access on the storage accountCorrect answer▾
Why this is correct
Disabling shared key access sets the storage account's AllowSharedKeyAccess property to false, causing the Azure Storage resource provider to reject any request authenticated with the account access keys. This forces all requests to use identity-based authentication, such as Azure AD credentials, managed identities, or service principals. It is the only option that actually enforces a change in authentication method at the authorization level, directly preventing the legacy app from using its stored account key.
✗Rotate the storage account keys every 24 hoursWrong answer — click to see why▾
Why this is wrong here
Rotating keys every 24 hours does not prevent new requests using shared key authorization; it only changes the key periodically, allowing continued use of shared key access.
★ When this WOULD be the correct answer
This would be correct in a scenario where the requirement is to periodically update the account key to minimize the risk of key compromise, without disabling shared key access entirely.
Why candidates choose this
Candidates may think frequent key rotation effectively blocks unauthorized access, but it does not stop legitimate applications from using shared key authorization.
✗Require secure transfer for the storage accountWrong answer — click to see why▾
Why this is wrong here
Requiring secure transfer enforces HTTPS for all requests but does not block shared key authorization; it only ensures data is encrypted in transit, not that shared key authentication is disabled.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks: 'An organization needs to ensure that all data transferred to Azure Storage is encrypted over the network. Which setting should be enabled?'
Why candidates choose this
Candidates may confuse 'secure transfer' with disabling shared key access, thinking that enforcing HTTPS somehow prevents shared key usage, or they may misread the requirement as a security encryption need rather than an authentication restriction.
✗Create a private endpoint for the storage accountWrong answer — click to see why▾
Why this is wrong here
Creating a private endpoint restricts network access to the storage account via a private IP, but it does not prevent requests that use shared key authorization. The requirement is to block shared key access, not network-level access.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the requirement is to ensure that all traffic to the storage account goes through a private network, eliminating exposure to the public internet, while still allowing authorized access via Microsoft Entra ID or shared keys.
Why candidates choose this
Candidates may confuse network security controls with authentication controls, thinking that a private endpoint can block shared key access because it limits network connectivity, but shared key authorization is an authentication method that can still be used over private endpoints.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.