A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Grant the partner Contributor access on the storage account

Contributor is broader than needed and still requires the partner to have an identity in the tenant.

Share the storage account access key and let the partner create their own token

Sharing the account key exposes full secret material and defeats the requirement to avoid key distribution.

Enable anonymous public write access on the container

Anonymous write access is not a secure or controlled way to grant temporary partner access.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create a user delegation SAS with write permission and a short expiration time — A user delegation SAS is the best answer because it grants time-limited, permission-scoped access to a specific blob container without giving the partner the storage account key. The SAS can be restricted to write operations and set to expire after 24 hours, which matches the business need closely. This pattern is preferred when you need temporary external access with strong control and revocation options. It is more secure and narrower than exposing a shared key or granting long-lived RBAC at the account scope. Why others are wrong: Contributor is too broad and assumes the partner can be added as a tenant identity. Sharing the account key is exactly what the requirement says not to do. Anonymous public access is insecure and does not provide per-user accountability or proper control.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.