Implement and Manage Storage →easyMultiple ChoiceObjective-mapped

AZ-104 Implement and Manage Storage Practice Question

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key, and the access should expire automatically. Which access method should you use?

⚠ Common exam trap

A common mix-up: candidates confuse RBAC with SAS, thinking that a role assignment can be made temporary, but RBAC does not support automatic expiration; only SAS provides time-bound, delegated access without sharing the account key.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Shared access signature (SAS)

A shared access signature (SAS) is the correct choice because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. You can set an expiry time of 12 hours, and the SAS token can be generated with only the permissions needed (e.g., write). Once the token expires, access is automatically revoked, meeting the requirement for automatic expiration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Role assignment in Azure RBAC
Why it's wrong here
RBAC can grant a partner access through a role like Storage Blob Data Contributor, but it requires the partner to have an Azure AD identity (user, group, or service principal) that you manage and assign. Setting this up for a single 12-hour upload is operationally heavy: you'd need to provision an identity, assign the role, coordinate credentials for the partner to authenticate, and then remember to remove the assignment after the task. RBAC assignments are meant for ongoing, identity-based access control, whereas a SAS is designed exactly for temporary, delegated access to a specific resource without identity overhead. While RBAC could technically work, it is not the simplest or most secure time-limited solution here.
When this WOULD be correct
A question that requires granting long-term or permanent access to a specific user or group for managing blob containers, without time constraints, would make RBAC role assignment correct.
✓
Shared access signature (SAS)
Why this is correct
A Shared Access Signature (SAS) is a URI that grants scoped, time-limited access to specific storage resources, such as a container or blob. For this scenario, you can generate a service SAS with write permissions on the single container, an expiry time (e.g., 12 hours), and optionally restrict it to the partner's IP address. The partner only needs the SAS URL; no Azure AD credentials or storage account key are exposed. This makes it the ideal, least-privilege mechanism for a one-off upload task.
✗
Private endpoint
Why it's wrong here
A private endpoint assigns a private IP address from your virtual network to the storage account, making it accessible only over a private connection within Azure. It effectively removes public internet exposure, but it does not authenticate a partner or provide write permissions to blob storage. For an external partner to upload files, you would still need to supply a credential or identity (like a SAS or RBAC role), and the private endpoint might actually block their path if they are not on the same network. The correct issue is access authorization, not network accessibility.
When this WOULD be correct
An organization needs to securely connect to an Azure Storage account from an on-premises network without traversing the public internet, and the connection must be restricted to a specific virtual network.
✗
Storage account lock
Why it's wrong here
An Azure resource lock (CanNotDelete or ReadOnly) is a management-plane control that guards the storage account against accidental deletion or destructive changes from Azure Resource Manager operations. It has no bearing on data-plane operations; uploading a blob is an interaction with the Blob service, not the ARM control plane. In fact, a ReadOnly lock would prevent any write operations, including blob uploads, because it blocks all management requests, but it certainly does not grant permissions to a partner. The lock does not carry identity or context about who is performing the action.
When this WOULD be correct
A storage account lock would be correct if the question asked for a method to prevent accidental deletion of the entire storage account or to enforce an immutable policy for compliance purposes, without needing to grant access to a partner.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

✓Shared access signature (SAS)Correct answer▾

Why this is correct

A Shared Access Signature (SAS) is a URI that grants scoped, time-limited access to specific storage resources, such as a container or blob. For this scenario, you can generate a service SAS with write permissions on the single container, an expiry time (e.g., 12 hours), and optionally restrict it to the partner's IP address. The partner only needs the SAS URL; no Azure AD credentials or storage account key are exposed. This makes it the ideal, least-privilege mechanism for a one-off upload task.

✗Role assignment in Azure RBACWrong answer — click to see why▾

Why this is wrong here

Azure RBAC role assignments grant persistent permissions and do not automatically expire, so they cannot enforce a 12-hour time limit for access.

★ When this WOULD be the correct answer

A question that requires granting long-term or permanent access to a specific user or group for managing blob containers, without time constraints, would make RBAC role assignment correct.

Why candidates choose this

Candidates may confuse RBAC with SAS because both control access, but RBAC lacks the time-limited, fine-grained delegation that SAS provides for temporary access.

✗Private endpointWrong answer — click to see why▾

Why this is wrong here

A private endpoint provides secure, private connectivity to Azure services over a private IP address, but it does not provide time-limited access or automatic expiration for external partners.

★ When this WOULD be the correct answer

An organization needs to securely connect to an Azure Storage account from an on-premises network without traversing the public internet, and the connection must be restricted to a specific virtual network.

Why candidates choose this

Candidates may confuse private endpoints with secure access methods, thinking that restricting network access alone can replace the need for time-limited credentials like SAS tokens.

✗Storage account lockWrong answer — click to see why▾

Why this is wrong here

A storage account lock prevents deletion or modification of the storage account but does not provide time-limited, granular access to a specific blob container without sharing the account key.

★ When this WOULD be the correct answer

A storage account lock would be correct if the question asked for a method to prevent accidental deletion of the entire storage account or to enforce an immutable policy for compliance purposes, without needing to grant access to a partner.

Why candidates choose this

Candidates may confuse 'lock' with access control, thinking it can restrict access like a SAS, but locks only protect against administrative operations, not data access.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

AZ-104 Implement and Manage Storage Practice Question

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question