AZ-104 Implement and Manage Storage Practice Question
A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.
⚠ Common exam trap
A common mix-up: candidates confuse the Contributor role (which grants management-level access) with the Storage Blob Data Contributor role (which grants data-plane access), and may overlook that scoping the role to the container (rather than the storage account or resource group) is the most secure and correct approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the VM.
A system-assigned managed identity on the VM allows Azure AD authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Azure AD tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a system-assigned managed identity on the VM.
Why this is correct
A system-assigned managed identity lets the VM request Azure access tokens without storing secrets on the server. The identity is automatically created and tied to that VM, which fits a simple single-VM app. This is the safest starting point when a workload must authenticate to Azure Storage without an account key or SAS token.
- ✓
Assign the Storage Blob Data Contributor role to that managed identity at the container scope.
Why this is correct
Storage Blob Data Contributor is a data-plane RBAC role that allows writing blobs without granting broader management permissions. Assigning it at the container scope keeps access limited to only the target data. This is the right permission model when a VM identity needs to upload files to one container.
- ✗
Store the storage account access key in an environment variable on the VM.
Why it's wrong here
An access key is a long-lived secret, and storing it on the VM violates the requirement to avoid credentials. It also grants broad access to the storage account rather than only the needed container. This is less secure than using managed identity and RBAC.
When this WOULD be correct
If the question allowed storing a key on the VM (e.g., 'The app can securely store a key using environment variables') and did not require managed identity, then storing the access key in an environment variable would be a valid approach.
- ✗
Generate a service SAS and copy it into the application configuration.
Why it's wrong here
A SAS token is still a secret, even if it can be time-limited and scoped. The requirement explicitly says the app must not store a SAS token on the VM. Managed identity is preferred because it removes the need to manage shared secrets in the workload.
When this WOULD be correct
If the question allowed storing a SAS token and required fine-grained, time-limited access without using managed identities, generating a service SAS and embedding it in the app configuration would be correct.
- ✗
Assign the Contributor role on the resource group to the managed identity.
Why it's wrong here
Contributor is a management-plane role and does not grant blob data access by itself. It would also give far more permission than needed for a single container upload. The app needs a data role such as Storage Blob Data Contributor, not broad resource control.
When this WOULD be correct
If the question required the VM to manage the storage account itself (e.g., create/delete containers, update account settings) rather than access blob data, assigning the Contributor role on the resource group would be correct. For example, a management app that needs to reconfigure storage accounts.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a system-assigned managed identity on the VM.Correct answer▾
Why this is correct
A system-assigned managed identity lets the VM request Azure access tokens without storing secrets on the server. The identity is automatically created and tied to that VM, which fits a simple single-VM app. This is the safest starting point when a workload must authenticate to Azure Storage without an account key or SAS token.
✗Store the storage account access key in an environment variable on the VM.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly requires that the app must not store a storage account key on the VM. Storing the key in an environment variable still places the key on the VM, violating the requirement.
★ When this WOULD be the correct answer
If the question allowed storing a key on the VM (e.g., 'The app can securely store a key using environment variables') and did not require managed identity, then storing the access key in an environment variable would be a valid approach.
Why candidates choose this
Candidates may think environment variables are a secure way to store secrets, overlooking the explicit prohibition against storing any key on the VM. They might also be unfamiliar with managed identity alternatives.
✗Generate a service SAS and copy it into the application configuration.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly states the app must not store a SAS token on the VM. Generating a service SAS and copying it into the application configuration violates this requirement.
★ When this WOULD be the correct answer
If the question allowed storing a SAS token and required fine-grained, time-limited access without using managed identities, generating a service SAS and embedding it in the app configuration would be correct.
Why candidates choose this
Candidates may think a SAS token is a secure way to grant access without a storage account key, overlooking the requirement that no token be stored on the VM.
✗Assign the Contributor role on the resource group to the managed identity.Wrong answer — click to see why▾
Why this is wrong here
The Contributor role at the resource group scope grants full management access to all resources in the group, but does not include the specific data permissions (e.g., Storage Blob Data Contributor) needed to upload blobs. Managed identities require a data role on the storage container or account to access blob data.
★ When this WOULD be the correct answer
If the question required the VM to manage the storage account itself (e.g., create/delete containers, update account settings) rather than access blob data, assigning the Contributor role on the resource group would be correct. For example, a management app that needs to reconfigure storage accounts.
Why candidates choose this
Candidates may confuse the Contributor role (which grants management access) with data access roles, assuming any role assignment on the resource group will allow blob operations. They might also think a broad role is sufficient without understanding Azure RBAC's separation between management and data planes.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.