AZ-104 Implement and Manage Storage Practice Question
A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?
⚠ Common exam trap
Watch out — candidates often think a SAS token or access key is acceptable if encrypted or rotated, but the security policy explicitly forbids storing any secrets on the VM, making managed identity the only compliant option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.
Assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Azure AD, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.
Why it's wrong here
A SAS token is a delegated bearer credential that grants anyone who possesses it the permissions encoded in the token, regardless of the sender's identity. Storing a one-year SAS in an encrypted file on the VM fails to meet the 'no long-lived credentials on the host' rule because the service process must be able to decrypt that file at runtime, putting the token within reach of any user or process with the VM's decryption keys. Because the SAS is valid for a year, the exposure window is enormous, and there's no automatic rotation or audit trail beyond the token's creation — exactly the kind of secret that managed identity eliminates.
When this WOULD be correct
A question where the security policy allows storing secrets on the VM with encryption, and the service needs to access Blob storage for a limited time (e.g., 1 year) without requiring managed identity support or frequent token renewal.
- ✓
Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.
Why this is correct
A managed identity lets the VM authenticate to Azure Storage without storing credentials. Granting Storage Blob Data Contributor provides the data-plane permissions needed to upload blobs while keeping access tied to Entra ID and RBAC. This satisfies the requirement for noninteractive authentication and avoids account keys or long-lived SAS tokens.
- ✗
Share the storage account access key with the service account and rotate it monthly.
Why it's wrong here
An account access key is the root superuser credential for the storage account — it allows full read/write/delete access to all blobs, queues, tables, and files, including the ability to regenerate other keys. Sharing the key with the service account means that key is stored in configuration on the VM, which is an unacceptable long-lived secret and gives any compromise of the VM full access to the entire storage account, not just the intended container. Rotating it monthly doesn't reduce the blast radius, because the new key is immediately written back to the VM, and key rotation itself requires coordinated reconfiguration and often downtime — a poor substitute for identity-based authentication.
When this WOULD be correct
If the security policy allowed storing keys on the VM and required periodic rotation, this option would be correct for a service that needs to authenticate to Blob storage without managed identity support.
- ✗
Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.
Why it's wrong here
A storage firewall rule only filters traffic by the VM's source IP; it doesn't authenticate the caller or prove that the Windows service is who it says it is. Anonymous access specifically means no Entra ID credential or shared key is presented, and Azure Storage allows anonymous read only for containers explicitly set to public access — anonymous upload is never supported. Therefore, even with the firewall opened, blob upload requests would be rejected with an authentication error, and the design violates the requirement for non-interactive, identity-based access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.Correct answer▾
Why this is correct
A managed identity lets the VM authenticate to Azure Storage without storing credentials. Granting Storage Blob Data Contributor provides the data-plane permissions needed to upload blobs while keeping access tied to Entra ID and RBAC. This satisfies the requirement for noninteractive authentication and avoids account keys or long-lived SAS tokens.
✗Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.Wrong answer — click to see why▾
Why this is wrong here
Storing a SAS token with a 1-year expiry in an encrypted file on the VM violates the security policy forbidding long-lived tokens on the VM, and still requires managing a secret on the VM, which is not allowed.
★ When this WOULD be the correct answer
A question where the security policy allows storing secrets on the VM with encryption, and the service needs to access Blob storage for a limited time (e.g., 1 year) without requiring managed identity support or frequent token renewal.
Why candidates choose this
Candidates may think an encrypted file provides sufficient security and that a long-lived SAS token avoids the need for frequent renewal, overlooking the policy restriction and the better managed identity solution.
✗Share the storage account access key with the service account and rotate it monthly.Wrong answer — click to see why▾
Why this is wrong here
Storing the storage account access key on the VM violates the security policy forbidding account keys on the VM, and monthly rotation does not eliminate the risk of key exposure.
★ When this WOULD be the correct answer
If the security policy allowed storing keys on the VM and required periodic rotation, this option would be correct for a service that needs to authenticate to Blob storage without managed identity support.
Why candidates choose this
Candidates may think that rotating keys monthly is a sufficient security measure and overlook the explicit policy forbidding key storage on the VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
Key term
Contributor role
The Contributor role is a built-in Azure role that grants full access to manage resources within a scope but does not allow granting access to other users.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.