AZ-104 Implement and Manage Storage Practice Question
A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?
⚠ Common exam trap
Many exam-takers confuse the Reader role (management plane) with data plane roles like Storage Blob Data Contributor, or they assume that storing a SAS token securely is acceptable despite the explicit policy forbidding it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.
Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.
Why this is correct
This uses Entra ID-based authorization without storing secrets on the VM. A managed identity is tied to the VM lifecycle, so when the VM is deleted, the identity is removed too. The Storage Blob Data Contributor role grants the data-plane permissions needed to upload blobs, while keeping access scoped to only the required storage resource.
- ✗
Create an account SAS token with write permissions and store it in a secure file on the VM.
Why it's wrong here
An account SAS is still a secret that must be stored and protected on the VM. It also remains valid until it expires or is revoked, so access does not automatically end when the VM is deleted. It is broader than necessary for a single application workload.
When this WOULD be correct
This option would be correct if the question allowed storing credentials on the VM and required a time-limited access solution, such as generating a SAS token with a short expiry and securely storing it, while the VM's lifecycle is managed separately.
- ✗
Assign the Reader role on the storage account to the VM's computer account.
Why it's wrong here
Reader is a management-plane role and does not grant data-plane permissions to upload blobs. The application would still be unable to write files to the container. This choice confuses resource visibility with actual storage data access.
When this WOULD be correct
If the question required read-only access to storage account properties (e.g., listing containers or reading metrics) and the VM had a managed identity, assigning the Reader role would be correct.
- ✗
Enable shared key access and rotate the storage account keys regularly.
Why it's wrong here
Shared keys allow broad access and create secret-management overhead. Rotating keys does not bind access to the VM lifecycle and does not provide least privilege. This approach is weaker than using managed identity plus a scoped RBAC role.
When this WOULD be correct
This option would be correct if the question required using storage account keys for authentication, and the security policy allowed storing keys securely (e.g., in Azure Key Vault with automatic rotation). The VM would retrieve the key at runtime without storing it locally.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.Correct answer▾
Why this is correct
This uses Entra ID-based authorization without storing secrets on the VM. A managed identity is tied to the VM lifecycle, so when the VM is deleted, the identity is removed too. The Storage Blob Data Contributor role grants the data-plane permissions needed to upload blobs, while keeping access scoped to only the required storage resource.
✗Create an account SAS token with write permissions and store it in a secure file on the VM.Wrong answer — click to see why▾
Why this is wrong here
Option B violates the security policy that forbids storing storage account keys or long-lived SAS tokens on the VM. An account SAS token is a long-lived credential that would need to be stored on the VM, and it does not automatically expire when the VM is deleted.
★ When this WOULD be the correct answer
This option would be correct if the question allowed storing credentials on the VM and required a time-limited access solution, such as generating a SAS token with a short expiry and securely storing it, while the VM's lifecycle is managed separately.
Why candidates choose this
Candidates may think a SAS token is a secure way to grant access without exposing the account key, and they might overlook the security policy forbidding credential storage on the VM.
✗Assign the Reader role on the storage account to the VM's computer account.Wrong answer — click to see why▾
Why this is wrong here
The Reader role only allows read access to storage account metadata, not data operations like uploading blobs. The VM's computer account is not used for Azure RBAC; managed identity or service principal is required.
★ When this WOULD be the correct answer
If the question required read-only access to storage account properties (e.g., listing containers or reading metrics) and the VM had a managed identity, assigning the Reader role would be correct.
Why candidates choose this
Candidates may confuse 'Reader role' with data access or think that a computer account can be used for Azure RBAC similarly to on-premises Active Directory.
✗Enable shared key access and rotate the storage account keys regularly.Wrong answer — click to see why▾
Why this is wrong here
Option D suggests enabling shared key access and rotating keys regularly, but the security policy forbids storing storage account keys on the VM. Even with rotation, the key must be present on the VM at some point, violating the policy. Additionally, shared key access does not automatically revoke access when the VM is deleted.
★ When this WOULD be the correct answer
This option would be correct if the question required using storage account keys for authentication, and the security policy allowed storing keys securely (e.g., in Azure Key Vault with automatic rotation). The VM would retrieve the key at runtime without storing it locally.
Why candidates choose this
Candidates may think that rotating keys regularly is a good security practice and that enabling shared key access is standard for storage accounts, overlooking the explicit policy forbidding key storage on the VM.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.