AZ-104 Implement and Manage Storage Practice Question
A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?
⚠ Common exam trap
Watch out — candidates often confuse managed identities with Key Vault integration, thinking that storing a key in Key Vault solves the secret rotation problem, but the access key itself is still a long-lived secret that requires manual rotation and is stored in the app settings as a reference.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. The identity is automatically managed by Azure AD, and the App Service can use it to obtain an OAuth 2.0 token for accessing blob storage via RBAC. This eliminates the need for manual credential rotation and secret storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A storage account access key stored in Key Vault
Why it's wrong here
Storing a storage account access key in Key Vault removes the secret from source control but still forces the app to authenticate to Key Vault, obtain a secret, and use it as the storage credential. An access key grants unrestricted permissions to the entire storage account and must be rotated periodically, which is exactly the operational overhead avoided by using a managed identity directly for the Azure AD-backed storage connection.
When this WOULD be correct
If the question required accessing a storage account that does not support Azure AD authentication (e.g., legacy storage) and the team was willing to manage secrets but wanted to centralize them, storing the access key in Key Vault and using a managed identity to retrieve it would be correct.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity creates a first-party Azure AD identity for the App Service instance, which can then be granted the Storage Blob Data Reader (or similar) role on the storage account's data plane. The runtime requests an Azure AD token through the instance metadata endpoint, and no embedded keys or tokens ever appear in code or configuration, so there is no credential rotation to manage.
- ✗
A shared access signature embedded in the application settings
Why it's wrong here
A shared access signature embedded in application settings is a bearer credential that must be kept confidential, and it will expire, requiring the team to generate a new token and redeploy or update settings. Even if stored as a connection string, the SAS is still a credential in plaintext at rest and in the configuration plane, so this inherits secret management while also introducing the risk of token leakage in logs or tooling.
When this WOULD be correct
If the question required granting time-limited, scoped access to specific blobs without using managed identities (e.g., for external clients or cross-tenant access), a SAS token stored securely (e.g., in Key Vault) would be appropriate.
- ✗
A service endpoint on the App Service integration subnet
Why it's wrong here
A service endpoint focuses exclusively on network-level access control by restricting traffic to the storage account from the App Service integration subnet’s IP range. It does not authenticate the web API's caller or provide any identity credentials, so storage requests would still be rejected unless a separate auth mechanism like a SAS or key is supplied; thus it cannot be the sole solution.
When this WOULD be correct
A service endpoint would be correct if the question asked: 'How to restrict network access to a storage account so that only traffic from a specific App Service subnet is allowed?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identityCorrect answer▾
Why this is correct
A system-assigned managed identity creates a first-party Azure AD identity for the App Service instance, which can then be granted the Storage Blob Data Reader (or similar) role on the storage account's data plane. The runtime requests an Azure AD token through the instance metadata endpoint, and no embedded keys or tokens ever appear in code or configuration, so there is no credential rotation to manage.
✗A storage account access key stored in Key VaultWrong answer — click to see why▾
Why this is wrong here
Using a storage account access key stored in Key Vault still requires the App Service to retrieve and manage the key, which involves secrets and manual credential rotation, contradicting the requirement to avoid storing secrets and rotating credentials manually.
★ When this WOULD be the correct answer
If the question required accessing a storage account that does not support Azure AD authentication (e.g., legacy storage) and the team was willing to manage secrets but wanted to centralize them, storing the access key in Key Vault and using a managed identity to retrieve it would be correct.
Why candidates choose this
Candidates may think Key Vault eliminates secret management entirely, but the App Service still needs to authenticate to Key Vault and handle the key, which introduces secret handling and rotation complexity.
✗A shared access signature embedded in the application settingsWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) embedded in application settings still requires manual rotation and exposes a secret, contradicting the requirement to avoid storing secrets or rotating credentials manually.
★ When this WOULD be the correct answer
If the question required granting time-limited, scoped access to specific blobs without using managed identities (e.g., for external clients or cross-tenant access), a SAS token stored securely (e.g., in Key Vault) would be appropriate.
Why candidates choose this
Candidates may think SAS tokens are a secure way to grant access without storing full access keys, but they still involve secret management and rotation, which the question explicitly wants to avoid.
✗A service endpoint on the App Service integration subnetWrong answer — click to see why▾
Why this is wrong here
A service endpoint on the App Service integration subnet restricts network access to the storage account but does not provide authentication or authorization for the App Service to read/write blobs. It does not eliminate the need for secrets or credentials.
★ When this WOULD be the correct answer
A service endpoint would be correct if the question asked: 'How to restrict network access to a storage account so that only traffic from a specific App Service subnet is allowed?'
Why candidates choose this
Candidates may confuse service endpoints with managed identities, thinking that securing the network path also handles authentication, or they may believe that service endpoints grant access permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.