AZ-104 Implement and Manage Storage Practice Question
A web app currently accesses Azure Blob Storage by using the storage account key in a connection string. Security now requires blocking any new requests that use shared key authorization, while Microsoft Entra-based access must continue to work. Which storage account setting should the administrator change?
⚠ Common exam trap
Many candidates confuse network-level restrictions (firewall/VNet) with authentication-level controls, mistakenly thinking that limiting network access (Option A) is equivalent to blocking shared key authorization, when in fact it only controls which IPs or VNets can reach the storage account, not how they authenticate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable shared key authorization on the storage account.
Disabling shared key authorization on the storage account explicitly blocks all requests that use the storage account key (shared key) for authentication, while still allowing requests authenticated via Microsoft Entra ID (formerly Azure AD). This directly meets the security requirement to block new requests using shared key authorization without affecting Entra-based access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the storage account network access to selected networks only.
Why it's wrong here
Setting the storage account's network access to selected networks only restricts the originating IP addresses or virtual networks from which requests are accepted. It does not evaluate the authentication method, so a client in an allowed network can still authenticate with the shared account key. The requirement is to eliminate key-based authorization entirely, not to narrow the network path from which key-based requests may arrive.
When this WOULD be correct
This option would be correct if the question asked: 'A web app must only be accessible from a specific corporate network. Which setting should the administrator configure to restrict access to the storage account?'
- ✓
Disable shared key authorization on the storage account.
Why this is correct
Disabling shared key authorization blocks new requests that rely on the account key, while still allowing Microsoft Entra-based authentication paths. This is the correct control when the goal is to stop key-based access without disabling modern identity-based access.
- ✗
Rotate the account keys and leave all authentication methods enabled.
Why it's wrong here
Rotating the account keys changes the shared secret value, but the shared key authorization mechanism remains enabled on the storage account. Any application or client that retrieves the new key from Azure Key Vault, configuration, or environment variables can continue to send authenticated requests with that key, so the undesired access pattern persists. Rotation is a periodic security hygiene step, not a policy that disables the authentication protocol itself.
When this WOULD be correct
This option would be correct in a scenario where the question asks for a security best practice to mitigate a potential key compromise without disrupting existing connections, or where the requirement is to periodically update keys to reduce the risk of unauthorized access while keeping shared key authorization enabled.
- ✗
Enable object replication for the storage account.
Why it's wrong here
Enabling object replication configures asynchronous copying of blobs between a source and destination storage account, typically for geo-redundancy or data movement. This data-plane feature operates independently from the storage account's authentication settings and neither elevates nor restricts how identities authenticate. It leaves the shared key authorization property untouched, so key-based access would still work for any client that has the account key.
When this WOULD be correct
A question asks: 'You need to ensure that blob data is automatically copied to a secondary region for disaster recovery. Which storage account setting should you configure?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Disable shared key authorization on the storage account.Correct answer▾
Why this is correct
Disabling shared key authorization blocks new requests that rely on the account key, while still allowing Microsoft Entra-based authentication paths. This is the correct control when the goal is to stop key-based access without disabling modern identity-based access.
✗Set the storage account network access to selected networks only.Wrong answer — click to see why▾
Why this is wrong here
Setting network access to selected networks only restricts access based on IP address or virtual network, not authentication method. It does not block shared key authorization; it only limits which networks can reach the storage account.
★ When this WOULD be the correct answer
This option would be correct if the question asked: 'A web app must only be accessible from a specific corporate network. Which setting should the administrator configure to restrict access to the storage account?'
Why candidates choose this
Candidates may confuse network-level access control with authentication method control, thinking that restricting network access also blocks shared key authorization.
✗Rotate the account keys and leave all authentication methods enabled.Wrong answer — click to see why▾
Why this is wrong here
Rotating the account keys does not disable shared key authorization; it only changes the keys. The question requires blocking new requests using shared key authorization, which is achieved by disabling shared key authorization entirely, not by rotating keys.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question asks for a security best practice to mitigate a potential key compromise without disrupting existing connections, or where the requirement is to periodically update keys to reduce the risk of unauthorized access while keeping shared key authorization enabled.
Why candidates choose this
Candidates may think that rotating keys is a way to enforce security and block unauthorized access, confusing key rotation with disabling the authentication method itself.
✗Enable object replication for the storage account.Wrong answer — click to see why▾
Why this is wrong here
Object replication is used to asynchronously copy blobs between storage accounts for data redundancy or compliance, not to control authentication methods. It does not block shared key authorization.
★ When this WOULD be the correct answer
A question asks: 'You need to ensure that blob data is automatically copied to a secondary region for disaster recovery. Which storage account setting should you configure?'
Why candidates choose this
Candidates may confuse 'replication' with 'authentication' or think that enabling replication somehow overrides or replaces shared key access, not understanding that replication is a data feature, not a security control.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.