AZ-104 Implement and Manage Storage Practice Question
A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?
⚠ Common exam trap
Candidates often confuse managed identity with other authentication methods like SAS tokens or connection strings, or incorrectly assume that embedding keys in app settings is acceptable because it's 'not in code,' but Azure explicitly considers this a security risk for production workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a managed identity to the app and grant it storage permissions
Azure Managed Identity provides an automatically managed service principal in Azure AD, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Azure AD token to securely access the blob container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Embed the storage account key in the application settings
Why it's wrong here
Embedding the storage account key in application settings works technically, but a key is a long-lived, full-access credential to the storage account, including all containers and data. It cannot be scoped to a single container, and if it leaks — via source control, logs, or the App Service blade — an attacker gains unrestricted access. The key also bypasses Azure AD auditing, and rotating it forces you to redeploy or update settings, so this is insecure and operationally heavy.
When this WOULD be correct
If the question specified that the app must use a shared access signature (SAS) token and the storage account key is needed to generate the SAS token server-side, embedding the key in application settings could be acceptable in a tightly controlled environment.
- ✓
Assign a managed identity to the app and grant it storage permissions
Why this is correct
A managed identity provides the app with an Azure AD identity that Azure automatically manages; your code acquires an OAuth 2.0 token from the instance metadata service with no stored secrets. You then grant that identity the Storage Blob Data Contributor role at the container or storage-account scope via RBAC, which gives least-privilege access for uploads and allows clean rotation and auditing. This is the secure, recommended approach for App Service to Azure Storage.
- ✗
Use the public endpoint and anonymous access
Why it's wrong here
Enabling public anonymous access means the blob container accepts unauthenticated requests from any client on the internet, eliminating all identity and authorization controls. This would let anyone who discovers the container's URL upload arbitrary files, making it completely unsuitable for a web app's protected file uploads. Anonymous access also violates the principle of least privilege and is typically not allowed for containers that need to be private.
When this WOULD be correct
When the requirement is to allow public read access to blob data without authentication, such as for hosting static websites or sharing publicly accessible files, and the app does not need to authenticate.
- ✗
Use an archive tier for the container
Why it's wrong here
The archive tier is a storage access tier that optimizes costs for rarely used blobs by moving them to offline storage and requiring rehydration for reads; it has absolutely no effect on authentication or authorization. Uploading to an archive tier still requires a valid identity or key and can cause unexpected latency of up to several hours for later access, but it never replaces the need for a secure authentication mechanism. Therefore, it is irrelevant to the question of how the app should authenticate to the container.
When this WOULD be correct
A question asks how to minimize storage costs for rarely accessed blob data that can tolerate hours of retrieval latency, such as compliance archives or backup data.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign a managed identity to the app and grant it storage permissionsCorrect answer▾
Why this is correct
A managed identity provides the app with an Azure AD identity that Azure automatically manages; your code acquires an OAuth 2.0 token from the instance metadata service with no stored secrets. You then grant that identity the Storage Blob Data Contributor role at the container or storage-account scope via RBAC, which gives least-privilege access for uploads and allows clean rotation and auditing. This is the secure, recommended approach for App Service to Azure Storage.
✗Embed the storage account key in the application settingsWrong answer — click to see why▾
Why this is wrong here
Embedding the storage account key in application settings violates the requirement to avoid storing keys in code, as the key would still be stored in a configurable setting that could be exposed.
★ When this WOULD be the correct answer
If the question specified that the app must use a shared access signature (SAS) token and the storage account key is needed to generate the SAS token server-side, embedding the key in application settings could be acceptable in a tightly controlled environment.
Why candidates choose this
Candidates may think that storing the key in application settings is secure because it's not in the source code, but they overlook that it still requires managing a secret and does not eliminate credential storage.
✗Use the public endpoint and anonymous accessWrong answer — click to see why▾
Why this is wrong here
Using the public endpoint with anonymous access would allow anyone to upload files without authentication, violating the requirement to avoid storing credentials but failing to provide secure, authenticated access.
★ When this WOULD be the correct answer
When the requirement is to allow public read access to blob data without authentication, such as for hosting static websites or sharing publicly accessible files, and the app does not need to authenticate.
Why candidates choose this
Candidates may think that anonymous access eliminates the need for credentials, overlooking the security and authentication requirements of the scenario.
✗Use an archive tier for the containerWrong answer — click to see why▾
Why this is wrong here
The archive tier is for cost-effective storage of infrequently accessed data with retrieval delays, not for authentication. It does not address the requirement to avoid storing credentials in code.
★ When this WOULD be the correct answer
A question asks how to minimize storage costs for rarely accessed blob data that can tolerate hours of retrieval latency, such as compliance archives or backup data.
Why candidates choose this
Candidates may confuse storage tiers with security features, thinking an archive tier somehow eliminates the need for authentication, or they may misapply cost-saving measures to a security requirement.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.