AZ-104 Implement and Manage Storage Practice Question
A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?
⚠ Common exam trap
Many exam-takers confuse RBAC roles like Contributor (which grants management permissions only) with data plane roles like Storage Blob Data Reader, or they mistakenly think service endpoints provide authentication instead of network-level access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.
A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account access key in an application setting, because it works with any blob operation.
Why it's wrong here
Using the storage account access key in an application setting is insecure for this scenario because the key is a long-lived secret that grants full administrative access to the storage account, including the ability to read, write, delete, and manage all blob containers and their contents. It also bypasses identity-based access control and requires the application to handle and store a credential, which directly contradicts the principle of avoiding stored secrets. Moreover, the access key is not scoped to a specific operation or resource; it exposes the entire account, far beyond the read-only blob access the application requires.
When this WOULD be correct
A question where the app needs full access to all storage operations (e.g., create/delete containers) and storing a key in an application setting is acceptable, such as when the app is in a trusted environment and key rotation is handled externally.
- ✓
A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.
Why this is correct
A managed identity lets the app authenticate to Azure Storage without storing credentials, and the Storage Blob Data Reader role grants only blob data read access. Assigning the role at the storage account scope keeps the permission focused on the intended resource while avoiding management-plane rights. This is the most secure operational pattern for an Azure-hosted app that only needs to read blobs.
- ✗
The Contributor role on the storage account, because it includes both management and data permissions.
Why it's wrong here
Assigning the Contributor role on the storage account is inappropriate because Contributor is an Azure RBAC management-plane role that provides full control over the storage account resource itself—such as modifying account configuration, networking, and encryption—but it does not grant any direct permissions to read or write blob data. For data access, a separate data-plane role such as Storage Blob Data Reader or Storage Blob Data Contributor is required, and the latter would still be too broad. Even if Contributor included some data permissions (which it does not by default), it would provide far more privilege than needed and violate the principle of least privilege for an app that only needs to read blobs.
When this WOULD be correct
A question requiring an Azure role that allows both management and data plane operations on a storage account, such as 'You need to grant a user full access to manage the storage account and read/write blobs. What role should you assign?'
- ✗
A service endpoint on the subnet, because service endpoints are used for application authentication.
Why it's wrong here
Configuring a service endpoint on the subnet does not authenticate the application to Azure Storage; service endpoints simply restrict the source IP address/network from which a storage account can be accessed, ensuring that traffic originates from an Azure virtual network. They are a network security control, not an identity-based authentication mechanism, and they do not replace the need for the app to present a valid credential or managed identity. Even with a service endpoint in place, the app must separately authenticate and be authorized to read blobs, so this option fails to solve the credential problem entirely.
When this WOULD be correct
A question requiring secure access to a storage account from a specific VNet, where the goal is to restrict network access to only trusted subnets, and authentication is handled separately (e.g., via managed identity or keys).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.Correct answer▾
Why this is correct
A managed identity lets the app authenticate to Azure Storage without storing credentials, and the Storage Blob Data Reader role grants only blob data read access. Assigning the role at the storage account scope keeps the permission focused on the intended resource while avoiding management-plane rights. This is the most secure operational pattern for an Azure-hosted app that only needs to read blobs.
✗The storage account access key in an application setting, because it works with any blob operation.Wrong answer — click to see why▾
Why this is wrong here
Using the storage account access key grants full management access to the storage account, not just blob data permissions, and requires storing a secret in the application settings, violating the requirement to avoid storing secrets.
★ When this WOULD be the correct answer
A question where the app needs full access to all storage operations (e.g., create/delete containers) and storing a key in an application setting is acceptable, such as when the app is in a trusted environment and key rotation is handled externally.
Why candidates choose this
Candidates may think the access key is a simple, familiar way to authenticate, and overlook that it provides excessive permissions and requires secret storage, which contradicts the 'no secrets' constraint.
✗The Contributor role on the storage account, because it includes both management and data permissions.Wrong answer — click to see why▾
Why this is wrong here
The Contributor role grants full management access to the storage account, including the ability to delete or modify the account itself, which violates the requirement to grant only blob data permissions and not storage management permissions.
★ When this WOULD be the correct answer
A question requiring an Azure role that allows both management and data plane operations on a storage account, such as 'You need to grant a user full access to manage the storage account and read/write blobs. What role should you assign?'
Why candidates choose this
Candidates may think Contributor is sufficient because it includes read/write access to blobs, but they overlook that it also grants management permissions, which are explicitly disallowed in this scenario.
✗A service endpoint on the subnet, because service endpoints are used for application authentication.Wrong answer — click to see why▾
Why this is wrong here
Service endpoints secure traffic to the storage account from a virtual network but do not authenticate the app or grant data permissions; they are a network-level control, not an identity-based authentication mechanism.
★ When this WOULD be the correct answer
A question requiring secure access to a storage account from a specific VNet, where the goal is to restrict network access to only trusted subnets, and authentication is handled separately (e.g., via managed identity or keys).
Why candidates choose this
Candidates confuse network security controls (service endpoints) with application authentication methods, assuming that restricting network access is sufficient for secure data access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
System-assigned managed identity
A system-assigned managed identity is an automatically created Azure Active Directory identity that is tied to a specific Azure resource and is used to securely authenticate to other Azure services without storing credentials.
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.