AZ-104 Implement and Manage Storage Practice Question
A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?
⚠ Common exam trap
Many candidates confuse shared access signatures (SAS) with managed identities, thinking SAS can be used without storing secrets, but SAS tokens still require a key to generate and must be stored or regenerated, whereas managed identity eliminates all stored credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.
A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Azure AD authentication, meeting the requirement of no account keys, passwords, or connection strings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.
Why this is correct
A system-assigned managed identity is ideal when one Azure resource needs to access storage without secrets. The identity is created and deleted with the App Service, and RBAC can grant only the storage permissions required. This removes the need to embed keys or connection strings and aligns with credential-free application access.
- ✗
The storage account key, because it is the simplest way to authenticate an application securely.
Why it's wrong here
Using the storage account key fails because the key is a shared secret that must be stored in application settings or configuration, directly violating the requirement to avoid keys or secrets. It also grants full access to the entire storage account, including all containers and blobs, rather than least-privilege access to just the target container. The key must be manually rotated, and any leak exposes the whole account, whereas a managed identity has no persistent secret to steal.
- ✗
A shared access signature embedded in the app settings, because SAS is the same as managed identity.
Why it's wrong here
A shared access signature (SAS) is still a secret token that must be embedded in app settings, so it does not satisfy the no-secrets requirement. Unlike a managed identity, a SAS is not tied to an Azure AD identity; it is a cryptographic key that grants access based on the token's signature and expiry. It also needs to be regenerated and rotated over time, and if it is exposed, an attacker can use it until it expires. A managed identity, by contrast, is backed by Azure AD and needs no stored credential in the application.
- ✗
An anonymous public container with write access disabled on the account.
Why it's wrong here
Anonymous public container access does not provide any authenticated write capability; disabling write access on the container means the web app cannot upload images at all. It would allow unauthenticated public read access to blobs, which is a severe security exposure and far beyond the minimal permissions needed for an application to upload images. The scenario requires controlled, authenticated access, which cannot be achieved with public containers, regardless of write settings.
When this WOULD be correct
An administrator needs to allow public read-only access to static assets (e.g., images, documents) in a blob container for anonymous users, and no authentication or upload is required.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.Correct answer▾
Why this is correct
A system-assigned managed identity is ideal when one Azure resource needs to access storage without secrets. The identity is created and deleted with the App Service, and RBAC can grant only the storage permissions required. This removes the need to embed keys or connection strings and aligns with credential-free application access.
✗An anonymous public container with write access disabled on the account.Wrong answer — click to see why▾
Why this is wrong here
Anonymous public container with write access disabled does not allow the app to upload images; it only permits read access to blobs, and the question requires upload capability without storing credentials.
★ When this WOULD be the correct answer
An administrator needs to allow public read-only access to static assets (e.g., images, documents) in a blob container for anonymous users, and no authentication or upload is required.
Why candidates choose this
Candidates may confuse 'anonymous access' with a simple way to avoid credential management, not realizing that write access is required for uploads and that anonymous write is a security risk.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.