A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Generate a service SAS and place it in an app setting.

A SAS in app settings reintroduces a secret and undermines the goal of a secretless design.

Rotate the storage account keys weekly.

Rotating keys does not eliminate key-based authentication and still leaves secrets in active use.

Grant Reader access to the resource group because it includes the storage account.

Reader is a management-plane role and does not grant blob data access for reading objects.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Assign the Storage Blob Data Reader role to the managed identity on the storage account or container. — Because the app already uses a managed identity, the storage account should authorize that identity directly with the Storage Blob Data Reader role. To prevent any future app from falling back to account keys, shared key access should be disabled at the storage account level. That combination preserves secretless access for the app while eliminating a major authentication path that the security team no longer wants to permit. Why others are wrong: A SAS stored in an app setting reintroduces a secret. Rotating account keys still relies on shared keys rather than removing them. Reader access on the resource group only affects management operations and does not authorize blob reads, so it cannot replace the data-plane role.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.