AZ-104 Implement and Manage Storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.

  Why this is correct

  The Storage Blob Data Reader role is a data-plane RBAC role that specifically authorizes read operations against blob containers and blobs. Assigning it to a managed identity at the storage account or container scope grants access based on the identity's Entra ID token, eliminating any need for shared keys or connection strings. This is the fundamental mechanism for secretless, identity-based access, and it works with both system-assigned and user-assigned managed identities.

• ✓

  Disable shared key access on the storage account.

  Why this is correct

  Disabling shared key access on the storage account removes the ability to authenticate with the account access keys, which are long-lived secrets often stored in configuration. When enabled, this setting forces every data-plane request to be authenticated through Microsoft Entra ID (or, if explicitly allowed, SAS tokens) — so the earlier role assignment to the managed identity becomes the effective path. Note that this action is a security hardening measure; it does not by itself grant any blob-read permission but ensures key-based authentication cannot be used as a fallback, thereby aligning with a zero-secret architecture.

• ✗

  Generate a service SAS and place it in an app setting.

  Why it's wrong here

  A service SAS (Shared Access Signature) is constructed from the account key and grants delegated, time-limited access to specific storage resources. Storing it in an app setting means you have reintroduced a secret into the application configuration, undermining the entire purpose of using a managed identity; moreover, the SAS must be managed, monitored, and rotated before expiry. In addition, if shared key access is disabled, a service SAS becomes invalid because it depends on the account key, making this approach incompatible with the intended secure architecture.

  When this WOULD be correct

  If the question required granting temporary, scoped access to a specific blob or container for an external client without using managed identity, and shared key access was still allowed, generating a service SAS would be correct.

• ✗

  Rotate the storage account keys weekly.

  Why it's wrong here

  Rotating storage account keys on a weekly basis simply generates new shared secrets; it does not eliminate the use of shared-key authentication. As long as the application uses the account key, you still have to deploy the new key to the app settings and handle the rotation, which is both a security risk and an operational burden. Because the problem explicitly calls for a managed identity to read blobs, key rotation is orthogonal and does not contribute to a secretless solution — the correct approach is to remove key-based authentication entirely.

  When this WOULD be correct

  In a scenario where a security policy mandates periodic rotation of storage account keys to limit exposure of compromised keys, and the question asks for a step to comply with key rotation requirements while maintaining existing authentication methods.

• ✗

  Grant Reader access to the resource group because it includes the storage account.

  Why it's wrong here

  The built-in Reader role is a management-plane (or control-plane) RBAC role that only permits 'read' on ARM resources, such as listing storage accounts and viewing their properties. It does not include dataActions like 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read', which are required to read blob objects. Even if assigned at the resource group level, Reader inherits down to the storage account but still lacks any data-level permissions, so the application would get 403 errors when attempting to access the blobs.

  When this WOULD be correct

  If the question asked which role allows a user to view storage account properties and settings but not access blob data, then Reader on the resource group would be correct. For example, an auditor needs to see storage account configuration without reading blobs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”