AZ-104 Deploy and Manage Azure Compute Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A system-assigned managed identity with Blob Data Contributor permissions on the container.

  Why this is correct

  A system-assigned managed identity is tied directly to the App Service instance and disappears when the app is deleted, which satisfies the automatic cleanup requirement. Because shared key access is disabled and secrets are not allowed in configuration, the app should authenticate through Microsoft Entra ID using the managed identity. Assigning Blob Data Contributor at the appropriate scope allows upload access without storing credentials.

• ✗

  A user-assigned managed identity with Blob Data Reader permissions on the storage account.

  Why it's wrong here

  A user-assigned managed identity is an independent Azure resource that does not get deleted when the App Service is deleted, so it fails the requirement that all associated identities be automatically cleaned up. More fundamentally, Blob Data Reader only grants read and list operations; it does not allow uploads or writes, so the app could not actually upload files even if the identity were scoped perfectly. Additionally, assigning the identity at the storage account scope with only Reader permissions gives broader read access than needed while still lacking the write capability required for the upload scenario.

  When this WOULD be correct

  A user-assigned managed identity with Blob Data Reader permissions would be correct in a scenario where the app only needs to read blobs (e.g., a reporting tool that reads files) and the identity must be shared across multiple Azure resources (e.g., multiple App Services and a Function App) to avoid managing separate identities.

• ✗

  A shared access signature generated from the storage account key.

  Why it's wrong here

  A shared access signature (SAS) generated from the storage account key is still a secret itself and requires shared key access to be enabled on the account. Since the scenario explicitly disables shared key access and forbids storing secrets in configuration, this approach cannot work. The SAS token would also need to be generated, delivered, and refreshed securely, and if leaked it grants access until it expires or the key is rotated, leaving a long-lived credential footprint to manage.

  When this WOULD be correct

  A question where the app needs to grant time-limited, delegated access to specific blobs or containers without using managed identities, and the app can securely generate SAS tokens at runtime using a stored access policy or user delegation key (e.g., from Azure AD). The scenario would not prohibit secret storage and would require granular, temporary access.

• ✗

  A storage account access key stored in an application setting.

  Why it's wrong here

  A storage account access key stored in an application setting directly violates the scenario's requirement that no secrets be placed in configuration, and it is a static, long-lived credential that grants full data-plane access to the entire storage account, not just the target container. If the key is exposed through a misconfigured setting, debug endpoint, or deployment log, an attacker would have unrestricted read, write, and delete access to all blobs in the account. Rotating the key would require updating the app setting and restarting the service, whereas managed identity authentication requires no secret management at all and automatically rotates the underlying token.

  When this WOULD be correct

  If the question stated that shared key access is enabled and the app can securely store secrets (e.g., in Key Vault), then using a storage account access key in an application setting could be a valid approach for authentication.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question