AZ-104 Implement and Manage Storage Practice Question
A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials instead of a storage account key. The organization already has domain-joined Windows servers in the environment. What should the administrator configure on the storage account?
⚠ Common exam trap
A common mix-up: candidates confuse network-level controls (like service endpoints) or key-based access methods (like SAS tokens) with identity-based authentication, failing to recognize that only enabling AD DS authentication on the storage account allows the use of existing domain credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Files identity-based authentication with Active Directory Domain Services.
Azure Files supports identity-based authentication over SMB using Active Directory Domain Services (AD DS). By enabling this on the storage account, the administrator can mount the file share using existing domain credentials instead of a storage account key, provided the client VM is domain-joined and the share is configured with appropriate NTFS permissions. This eliminates the need to manage or expose storage account keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Azure Files identity-based authentication with Active Directory Domain Services.
Why this is correct
Enabling Azure Files identity-based authentication with Active Directory Domain Services allows the Windows file server VM to obtain a Kerberos ticket for the SMB share and mount it using the user's existing domain credentials. This eliminates the need for storage account keys or SAS tokens because authorization is handled through RBAC roles like 'Storage File Data SMB Share Reader'. This is precisely what the requirement asks for.
- ✗
Enable blob soft delete and mount the share with a blob container SAS token.
Why it's wrong here
Blob soft delete is a data-protection feature that preserves deleted blobs for a retention window, so it has absolutely no role in authentication or in granting SMB access to an Azure file share. A blob container SAS token is designed for REST/API operations against Azure Blob Storage, not for the SMB file share protocol; Azure Files requires either a storage account key, an identity-based Kerberos ticket, or a file-share SAS, and even a file-share SAS wouldn't satisfy the AD DS credential requirement. This option conflates blob features with file-share identity.
When this WOULD be correct
An administrator needs to protect blob data from accidental deletion or overwrite. Enabling blob soft delete allows recovery of deleted blobs within a retention period. Mounting with a SAS token provides delegated access without exposing the account key.
- ✗
Enable a service endpoint for Microsoft.Storage on the subnet.
Why it's wrong here
A service endpoint for Microsoft.Storage restricts network traffic to the storage account from a specific virtual network subnet, but it is a network-layer control and does not affect how clients authenticate. Even with the service endpoint enabled, the VM would still need to supply some credential, such as a storage account key or a SAS token, unless identity-based authentication is separately configured. Because the question specifically demands use of existing AD DS credentials, a service endpoint alone cannot fulfill that requirement.
When this WOULD be correct
An administrator needs to ensure that a storage account is only accessible from a specific virtual network subnet to reduce exposure to the internet. The correct answer would be to enable a service endpoint for Microsoft.Storage on that subnet and configure the storage account firewall to allow access only from that subnet.
- ✗
Create a shared access signature for the file share and map it as a local drive.
Why it's wrong here
A shared access signature (SAS) for the file share is a delegated URI that grants time-limited access to the share, but it is not tied to any directory identity and cannot be used with the SMB protocol in the way the VM's existing AD DS login expects. Mapping a drive with a SAS URI requires embedding the token in the path or using PowerShell, which creates a connection authenticated by the token rather than by the user's domain account. Since the requirement is to use existing AD DS credentials, this approach fails.
When this WOULD be correct
An administrator needs to grant temporary, time-limited access to a specific Azure file share for a user who does not have AD DS credentials, such as an external contractor. In that case, generating a SAS token and mapping the share as a local drive would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable Azure Files identity-based authentication with Active Directory Domain Services.Correct answer▾
Why this is correct
Enabling Azure Files identity-based authentication with Active Directory Domain Services allows the Windows file server VM to obtain a Kerberos ticket for the SMB share and mount it using the user's existing domain credentials. This eliminates the need for storage account keys or SAS tokens because authorization is handled through RBAC roles like 'Storage File Data SMB Share Reader'. This is precisely what the requirement asks for.
✗Enable blob soft delete and mount the share with a blob container SAS token.Wrong answer — click to see why▾
Why this is wrong here
Blob soft delete and SAS tokens are for Azure Blob Storage, not Azure Files. The question requires mounting an Azure file share with AD credentials, not using a storage account key or SAS.
★ When this WOULD be the correct answer
An administrator needs to protect blob data from accidental deletion or overwrite. Enabling blob soft delete allows recovery of deleted blobs within a retention period. Mounting with a SAS token provides delegated access without exposing the account key.
Why candidates choose this
Candidates may confuse Azure Files with Azure Blobs, or think that SAS tokens can be used for AD-based authentication, not realizing SAS is a shared key mechanism.
✗Enable a service endpoint for Microsoft.Storage on the subnet.Wrong answer — click to see why▾
Why this is wrong here
Enabling a service endpoint for Microsoft.Storage on the subnet restricts access to the storage account from that subnet but does not enable Active Directory authentication for Azure Files. The question requires identity-based authentication using AD DS credentials, which service endpoints do not provide.
★ When this WOULD be the correct answer
An administrator needs to ensure that a storage account is only accessible from a specific virtual network subnet to reduce exposure to the internet. The correct answer would be to enable a service endpoint for Microsoft.Storage on that subnet and configure the storage account firewall to allow access only from that subnet.
Why candidates choose this
Candidates may confuse network-level access control (service endpoints) with identity-based authentication, thinking that restricting network access is sufficient to meet the requirement of using AD credentials, or they may incorrectly associate service endpoints with Active Directory integration.
✗Create a shared access signature for the file share and map it as a local drive.Wrong answer — click to see why▾
Why this is wrong here
Creating a shared access signature (SAS) for the file share and mapping it as a local drive still uses a SAS token for authentication, not Active Directory Domain Services credentials. The question requires using existing AD DS credentials, which SAS does not support.
★ When this WOULD be the correct answer
An administrator needs to grant temporary, time-limited access to a specific Azure file share for a user who does not have AD DS credentials, such as an external contractor. In that case, generating a SAS token and mapping the share as a local drive would be appropriate.
Why candidates choose this
Candidates may confuse SAS tokens with identity-based authentication, thinking that any token-based access can satisfy the requirement for using AD DS credentials, or they may not fully understand the difference between storage account key access and AD DS integration.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Azure Files
Azure Files is a cloud-based file sharing service that lets you create and access file shares using the Server Message Block (SMB) protocol or Network File System (NFS) protocol, just like you would access files on a local network drive.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?
medium- A.Shared key authorization, because it is the only method supported by Azure Files.
- ✓ B.Azure Files identity-based authentication using Active Directory Domain Services.
- C.A user delegation SAS, because it maps the share automatically to domain accounts.
- D.Anonymous access, because Windows file servers can mount Azure shares without authentication.
Why B: Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.
Variation 2. A Windows VM mounts an Azure Files share by using SMB and identity-based authentication. Which two permission layers can affect access to folders in the share? Select two.
easy- ✓ A.Azure RBAC permissions on the file share
- ✓ B.NTFS permissions on files and folders
- C.Network security group rules on the storage account
- D.Blob access tier settings
- E.Route table next-hop selection
Why A: Azure RBAC permissions on the file share (Option A) control whether a user or service principal can mount the share or perform management operations, such as listing or modifying share properties. When identity-based authentication is used (Kerberos or Azure AD Kerberos), RBAC roles like 'Storage File Data SMB Share Reader' or 'Contributor' are required to grant access at the share level before any file-level permissions apply.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.