AZ-104 Implement and Manage Storage Practice Question
A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?
⚠ Common exam trap
A common mix-up: candidates assume Azure Files only supports shared key or SAS-based access, overlooking the identity-based authentication option that integrates with on-premises AD DS for seamless credential reuse.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Files identity-based authentication using Active Directory Domain Services.
Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shared key authorization, because it is the only method supported by Azure Files.
Why it's wrong here
Shared key authorization does work for mounting an Azure file share, but it is not the only supported method and is explicitly unsuitable for this scenario. It uses the storage account key as a shared secret, which grants full administrative control over the storage account and is not tied to an individual Windows user's domain identity. The security team specifically requires identity-based authentication using Active Directory Domain Services, so relying on shared key access would not meet that requirement and would introduce unnecessary credential management risk.
When this WOULD be correct
If the question asked for a simple, legacy method to mount an Azure file share without any identity-based authentication requirements and the security team allowed storage account keys, shared key authorization would be correct.
- ✓
Azure Files identity-based authentication using Active Directory Domain Services.
Why this is correct
Azure Files can use AD DS-based identity authentication so Windows users and servers can access the share with domain credentials. This avoids storing or distributing storage account keys and fits the requirement to use existing directory identities.
- ✗
A user delegation SAS, because it maps the share automatically to domain accounts.
Why it's wrong here
A user delegation SAS is a token used to delegate access to Azure Blob Storage resources, not to mount Azure Files SMB shares. While it is signed with Azure AD credentials, it does not map to Windows domain accounts or integrate with the SMB protocol's Kerberos flow, so it cannot be used when Windows file servers need to authenticate with on-premises AD DS identity. Moreover, Azure Files does not support SAS-based authentication for SMB file share mounts at all, making this option conceptually wrong for the stated identity-based requirement.
When this WOULD be correct
When a question asks for granting time-limited, delegated access to a specific Azure file share for a user or application without using storage account keys, and the access must be scoped to a particular share or directory using Azure AD authentication.
- ✗
Anonymous access, because Windows file servers can mount Azure shares without authentication.
Why it's wrong here
Anonymous access is not applicable to Azure Files SMB shares. Azure Files requires authentication for every mount operation, and anonymous or guest-level access is not supported for SMB file shares in the same way it is for public blob containers. Even if it were possible, it would completely bypass the security team's requirement to leverage existing Active Directory Domain Services identities, making this option both technically incorrect and a violation of the stated policy.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Files identity-based authentication using Active Directory Domain Services.Correct answer▾
Why this is correct
Azure Files can use AD DS-based identity authentication so Windows users and servers can access the share with domain credentials. This avoids storing or distributing storage account keys and fits the requirement to use existing directory identities.
✗Shared key authorization, because it is the only method supported by Azure Files.Wrong answer — click to see why▾
Why this is wrong here
Shared key authorization requires storage account keys, which the security team explicitly prohibits. The question requires using existing AD DS credentials, which shared key authorization does not support.
★ When this WOULD be the correct answer
If the question asked for a simple, legacy method to mount an Azure file share without any identity-based authentication requirements and the security team allowed storage account keys, shared key authorization would be correct.
Why candidates choose this
Candidates may mistakenly believe shared key is the only or default authentication method for Azure Files, overlooking the identity-based options that integrate with AD DS.
✗A user delegation SAS, because it maps the share automatically to domain accounts.Wrong answer — click to see why▾
Why this is wrong here
A user delegation SAS does not map shares automatically to domain accounts; it provides delegated access to a specific resource using Azure AD credentials, not Active Directory Domain Services, and does not support automatic mapping via domain credentials.
★ When this WOULD be the correct answer
When a question asks for granting time-limited, delegated access to a specific Azure file share for a user or application without using storage account keys, and the access must be scoped to a particular share or directory using Azure AD authentication.
Why candidates choose this
Candidates may confuse SAS with identity-based authentication, thinking that a user delegation SAS integrates with domain accounts, but it actually uses Azure AD tokens and does not support automatic drive mapping with AD DS credentials.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Azure Files
Azure Files is a cloud-based file sharing service that lets you create and access file shares using the Server Message Block (SMB) protocol or Network File System (NFS) protocol, just like you would access files on a local network drive.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.