AZ-104 Implement and Manage Storage Practice Question
A Windows file server VM must mount an Azure file share by using domain credentials instead of a storage account key. The organization already manages users in Active Directory Domain Services. Which authentication option should be configured for Azure Files?
⚠ Common exam trap
Many candidates confuse shared key authentication (Option A) as the only supported method for Azure Files, overlooking the identity-based authentication capability that integrates with on-premises AD DS for domain-joined VMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identity-based authentication with Active Directory Domain Services.
Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined Windows VMs to mount Azure file shares using their existing domain credentials instead of a storage account key. This enables Kerberos-based authentication and preserves NTFS permissions, meeting the requirement to avoid shared key access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shared key authentication, because it is the default for Azure file shares.
Why it's wrong here
Shared key authentication uses the storage account key, which grants full administrative control over the storage account, not user-level domain credentials. While it is a default option for many Azure Files operations, it does not integrate with Active Directory Domain Services and therefore does not satisfy the 'identity-based authentication' requirement. In an enterprise environment, relying on the shared key also forces you to embed a powerful secret in scripts or connection strings, making it both functionally wrong and a security anti-pattern for this scenario.
When this WOULD be correct
When the question asks for the simplest method to authenticate to an Azure file share without requiring domain services, and the environment does not have Active Directory Domain Services or Azure AD DS.
- ✓
Identity-based authentication with Active Directory Domain Services.
Why this is correct
Azure Files can use identity-based authentication so Windows clients access the share with their domain identities instead of storage keys. In an environment that already has Active Directory Domain Services, that is the appropriate configuration for SMB-based access. It supports centralized identity management, aligns with existing Windows admin practices, and avoids embedding account keys in scripts or connection strings.
- ✗
A service SAS created for the share and mapped as a network drive.
Why it's wrong here
A service SAS is a token-based delegation intended for REST API calls, not for SMB file share mounting. To map an Azure file share as a network drive over SMB, the client must use one of the supported authentication protocols: storage account key, AD DS identity, Azure AD Kerberos, or a shared access signature only when using the File REST protocol. A SAS URI cannot be supplied as the UNC path in `net use` or File Explorer, and even if it were accepted, it would carry no domain identity, so it cannot meet the requirement for AD DS identity-based authentication.
- ✗
Anonymous access with public network restrictions disabled.
Why it's wrong here
Azure Files does not provide an anonymous-access mode for SMB shares; every connection must be authenticated, and disabling public network restrictions merely widens the network exposure. Anonymous requests would be rejected with an access denied error, so this option is not a viable authentication model. Additionally, turning off network restrictions contradicts the principle of least privilege and increases the attack surface, but it still would not enable anonymous access even if configured.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Identity-based authentication with Active Directory Domain Services.Correct answer▾
Why this is correct
Azure Files can use identity-based authentication so Windows clients access the share with their domain identities instead of storage keys. In an environment that already has Active Directory Domain Services, that is the appropriate configuration for SMB-based access. It supports centralized identity management, aligns with existing Windows admin practices, and avoids embedding account keys in scripts or connection strings.
✗Shared key authentication, because it is the default for Azure file shares.Wrong answer — click to see why▾
Why this is wrong here
Shared key authentication uses the storage account key, not domain credentials, so it does not meet the requirement to mount the share using domain credentials.
★ When this WOULD be the correct answer
When the question asks for the simplest method to authenticate to an Azure file share without requiring domain services, and the environment does not have Active Directory Domain Services or Azure AD DS.
Why candidates choose this
Candidates may assume that the default authentication method (shared key) is sufficient, overlooking the specific requirement for domain credentials.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
File share
A file share is a centralized storage location on a network where multiple users can access, read, write, and manage files simultaneously.
Key term
Azure Files
Azure Files is a cloud-based file sharing service that lets you create and access file shares using the Server Message Block (SMB) protocol or Network File System (NFS) protocol, just like you would access files on a local network drive.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.