AZ-104 Implement and Manage Storage Practice Question
A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?
⚠ Common exam trap
Candidates often assume NFS is the only cross-platform option for Linux and Windows, overlooking that Azure Files SMB with AD DS authentication supports both operating systems when domain-joined.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.
Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.
Why this is correct
This provides password-based domain authentication for SMB access without using storage keys or SAS. Both Windows and Linux clients can mount the share when they are domain joined and the share permissions are assigned correctly.
- ✗
Use a private endpoint and rely on network isolation instead of authentication.
Why it's wrong here
A private endpoint only removes the file share from the public internet by assigning a private IP inside your virtual network; it does not authenticate the user or computer attempting to access the SMB share. Without identity-based authentication, Azure Files still requires a storage account key or SAS for the SMB client, which the scenario explicitly disallows. Network isolation should be used in addition to, not instead of, Active Directory authentication and share-level permissions.
When this WOULD be correct
If the question required secure network access to Azure Files without traversing the public internet, and authentication was handled separately (e.g., via AD DS), a private endpoint would be correct.
- ✗
Use the storage account access key because SMB requires shared-key authentication.
Why it's wrong here
The storage account access key is a shared secret that grants full administrative control over the entire storage account, far exceeding the least-privilege share permissions requested. SMB access to Azure Files does not require shared-key authentication; when the storage account is domain-joined, clients can authenticate with Kerberos using their AD DS identity. Since the requirement explicitly bans storage keys and SAS, using the access key is disallowed and also bypasses the AD group permission model.
When this WOULD be correct
A question that asks for the simplest method to mount an Azure Files share for a single Windows VM without any authentication restrictions, and the security policy does not forbid using storage account keys.
- ✗
Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.
Why it's wrong here
Azure Files NFS shares run over the NFS 4.1 protocol and are supported only on Linux/Unix clients; Windows SMB clients cannot mount an NFS share, so this fails the mixed Windows + Linux requirement. Moreover, NFS authentication does not use AD DS identity-based authentication for SMB, meaning you would not get Kerberos-based access with the required AD group. Even if the Linux side works, the Windows VM would have no supported access path under this design.
When this WOULD be correct
If the question specified that only Linux clients need to mount the Azure Files share and SMB is not required, or if the environment uses NFSv4.1 and does not include Windows clients, then NFS authentication would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.Correct answer▾
Why this is correct
This provides password-based domain authentication for SMB access without using storage keys or SAS. Both Windows and Linux clients can mount the share when they are domain joined and the share permissions are assigned correctly.
✗Use a private endpoint and rely on network isolation instead of authentication.Wrong answer — click to see why▾
Why this is wrong here
Network isolation via a private endpoint does not authenticate users or satisfy the security policy forbidding storage account keys and SAS tokens; it only restricts network access.
★ When this WOULD be the correct answer
If the question required secure network access to Azure Files without traversing the public internet, and authentication was handled separately (e.g., via AD DS), a private endpoint would be correct.
Why candidates choose this
Candidates may confuse network security (private endpoint) with authentication, thinking that restricting network access alone meets the security requirement.
✗Use the storage account access key because SMB requires shared-key authentication.Wrong answer — click to see why▾
Why this is wrong here
The question explicitly forbids storage account keys, and SMB with Azure Files does not require shared-key authentication when using AD DS authentication.
★ When this WOULD be the correct answer
A question that asks for the simplest method to mount an Azure Files share for a single Windows VM without any authentication restrictions, and the security policy does not forbid using storage account keys.
Why candidates choose this
Candidates may mistakenly believe that SMB inherently requires shared-key authentication, overlooking that Azure Files supports Kerberos-based authentication with AD DS.
✗Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.Wrong answer — click to see why▾
Why this is wrong here
Azure Files NFS authentication is not supported for Windows clients, and the question requires both Windows and Linux VMs to mount the same share over SMB, not NFS.
★ When this WOULD be the correct answer
If the question specified that only Linux clients need to mount the Azure Files share and SMB is not required, or if the environment uses NFSv4.1 and does not include Windows clients, then NFS authentication would be correct.
Why candidates choose this
Candidates may mistakenly believe that NFS is the universal protocol for cross-platform file sharing, overlooking that Azure Files NFS is Linux-only and incompatible with Windows SMB requirements.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
Key term
Azure Files
Azure Files is a cloud-based file sharing service that lets you create and access file shares using the Server Message Block (SMB) protocol or Network File System (NFS) protocol, just like you would access files on a local network drive.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.
easy- ✓ A.Storage account key
- ✓ B.Active Directory Domain Services credentials
- C.Blob SAS token
- D.Network security group rule
- E.Azure resource lock
Why A: The storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.