AZ-104 Implement and Manage Storage Practice Question
A Windows VM mounts an Azure Files share by using SMB and identity-based authentication. Which two permission layers can affect access to folders in the share? Select two.
⚠ Common exam trap
It's easy for candidates to confuse network-level controls (NSGs, route tables) with identity-based access controls, or incorrectly assume Blob access tiers apply to Azure Files shares, when in fact only RBAC and NTFS permissions govern folder access in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure RBAC permissions on the file share
Azure RBAC permissions on the file share (Option A) control whether a user or service principal can mount the share or perform management operations, such as listing or modifying share properties. When identity-based authentication is used (Kerberos or Azure AD Kerberos), RBAC roles like 'Storage File Data SMB Share Reader' or 'Contributor' are required to grant access at the share level before any file-level permissions apply.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure RBAC permissions on the file share
Why this is correct
Azure RBAC for Azure Files is the first authorization gate. Roles such as Storage File Data SMB Share Reader, Contributor, or Elevated Contributor map an identity to the share and determine whether it can authenticate for SMB access. This share-level permission is evaluated before any file-level ACLs, and in Azure Files it is required for identity-based authentication to succeed.
- ✓
NTFS permissions on files and folders
Why this is correct
Once share-level RBAC authenticates a user, NTFS ACLs on files and directories provide a second, finer-grained layer of authorization. Even if the RBAC role grants full share access, a per-file NTFS deny or read-only ACE for the user's group can still block modifications. NTFS permissions are evaluated from the file system side and are expressed as allow/deny entries based on the user's SID.
- ✗
Network security group rules on the storage account
Why it's wrong here
Network security group rules are applied to virtual network subnets or VM NICs to filter inbound and outbound IP/port traffic. They can restrict which source IPs can reach the storage account over SMB, but they are not a permission system for share-level or file-level access. NSGs cannot specify a user identity, and the storage service itself is not directly associated with an NSG, so they never grant or deny SMB file access.
When this WOULD be correct
An NSG rule would be correct if the question asked about restricting network access to the storage account from specific IP addresses or subnets, e.g., 'Which component can block SMB traffic to an Azure Files share from a specific IP?'
- ✗
Blob access tier settings
Why it's wrong here
Blob access tier settings—hot, cool, cold, or archive—are optimization options for Azure Blob Storage objects, not for Azure Files SMB shares. These tiers affect storage cost, latency, and retrieval state for blobs, but have no bearing on how an identity is authorized to access a file share. Trying to alter a folder's permission via blob tier settings is impossible because Azure Files does not expose Blob Storage tiers.
When this WOULD be correct
In a question about controlling access to data in Azure Blob Storage (e.g., a storage account with blob containers), the blob access tier (hot, cool, archive) can affect whether data is accessible or requires rehydration, making it a correct answer.
- ✗
Route table next-hop selection
Why it's wrong here
Route tables (UDRs) influence the next hop for traffic leaving a subnet, such as forcing it through a network virtual appliance or firewall. They control the network path, not whether a user is authorized to open an SMB connection or access a specific file. A configured route may allow or block connectivity, but it has no concept of identities or ACLs, so it cannot manage what the user can do after the share is mounted.
When this WOULD be correct
In a scenario where a VM cannot connect to an Azure Files share due to network connectivity issues, and you need to diagnose the problem by checking the effective route table to ensure traffic is directed correctly, route table next-hop selection would be relevant.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure RBAC permissions on the file shareCorrect answer▾
Why this is correct
Azure RBAC for Azure Files is the first authorization gate. Roles such as Storage File Data SMB Share Reader, Contributor, or Elevated Contributor map an identity to the share and determine whether it can authenticate for SMB access. This share-level permission is evaluated before any file-level ACLs, and in Azure Files it is required for identity-based authentication to succeed.
✗Network security group rules on the storage accountWrong answer — click to see why▾
Why this is wrong here
NSG rules apply to network traffic at the subnet or NIC level, not to authentication or authorization for accessing an Azure Files share via SMB. Identity-based access is controlled by Azure RBAC and NTFS permissions, not by NSGs.
★ When this WOULD be the correct answer
An NSG rule would be correct if the question asked about restricting network access to the storage account from specific IP addresses or subnets, e.g., 'Which component can block SMB traffic to an Azure Files share from a specific IP?'
Why candidates choose this
Candidates may confuse network-level security (NSGs) with access control for file shares, assuming that blocking network traffic is equivalent to restricting file access, but NSGs do not affect authenticated SMB sessions.
✗Blob access tier settingsWrong answer — click to see why▾
Why this is wrong here
Blob access tier settings only affect the cost and performance of Azure Blob Storage, not Azure Files. Azure Files uses SMB shares, not blob tiers, so this option has no impact on folder access.
★ When this WOULD be the correct answer
In a question about controlling access to data in Azure Blob Storage (e.g., a storage account with blob containers), the blob access tier (hot, cool, archive) can affect whether data is accessible or requires rehydration, making it a correct answer.
Why candidates choose this
Candidates may confuse Azure Files with Azure Blob Storage, assuming that access tiers apply to all storage types. The term 'access' in the option name suggests it controls permissions, leading to incorrect selection.
✗Route table next-hop selectionWrong answer — click to see why▾
Why this is wrong here
Route table next-hop selection controls network traffic routing between subnets or to on-premises, not access permissions to Azure Files shares. Identity-based access to Azure Files is governed by RBAC and NTFS permissions, not routing.
★ When this WOULD be the correct answer
In a scenario where a VM cannot connect to an Azure Files share due to network connectivity issues, and you need to diagnose the problem by checking the effective route table to ensure traffic is directed correctly, route table next-hop selection would be relevant.
Why candidates choose this
Candidates may confuse network-level access controls (like routing) with identity-based access controls, assuming that network path configuration affects file-level permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
File share
A file share is a centralized storage location on a network where multiple users can access, read, write, and manage files simultaneously.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.