AZ-104 Implement and Manage Storage Practice Question
A Windows VM runs an application that uploads files to a blob container every hour. Security forbids storing storage account keys or long-lived SAS tokens on the VM. The application must be able to write only to that container and nothing else. What should the administrator configure?
⚠ Common exam trap
Candidates often confuse the Contributor role (which grants management-plane access) with the Storage Blob Data Contributor role (which grants data-plane access), and fail to realize that scoping the role to the container level is necessary to restrict access to only that container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Storage Blob Data Contributor to the VM's managed identity at the container scope
It uses Azure RBAC to grant the VM's managed identity the Storage Blob Data Contributor role at the container scope. This allows the application to write only to that specific container without requiring any storage account keys or SAS tokens on the VM, satisfying the security requirement. Managed identities provide an automatically managed service principal in Azure AD, enabling secure authentication to Azure services without storing credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the storage account key in an environment variable on the VM
Why it's wrong here
Storing the storage account key in an environment variable introduces a long-lived symmetric secret directly onto the VM. The key grants full data-plane access to every container, queue, table, and file in the entire storage account, far exceeding the requirement to upload only to one blob container. Additionally, environment variables are visible to any process or user with access to the VM, making the key vulnerable to exfiltration and requiring manual rotation instead of using Azure AD-backed identity.
When this WOULD be correct
If the question had no security restriction against storing keys and required the simplest method to grant an application access to a storage account, storing the key in an environment variable would be a valid approach.
- ✗
Create a service SAS with write permission on the storage account
Why it's wrong here
A service SAS with write permission at the storage account level creates a delegation token scoped to the entire Blob service, meaning the bearer can write to any container in the account, not just the intended one. Even if the SAS is designed for a single service, it is still a shared secret that must be embedded in the app's configuration or URL. Unlike managed identity, a SAS cannot be automatically rotated by Azure AD and is harder to revoke per-resource without invalidating all tokens sharing the same policy.
When this WOULD be correct
If the requirement was to grant write access to all containers in a storage account for a limited time, and the VM could securely retrieve a short-lived SAS token from a vault or generate it at runtime, a service SAS with write permission at the account level would be appropriate.
- ✓
Assign Storage Blob Data Contributor to the VM's managed identity at the container scope
Why this is correct
A managed identity avoids stored credentials, and the Storage Blob Data Contributor role grants blob read/write permissions without exposing account keys. Assigning it at the container scope keeps access limited to one container instead of the whole storage account. This is the least-privilege, Azure-native approach for an app that needs ongoing upload access.
- ✗
Assign Contributor on the storage account to the VM's system-assigned identity
Why it's wrong here
Contributor on the storage account is an Azure Resource Manager (ARM) role that governs control-plane operations such as creating, deleting, or updating the storage account itself. It does not include data-plane permissions, so the VM's managed identity would still be unable to upload blobs to a container. Furthermore, even if data access were included, the account-wide scope violates least privilege because it grants management rights to the entire storage resource instead of limiting access to the specific container.
When this WOULD be correct
If the question required the VM to have full management access to the storage account (e.g., to create/delete containers, manage firewall rules, or perform all data operations) and security constraints allowed broader permissions, then assigning Contributor at the storage account scope to the managed identity would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Storage Blob Data Contributor to the VM's managed identity at the container scopeCorrect answer▾
Why this is correct
A managed identity avoids stored credentials, and the Storage Blob Data Contributor role grants blob read/write permissions without exposing account keys. Assigning it at the container scope keeps access limited to one container instead of the whole storage account. This is the least-privilege, Azure-native approach for an app that needs ongoing upload access.
✗Store the storage account key in an environment variable on the VMWrong answer — click to see why▾
Why this is wrong here
Storing the storage account key in an environment variable violates the security requirement that forbids storing keys on the VM. The key grants full access to the storage account, not just the container.
★ When this WOULD be the correct answer
If the question had no security restriction against storing keys and required the simplest method to grant an application access to a storage account, storing the key in an environment variable would be a valid approach.
Why candidates choose this
Candidates may think environment variables are a secure way to store secrets, or they may default to using keys because it's a familiar method without considering the security constraint.
✗Create a service SAS with write permission on the storage accountWrong answer — click to see why▾
Why this is wrong here
A service SAS with write permission on the storage account would grant write access to all containers within the account, violating the requirement to restrict writes to only that specific container. Additionally, long-lived SAS tokens are forbidden by security policy.
★ When this WOULD be the correct answer
If the requirement was to grant write access to all containers in a storage account for a limited time, and the VM could securely retrieve a short-lived SAS token from a vault or generate it at runtime, a service SAS with write permission at the account level would be appropriate.
Why candidates choose this
Candidates may think a SAS token provides fine-grained access without needing keys, but they overlook that a service SAS at the account level grants broader permissions than needed, and the security policy prohibits long-lived tokens.
✗Assign Contributor on the storage account to the VM's system-assigned identityWrong answer — click to see why▾
Why this is wrong here
Contributor role at the storage account scope grants full management access to the storage account, including the ability to read and write all containers and blobs, which violates the principle of least privilege and the requirement to restrict the application to write-only access to a single container.
★ When this WOULD be the correct answer
If the question required the VM to have full management access to the storage account (e.g., to create/delete containers, manage firewall rules, or perform all data operations) and security constraints allowed broader permissions, then assigning Contributor at the storage account scope to the managed identity would be appropriate.
Why candidates choose this
Candidates may confuse 'Contributor' with a data role, or think that assigning a role to the managed identity is the correct approach but overlook the scope and permission level, assuming Contributor provides sufficient write access without realizing it includes excessive permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.