AZ-104 Implement and Manage Storage Practice Question
You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?
⚠ Common exam trap
Many candidates confuse a SAS with a connection string or access key, mistakenly thinking that any shared credential will work, but the exam specifically tests the ability to grant time-limited, scoped access without exposing the account key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A shared access signature (SAS)
A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account access key
Why it's wrong here
The storage account access key acts as the root secret for the entire storage account, granting full control over blobs, tables, queues, and files, including read, write, delete, and access-control changes. Sharing it with a partner app creates a permanent, broad security exposure that violates least privilege and forces a full key rotation if the secret ever needs to be revoked, far exceeding the single-container upload requirement.
When this WOULD be correct
If the question asked for a method to grant a partner full, unrestricted access to a storage account (e.g., for administrative tasks) and there was no requirement to limit permissions or avoid sharing the key, then providing the storage account access key would be correct.
- ✓
A shared access signature (SAS)
Why this is correct
A shared access signature (SAS) is the correct mechanism because it delegates time-limited, container-scoped permissions—such as write or create—to a partner application without exposing the storage account's key. You can generate a service SAS or a user delegation SAS optionally backed by a stored access policy, which lets you revoke access centrally and restrict the app to a single blob container while preserving least privilege.
- ✗
The connection string with the account key
Why it's wrong here
A connection string that includes the account key embeds the same full-access secret as the raw storage account key, typically with the DefaultEndpointsProtocol and endpoint metadata. Using it in a partner application would permit every operation against every service in the storage account, not just uploads to the target container, and because the key is physical, revoking it would break the partner app and require regenerating keys and redeploying configurations.
When this WOULD be correct
If the question required granting full, permanent access to the storage account (e.g., for a trusted internal application) and did not restrict sharing the account key, providing the connection string with the account key would be appropriate.
- ✗
A Recovery Services vault
Why it's wrong here
A Recovery Services vault is an Azure service for managing backup and disaster recovery workloads, not a storage authorization mechanism. It has no APIs or permissions for granting blob container access, so a partner application cannot use it to authenticate or receive upload credentials—making it entirely irrelevant to this requirement.
When this WOULD be correct
You need to back up on-premises servers or Azure VMs to Azure. A Recovery Services vault would be the correct resource to create and configure for storing backup data and managing recovery points.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A shared access signature (SAS)Correct answer▾
Why this is correct
A shared access signature (SAS) is the correct mechanism because it delegates time-limited, container-scoped permissions—such as write or create—to a partner application without exposing the storage account's key. You can generate a service SAS or a user delegation SAS optionally backed by a stored access policy, which lets you revoke access centrally and restrict the app to a single blob container while preserving least privilege.
✗The storage account access keyWrong answer — click to see why▾
Why this is wrong here
The storage account access key provides full administrative access to the storage account, including all operations on all services. The question explicitly requires that the partner must not receive the storage account key, so providing the key violates the security constraint.
★ When this WOULD be the correct answer
If the question asked for a method to grant a partner full, unrestricted access to a storage account (e.g., for administrative tasks) and there was no requirement to limit permissions or avoid sharing the key, then providing the storage account access key would be correct.
Why candidates choose this
Candidates may think that the access key is the simplest way to grant access to a storage account, overlooking the security requirement to avoid sharing the key and the need for time-limited, scoped permissions.
✗The connection string with the account keyWrong answer — click to see why▾
Why this is wrong here
The connection string with the account key includes the storage account key, which violates the requirement that the partner must not receive the storage account key.
★ When this WOULD be the correct answer
If the question required granting full, permanent access to the storage account (e.g., for a trusted internal application) and did not restrict sharing the account key, providing the connection string with the account key would be appropriate.
Why candidates choose this
Candidates may think a connection string is a secure way to grant access without realizing it exposes the account key, or they may confuse connection strings with SAS tokens.
✗A Recovery Services vaultWrong answer — click to see why▾
Why this is wrong here
A Recovery Services vault is used for Azure Backup and disaster recovery, not for granting temporary access to blob storage. It does not provide any mechanism for uploading files to a blob container.
★ When this WOULD be the correct answer
You need to back up on-premises servers or Azure VMs to Azure. A Recovery Services vault would be the correct resource to create and configure for storing backup data and managing recovery points.
Why candidates choose this
Candidates may confuse 'vault' with a secure storage location and assume it can be used to grant access to storage, or they may misassociate it with Azure Storage security features.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.