AZ-104 Implement and Manage Storage Practice Question
An application uploads documents by using one of the storage account access keys. The team wants to rotate keys without interrupting uploads. Which process should the administrator follow?
⚠ Common exam trap
A common mix-up: candidates think regenerating both keys at once is acceptable, not realizing that the application would lose access immediately, or they may overcomplicate the solution by disabling authorization or recreating the account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Switch the app to the secondary key, regenerate the primary key, and then update the app back later.
It follows the safe key rotation pattern: switch the application to use the secondary key, regenerate the primary key (which invalidates the old primary key), and then later update the application back to the primary key if desired. This ensures the application never loses access during the rotation, as it always has a valid key in use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Regenerate both keys at the same time so the account is fully refreshed.
Why it's wrong here
Simultaneously regenerating both account keys creates an unavoidable window where no valid shared key exists, because the operations are not atomic and any client still holding an old key will immediately receive HTTP 403 (AuthorizationFailure) errors. This removes the only fallback credential, so the application, Azure Functions, AzCopy, and any other service with cached keys all break at once. Staggered rotation with two keys exists specifically to prevent this all-or-nothing failure.
When this WOULD be correct
This option would be correct if the question specified that the application can tolerate downtime or if the keys are not currently in use, and the goal is to refresh both keys without maintaining a fallback.
- ✓
Switch the app to the secondary key, regenerate the primary key, and then update the app back later.
Why this is correct
Azure Storage provides two account keys so you can rotate credentials with no downtime. The correct approach is to move the application to the secondary key first, verify that it works, regenerate the primary key, and then later rotate the app back if needed. This preserves access throughout the process and avoids a period where the application has no valid key.
- ✗
Disable shared key authorization before rotating the keys.
Why it's wrong here
Disabling shared key authorization (setting allowSharedKeyAccess to false) makes all requests authenticated with account keys fail immediately, before any key regeneration even happens. That means the application loses access first, and then you still have to rotate the keys while re-enabling access, which doubles the outage. Disabling shared key access should only be done after every client has migrated to Microsoft Entra ID, never as a step preceding key rotation.
When this WOULD be correct
This option would be correct if the question required enforcing Azure AD authentication only and disabling shared key access as a security best practice, with the application already updated to use Azure AD or managed identities for authentication.
- ✗
Delete the storage account and create a new one with the same name.
Why it's wrong here
Deleting the storage account permanently removes all blobs, tables, queues, files, snapshots, and soft-deleted data, and the same account name cannot be reused immediately because DNS propagation can take minutes to hours. Even if you recreate the account with the same name, the endpoint and both account keys change, forcing every client to reconfigure and risking total data loss unless a full export was performed. This is a catastrophic recovery procedure, not a credential-rotation strategy.
When this WOULD be correct
This option would be correct if the question asked for a method to completely reset all access keys and start fresh, such as after a security breach where keys are compromised and the account is no longer trusted.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Switch the app to the secondary key, regenerate the primary key, and then update the app back later.Correct answer▾
Why this is correct
Azure Storage provides two account keys so you can rotate credentials with no downtime. The correct approach is to move the application to the secondary key first, verify that it works, regenerate the primary key, and then later rotate the app back if needed. This preserves access throughout the process and avoids a period where the application has no valid key.
✗Regenerate both keys at the same time so the account is fully refreshed.Wrong answer — click to see why▾
Why this is wrong here
Regenerating both keys simultaneously would break the application's access immediately, as the app would have no valid key to use during the rotation, causing upload interruptions.
★ When this WOULD be the correct answer
This option would be correct if the question specified that the application can tolerate downtime or if the keys are not currently in use, and the goal is to refresh both keys without maintaining a fallback.
Why candidates choose this
Candidates may think regenerating both keys at once is efficient and 'fully refreshes' the account, overlooking the need for a seamless transition without service disruption.
✗Disable shared key authorization before rotating the keys.Wrong answer — click to see why▾
Why this is wrong here
Disabling shared key authorization before rotating keys would immediately break the application's ability to upload documents, as it relies on access keys. This interrupts uploads, which the question explicitly aims to avoid.
★ When this WOULD be the correct answer
This option would be correct if the question required enforcing Azure AD authentication only and disabling shared key access as a security best practice, with the application already updated to use Azure AD or managed identities for authentication.
Why candidates choose this
Candidates may think disabling shared key authorization is a necessary security step before key rotation, but they overlook that the application currently uses access keys, so disabling them first would cause an outage.
✗Delete the storage account and create a new one with the same name.Wrong answer — click to see why▾
Why this is wrong here
Deleting and recreating the storage account would cause downtime and data loss, which is unnecessary and disruptive for key rotation.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a method to completely reset all access keys and start fresh, such as after a security breach where keys are compromised and the account is no longer trusted.
Why candidates choose this
Candidates may think a clean slate is the safest approach, overlooking the fact that key rotation can be done without deleting the account.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Customer-Managed Keys (CMK) for Storage Encryption
Key term
Switch
A switch is a networking device that connects devices on a local area network and uses MAC addresses to forward data only to the intended recipient.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.