An Azure Function App and an Azure Automation runbook both need to upload, read, and delete blobs in one container. You must avoid stored secrets and keep the permissions as limited as possible. Which two configuration choices should you make? Select two.

Store the storage account access key in both app settings and runbook variables.

Account keys are broad secrets that grant more access than needed and create secret-rotation and exposure risks.

Assign Contributor on the storage account because it automatically includes all blob data permissions.

Contributor manages the resource, but it does not provide the required data-plane permissions for blob access.

Use a shared SAS token without an expiration date for both workloads.

A long-lived SAS token is not least privilege and introduces a credential that can be leaked or reused.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create a user-assigned managed identity that can be attached to both Azure resources. — The secure pattern is to use a managed identity so Azure handles the credential lifecycle and no secret is stored in the app or runbook. Because the same identity must work across multiple resources, a user-assigned managed identity is the best fit. Then assign Storage Blob Data Contributor at the container scope to limit access to only the target container and only the blob data plane. This combination meets both security and delegation requirements. Why others are wrong: Using storage keys or a nonexpiring SAS token violates the requirement to avoid stored secrets and grants broader access than necessary. Contributor on the storage account is a management-plane role and does not automatically permit blob data operations. Those options are common mistakes when people confuse data access with resource administration. The correct answer keeps identity reusable, secret-free, and narrowly scoped.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.