Restore Deleted File from Azure File Share Snapshot
An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?
Quick Answer
The answer is a file share snapshot, which is the correct choice because it captures a point-in-time, read-only copy of the Azure file share, enabling granular recovery of individual files without restoring the entire share or relying on a vault-based backup job. When a critical document is accidentally deleted, you simply mount a previous snapshot, locate the deleted file, copy it, and paste it back into the live share—no full restore or Azure Backup vault involvement is needed. On the AZ-104 exam, this question tests your understanding of native Azure Files recovery features versus backup solutions like Azure Backup, with a common trap being to select a restore from a Recovery Services vault, which is unnecessary for single-file recovery. Remember the memory tip: “Snapshot saves single files; vaults restore volumes.”
⚠ Common exam trap
Many exam-takers confuse file share snapshots with Azure Backup (vault-based recovery) or assume that access keys or private endpoints can somehow restore deleted files, when in fact only snapshots provide the granular, point-in-time restore capability for individual files.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.
File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.
Why this is correct
A snapshot is the right recovery tool when you need a point-in-time copy of an Azure file share and want to restore only a specific file. It allows granular recovery without rolling back the entire share, which keeps the impact small and the process simple. This is a common operational use of Azure Files snapshots.
- ✗
A storage account access key, because it can retrieve deleted files from any share version.
Why it's wrong here
An access key controls authorization, not file recovery. It cannot restore deleted file content or create point-in-time copies.
When this WOULD be correct
A question asking how to access an Azure file share from an on-premises server using SMB protocol, where the access key is required for authentication and mounting the share.
- ✗
An Azure VM snapshot, because it captures the file share state automatically.
Why it's wrong here
VM snapshots protect the VM's disks, not an Azure file share. They are the wrong recovery mechanism for a file-share-only deletion.
When this WOULD be correct
When a question asks how to restore a VM's system state or specific files within a VM after accidental deletion or corruption, and the VM has been configured with application-consistent snapshots. For example: 'You need to restore a deleted file from a VM's data disk without using backup vaults.'
- ✗
A private endpoint to the file share, because it enables restore operations.
Why it's wrong here
A private endpoint changes network access to the file share, but it does not provide backup or restore capability for deleted files.
When this WOULD be correct
You need to ensure that all traffic to an Azure file share from a specific virtual network stays within the Microsoft backbone network and never traverses the public internet. In this scenario, a private endpoint is the correct feature to use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.Correct answer▾
Why this is correct
A snapshot is the right recovery tool when you need a point-in-time copy of an Azure file share and want to restore only a specific file. It allows granular recovery without rolling back the entire share, which keeps the impact small and the process simple. This is a common operational use of Azure Files snapshots.
✗A storage account access key, because it can retrieve deleted files from any share version.Wrong answer — click to see why▾
Why this is wrong here
Storage account access keys provide full administrative access to the storage account but cannot retrieve or restore individual deleted files from a file share. They do not support granular file recovery.
★ When this WOULD be the correct answer
A question asking how to access an Azure file share from an on-premises server using SMB protocol, where the access key is required for authentication and mounting the share.
Why candidates choose this
Candidates may confuse access keys with a recovery mechanism, thinking they can be used to 'unlock' or restore deleted files, similar to how keys might enable versioning or snapshot access.
✗An Azure VM snapshot, because it captures the file share state automatically.Wrong answer — click to see why▾
Why this is wrong here
An Azure VM snapshot captures the entire VM's disks, not the file share itself. It cannot be used to restore individual files from an Azure file share because the file share is a separate managed service, not part of the VM's disks.
★ When this WOULD be the correct answer
When a question asks how to restore a VM's system state or specific files within a VM after accidental deletion or corruption, and the VM has been configured with application-consistent snapshots. For example: 'You need to restore a deleted file from a VM's data disk without using backup vaults.'
Why candidates choose this
Candidates may confuse Azure file shares with VM-attached storage, assuming that a VM snapshot includes the file share if the VM is connected to it, or they may think snapshots are a universal recovery mechanism for all Azure storage types.
✗A private endpoint to the file share, because it enables restore operations.Wrong answer — click to see why▾
Why this is wrong here
A private endpoint provides secure, private connectivity to the file share over a virtual network, but it does not have any capability to restore deleted files or perform data recovery operations.
★ When this WOULD be the correct answer
You need to ensure that all traffic to an Azure file share from a specific virtual network stays within the Microsoft backbone network and never traverses the public internet. In this scenario, a private endpoint is the correct feature to use.
Why candidates choose this
Candidates may confuse 'private' with 'protected' or assume that private endpoints offer data protection features like snapshots or backups, when in fact they only control network access.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user accidentally deleted a folder tree from an Azure file share. The administrator needs to restore only the deleted folders to the state they had yesterday, not roll back the whole share. Which feature should be used?
medium- A.Restore the entire storage account from an account-level backup.
- ✓ B.Use a file share snapshot and copy the needed folders back from it.
- C.Enable blob versioning on the storage account and recover the folders from versions.
- D.Create a shared access signature with read permissions and use it to recover the folder tree.
Why B: Azure file share snapshots provide a point-in-time, read-only copy of the share. By mounting a snapshot taken yesterday, the administrator can browse the folder tree and copy only the deleted folders back to the live share, restoring them without affecting other data. This is the only option that allows granular, folder-level recovery without rolling back the entire share or storage account.
Variation 2. A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?
medium- ✓ A.Use a file share snapshot and copy the deleted folder tree back into the live share.
- B.Delete the current share and restore the whole share from the most recent backup.
- C.Change the share’s access tier from Hot to Cool and then refresh the folder view.
- D.Enable soft delete for blobs in the same storage account and recover the folder from there.
Why A: Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.
Variation 3. An employee accidentally deletes several folders from an Azure file share. The administrator must recover only those folders from yesterday, not roll back the whole share. What should the administrator use?
easy- ✓ A.A snapshot of the Azure file share from yesterday
- B.The storage account access key
- C.A shared access signature
- D.A private endpoint to the storage account
Why A: To recover the deleted folders, use an Azure file share snapshot that was created before the deletion (for example, yesterday). Mount that snapshot, copy the deleted folders back to the live share, and then unmount the snapshot. This provides granular, file-level recovery without rolling back the entire share.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.