CCNA Implement and Manage Storage Questions

LRS only replicates data within a single data center in the primary region, providing no redundancy for a regional outage. The business requirement is for readable secondary region access, which LRS cannot fulfill.

ZRS replicates data synchronously across availability zones within a single region, providing no geo-redundancy or read access to a secondary region if the primary becomes unavailable.

Archive is a blob access tier, not a redundancy option. It does not provide replication or read access to a secondary region.

Granting Contributor access on the storage account gives the partner full control over the entire storage account, including all containers and blobs, and allows management operations like deleting the account. This exceeds the requirement of write access to a single container for only 24 hours and violates the principle of least privilege.

Sharing the storage account access key grants full administrative access to the entire storage account, not just the single container, and violates the requirement to not share the key.

Enabling anonymous public write access on the container would allow anyone on the internet to write to the container, violating security requirements and providing uncontrolled access beyond the intended partner.

A full VM restore would restore the entire virtual machine, not just a single deleted file from a file share. It is excessive and does not target the specific file.

A metric alert rule monitors performance metrics (e.g., CPU, memory) and triggers notifications; it cannot restore files from a backup.

A private endpoint provides secure connectivity to Azure services over a private IP address, but it does not enable file-level restore from Azure Backup recovery points.

Embedding the storage account key in application settings violates the requirement to avoid storing keys in code, as the key would still be stored in a configurable setting that could be exposed.

Using the public endpoint with anonymous access would allow anyone to upload files without authentication, violating the requirement to avoid storing credentials but failing to provide secure, authenticated access.

The archive tier is for cost-effective storage of infrequently accessed data with retrieval delays, not for authentication. It does not address the requirement to avoid storing credentials in code.

GRS replicates data to a paired secondary region, which provides cross-region replication. The question explicitly states that cross-region replication is not needed, so GRS is unnecessary and does not meet the requirement of keeping data available if an entire availability zone fails without cross-region replication.

RA-GRS provides read-access to a secondary region during a regional outage, but the question explicitly states that cross-region replication is not needed. Additionally, RA-GRS does not protect against an entire availability zone failure in the primary region because it relies on LRS within the primary region.

BlobStorage accounts do not support Azure Files, which is required for the shared working directory accessible by both Windows and Linux VMs. They also lack lifecycle management and private endpoint support.

FileStorage is a premium-only account kind for Azure Files, lacking blob support and lifecycle management, and does not meet the 'standard performance' requirement.

BlockBlobStorage is designed for high-throughput workloads with premium performance and does not support Azure Files, lifecycle management, or standard performance tier, all of which are required in this scenario.

BlobStorage accounts support only block blobs and append blobs, not Azure Files shares or lifecycle management rules.

FileStorage accounts support only Azure Files shares and do not support blob containers or lifecycle management rules for blob data.

BlockBlobStorage is optimized for high-throughput block blob workloads and does not support Azure Files shares or lifecycle management rules for blob data.

Hot tier is the highest-cost online tier, not the lowest-cost. The question asks for the lowest-cost online tier that still allows immediate reads, which is Cold, not Hot.

Cool tier has higher storage cost than Cold tier and is not the lowest-cost online tier for infrequently accessed data. The question specifically asks for the lowest-cost online tier that allows immediate reads, and Cold tier meets that requirement at a lower storage cost than Cool.

Archive tier requires rehydration (which can take hours) before data can be read, violating the requirement for immediate availability without waiting.

The storage account access key grants full access to the entire storage account, not just one container, and does not have a built-in time limit. This violates the requirement to grant only minimum permissions and avoid sharing the key.

A shared key rotation policy is not a valid Azure access method; it refers to rotating storage account keys, not granting time-limited access to a specific container.

A user-assigned managed identity cannot be assigned to a contractor's laptop; managed identities are designed for Azure resources like VMs or App Services, not external devices. It also requires complex authentication setup and does not inherently provide time-limited access to a specific container.

The question explicitly states the security team does not want a private endpoint or private DNS zone, and they are fine with the storage account using its public FQDN. Option B requires a private endpoint and disabling public network access, which contradicts these requirements.

NSG rules control traffic at the subnet or NIC level but do not restrict access to the storage account's public endpoint from other subnets; the storage account firewall must explicitly allow only the desired subnet.

Associating a route table that sends storage traffic to an Azure firewall appliance does not restrict access to only one subnet; it only redirects traffic but does not enforce subnet-level access control. The storage account would still be accessible from any subnet unless additional firewall rules are applied.

Sharing the storage account key grants full access to all storage account resources, including all containers and blobs, with no time or permission restrictions. This violates the requirement to minimize access scope and avoid sharing the key.

A container stored access policy without a token does not provide any access; it only defines constraints. To grant access, a SAS token must be generated and attached to the policy, which is not done here.

Azure Policy assignments enforce compliance rules across resources but do not grant direct write access to a blob container. They cannot provide time-limited, scoped access to a specific container.

ZRS replicates data synchronously across availability zones within a single region, not to a paired Azure region, so it does not meet the requirement for cross-region disaster recovery.

LRS only replicates data within a single datacenter in the primary region, so it does not copy data to a paired Azure region, failing the requirement for automatic cross-region replication.

Cool is an access tier for Azure Blob Storage, not a redundancy option for Azure Files. It does not provide replication to a paired region or read access to a secondary copy.

The question requires access over the public endpoint, but a private endpoint assigns a private IP address from the subnet, bypassing the public endpoint entirely. This contradicts the requirement to use the public endpoint.

The question requires restricting access to the storage account's public endpoint to only a specific subnet. Allowing trusted Microsoft services bypasses the firewall, which would grant access to other Azure services (e.g., Azure Backup, Azure Logic Apps) that are not part of the subnet, violating the restriction.

A user-defined route (UDR) directing storage traffic to a virtual network gateway would force traffic through the gateway, but the question requires access over the public endpoint without using a private IP. UDRs do not restrict access to a specific subnet; they only control routing, not firewall rules.

The question explicitly requires avoiding secrets in application settings and authenticating without a password or access key. Storing the storage account key in app configuration violates both requirements, as the key is a secret and must be stored securely.

The question requires authenticated uploads without secrets; anonymous public containers allow unauthenticated access, violating the requirement to avoid secrets and potentially exposing the container to unauthorized uploads.

The question requires passwordless authentication without secrets, but a shared access signature (SAS) is derived from a storage account key, which is a secret. The SAS itself must be stored or generated at runtime, introducing a secret management issue.

A private endpoint assigns a private IP to the storage account, which contradicts the requirement that 'no private IP is required' and that the storage account must stay reachable through its public endpoint.

A VPN gateway is used for site-to-site or point-to-site connectivity over the internet, not for allowing Azure workloads in a subnet to access a storage account via its public endpoint. It adds unnecessary complexity and cost, and does not provide the required network-level access control.

The storage account already has a public endpoint; assigning a public IP address is not a configuration option for Azure storage accounts and does not restrict access to AppSubnet.

The storage account access key provides full control over the storage account, but it must be stored on the machine to authenticate requests, which violates the requirement of not storing the key on the machine.

A service SAS generated from the account key still requires the storage account key to create it, and the key is stored on the machine or in the code, violating the constraint of not storing the key.

Anonymous public access allows anyone to read blob data without authentication, but it does not involve any authentication method for an app; the app would simply access the data without storing a key, but the question requires an authentication method, not the absence of one.

A service SAS generated from the storage account key does not support time-limited access with Microsoft Entra ID authentication, and it exposes the storage account key if the SAS is not properly scoped. The question requires a user delegation SAS for time-limited access to a single container.

Making the container public would grant anonymous access to all users, violating the requirement for time-limited access to a specific partner.

Assigning Storage Blob Data Contributor on the storage account grants permanent, broad access to all containers, not time-limited access to a single container as required.

Hot tier is designed for frequently accessed data and has the highest storage cost, which contradicts the requirement to minimize cost for almost never accessed files.

Archive tier requires rehydration (up to 15 hours) to read data, but the question states files must be readable immediately without waiting. Thus, Archive cannot meet the availability requirement.

Assigning the role at the subscription scope grants the engineer permissions to manage all virtual machines in the subscription, violating the requirement to restrict access to only VM-App01.

Assigning the role at the resource group scope would grant the engineer permissions to start, stop, and resize all virtual machines within that resource group, not just VM-App01, violating the requirement to restrict access to only VM-App01.

Assigning the role at a management group scope would grant permissions to all subscriptions and resources under that management group, far exceeding the requirement to restrict access to only VM-App01.

Azure blob containers cannot be mounted as a file system using standard protocols like SMB or NFS; they are object storage accessed via HTTP/HTTPS, not a shared file system for concurrent VM access.

Azure managed disks cannot be attached to multiple VMs simultaneously; they support single-VM attachment only, so both VMs cannot access the same shared folder concurrently.

Azure Files supports both SMB and NFS protocols, but a single share can only use one protocol. Forcing the Linux VM to use NFS while Windows uses SMB on the same share is not supported; both VMs must use the same protocol (SMB) for cross-platform access.

An availability set is a logical grouping of VMs to ensure high availability across fault domains and update domains; it does not provide point-in-time copies of disks.

An image is a template used to create new VMs, not a point-in-time copy of an existing disk for backup or restore purposes.

A resource lock prevents accidental deletion or modification of a resource, but it does not create a point-in-time copy of the disk data. It cannot be used to restore the disk to a previous state after a change fails.

The write action allows modifying all VM settings, which exceeds the required permissions of only starting, stopping, and viewing state.

The delete action would allow the help desk group to remove the VM entirely, which is beyond the required permissions of starting, stopping, deallocating, and viewing state.

Archive tier is designed for data that is rarely accessed and has a retrieval latency of hours, making it unsuitable for daily downloads by developers.

Cool tier is designed for data that is infrequently accessed but still requires low latency, not for daily downloads. The artifacts are actively used every day for a week, which requires the high throughput and low latency of Hot tier.

Cold tier is designed for data accessed rarely (e.g., once every 90+ days) and has higher retrieval costs and latency, making it unsuitable for daily downloads during the first week after release.

Blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to Hot or Cool tier, which takes time. Downloading immediately would fail.

A snapshot captures the blob's state at a point in time but does not change its access tier; if the blob is in Archive tier, the snapshot remains in Archive and cannot be read without rehydration.

Blobs in Archive tier are offline and cannot be read or copied directly. Copying without changing the tier would fail because the source blob is not available for read operations.

A storage account access key grants full administrative access to the entire storage account, not temporary, read-only access to a single blob. It also violates the requirement to avoid giving the account key.

A resource lock prevents deletion or modification of resources but does not grant any access permissions, so it cannot provide read access to a blob.

A private endpoint provides secure, private connectivity to the storage account over a VNet, but does not grant temporary read access to a single blob for an external partner without an account key.

Managed identities are an Azure feature that cannot be assigned to on-premises servers; they only work for Azure resources like VMs or App Services. The build server is not in Azure, so a managed identity is not applicable.

Managed identities are an Azure feature that cannot be assigned to on-premises servers; they only work with Azure resources like VMs or App Services. The question explicitly states the server is not in Azure.

A shared access signature (SAS) provides delegated access to Azure Storage resources, not to ARM template deployment. It cannot authenticate to Azure Resource Manager for deploying templates to a resource group.

Storing an account SAS token on the VM violates the security requirement that prohibits storing account keys or SAS tokens on the VM. The question explicitly forbids this approach.

The Reader role only allows read access to the storage account, not write access to a blob container. The app needs to upload invoices (write blobs), so Reader is insufficient.

Storage Account Contributor at subscription scope grants full management access to all storage accounts in the subscription, far exceeding the principle of least privilege required for the app to only write blobs in one container. It also does not restrict the app to blob write operations only.

Assigning Virtual Machine Contributor at subscription scope grants permissions to all VMs in the subscription, not just RG-App, and includes actions like delete VM and manage disks, exceeding the required permissions.

The built-in Reader role only allows viewing resources, not starting, stopping, or deallocating VMs. Portal buttons for these actions require write permissions, so the team would be unable to perform the required operations.

The built-in Contributor role includes permissions to delete resources, read NIC settings, and manage disks, which violates the requirement to restrict these actions.

Immutable storage prevents any modifications or deletions to blobs during the retention period, which conflicts with the requirement to allow updates to existing blobs.

Moving the account to premium performance does not address accidental deletion; it only improves latency and throughput for workloads requiring consistent low-latency access, not data protection against deletion.

Enabling static website hosting only does not prevent accidental deletion; it merely configures the storage account to serve static content. It provides no protection against blob deletion.

LRS replicates data three times within a single datacenter, so it cannot survive a zone failure because an entire zone (which includes multiple datacenters) could be lost.

GRS replicates data to a secondary region, but the question explicitly states that a secondary region replica is not needed. The requirement is only to survive a zone failure within the same region, which ZRS handles.

ZRS replicates data synchronously across three availability zones within a single region, but it does not provide a copy in a paired region for disaster recovery, which is explicitly required.

GRS provides zone-redundant storage only in the primary region, not across availability zones, and replicates to a paired region for disaster recovery. However, it does not survive a failure of any one availability zone because GRS uses LRS in the primary region, which is not zone-redundant.

RA-GRS provides read access to the secondary region, but the question states no one needs to read from the secondary region unless a disaster recovery event occurs, so the extra read access is unnecessary and not the best fit.

A ReadOnly lock prevents all write operations, including updates and patching, which contradicts the requirement that administrators must still be able to update settings and apply patches.

A policy assignment denies delete operations but does not prevent modification of settings or patching; however, the question specifically asks for a lock, not a policy. Locks are simpler and apply uniformly, while policies require explicit definition and can be overridden by RBAC if not properly configured.

RBAC permissions alone do not prevent accidental deletion; users with Contributor or Owner roles can delete resources. A lock is needed to enforce deletion protection beyond RBAC.

Blobs in Archive tier are offline and cannot be read directly; a normal read operation fails. You must first rehydrate the blob to an online tier (e.g., Cool) before downloading.

Setting blobs to Hot tier permanently increases costs significantly, as Archive is the cheapest tier for long-term storage. The requirement is to return to the lowest practical storage cost after the review, not to keep them in Hot tier.

RA-GRS provides geo-redundant read access, but Archive blobs are offline and cannot be read directly regardless of redundancy. The blobs must first be rehydrated to an online tier.

Using the storage account access key grants full management access to the storage account, not just blob data permissions, and requires storing a secret in the application settings, violating the requirement to avoid storing secrets.

The Contributor role grants full management access to the storage account, including the ability to delete or modify the account itself, which violates the requirement to grant only blob data permissions and not storage management permissions.

Service endpoints secure traffic to the storage account from a virtual network but do not authenticate the app or grant data permissions; they are a network-level control, not an identity-based authentication mechanism.

The storage account access key provides full administrative access to the storage account, including all operations on all services. The question explicitly requires that the partner must not receive the storage account key, so providing the key violates the security constraint.

The connection string with the account key includes the storage account key, which violates the requirement that the partner must not receive the storage account key.

A Recovery Services vault is used for Azure Backup and disaster recovery, not for granting temporary access to blob storage. It does not provide any mechanism for uploading files to a blob container.

GRS replicates data to a paired region, which provides durability across regions but does not protect against a single availability zone failure within the primary region; it also incurs higher cost and latency than needed.

RA-GRS provides read access to a secondary region, but the requirement states no automatic read access from another region is needed. Additionally, RA-GRS does not protect against a single availability zone loss within the primary region; it only protects against region-level failures.

Option B is wrong because enabling forwarded traffic alone does not allow the spoke VNet to use the hub's VPN gateway. Gateway transit must be enabled on the hub peering, and the spoke must use remote gateways to route traffic through the hub's gateway.

Option C reverses the required settings: gateway transit must be enabled on the hub (where the gateway resides) and use remote gateways on the spoke. Enabling use remote gateways on the hub would attempt to use a non-existent gateway in the spoke, and gateway transit on the spoke would not allow the spoke to use the hub's gateway.

A private endpoint enables secure connectivity to a specific Azure service (e.g., Storage, SQL) over the Microsoft backbone, not transitive routing to on-premises networks through a VPN gateway. It does not provide network-level routing between VNets or to on-premises.

Blob soft delete and SAS tokens are for Azure Blob Storage, not Azure Files. The question requires mounting an Azure file share with AD credentials, not using a storage account key or SAS.

Enabling a service endpoint for Microsoft.Storage on the subnet restricts access to the storage account from that subnet but does not enable Active Directory authentication for Azure Files. The question requires identity-based authentication using AD DS credentials, which service endpoints do not provide.

Creating a shared access signature (SAS) for the file share and mapping it as a local drive still uses a SAS token for authentication, not Active Directory Domain Services credentials. The question requires using existing AD DS credentials, which SAS does not support.

LRS only replicates within a single datacenter, so it does not protect against an availability zone failure in the primary region (since zones span multiple datacenters) and provides no secondary region for read access if the primary region becomes unavailable.

RA-GRS does not provide zone redundancy in the primary region; it only replicates to a single physical location in the primary region. If the primary region's single zone fails, the app may lose availability until failover occurs.

GZRS provides zone redundancy in the primary region and geo-replication, but it does not allow read access to the secondary copy; only RA-GZRS offers that read access, which is required for administrators to read the secondary copy if the primary region fails.

Creating a snapshot of an archived blob does not rehydrate the blob; the snapshot itself is also in the Archive tier and cannot be read until the base blob is rehydrated.

Enabling versioning does not make an archived blob readable; it only preserves previous versions. The blob remains in the Archive tier and must be rehydrated to Hot or Cool before access.

Moving the storage account to LRS redundancy does not affect the Archive tier's requirement for rehydration before reading. The blob remains in the Archive tier and must be changed to Hot or Cool and rehydrated.

Assigning Reader at the storage account scope grants read access to all containers and blobs, not just the invoices container, violating the requirement for least privilege.

Storage Account Contributor at the resource group scope grants full management access to the storage account, including the ability to delete or modify configurations, but does not grant data access (e.g., reading blobs). It would over-privilege John and fail to meet the requirement of read-only blob download from a specific container.

BlobStorage does not support Azure Files shares, which are required by the development team.

FileStorage is a premium-only account kind designed for high-performance file shares and does not support blob containers, lifecycle management, or access tiers.

BlockBlobStorage is a premium account kind optimized for block blobs with low latency, but it does not support Azure Files shares or standard performance tiers, and it lacks lifecycle management features.

GZRS provides geo-redundancy with zone-level resilience but does not offer read access to the secondary region during an outage; it requires a failover to access the replica, which does not meet the requirement for immediate read-only access while planning failover.

ZRS replicates data synchronously across three availability zones within a single region, providing zone-level fault tolerance but no protection against a regional outage. The question requires read-only access during a regional outage, which ZRS cannot provide.

Azure RBAC role assignments grant persistent permissions and do not automatically expire, so they cannot enforce a 12-hour time limit for access.

A private endpoint provides secure, private connectivity to Azure services over a private IP address, but it does not provide time-limited access or automatic expiration for external partners.

A storage account lock prevents deletion or modification of the storage account but does not provide time-limited, granular access to a specific blob container without sharing the account key.

This option requires manual deletion after each audit cycle, which violates the requirement to avoid manual intervention. Additionally, keeping blobs in Hot tier permanently incurs higher storage costs than using Cool tier after 30 days.

Archive tier requires a rehydration job (which can take hours) to make blobs readable, contradicting the requirement that files must be readable immediately when an auditor needs them.

Premium block blob storage is designed for low-latency and high-performance workloads, not for cost-effective long-term archival storage. Snapshots add additional costs and do not address the need for immediate readability without rehydration, making this option more expensive and unnecessary for quarterly audits.

A storage account access key grants full access to all containers in the storage account, not just one container. It cannot be scoped to a single container, and revoking it would affect all containers.

Anonymous public access cannot be time-limited and would allow anyone to access the container without authentication, violating the requirement to revoke access after 8 hours.

Azure RBAC on the storage account does not automatically expire after a few hours; it requires manual removal. It also cannot be scoped to a single container without additional configuration, and it does not provide the temporary, revocable access needed for this scenario.

This option only restricts access by IP address, but the storage account would still have a public IP and public endpoint, failing the requirement for a private IP address and disabled public network access.

A service endpoint does not assign a private IP address to the storage account; it only allows traffic from the subnet via the public endpoint while keeping public access enabled, which violates the requirement to disable public network access.

VNet peering connects virtual networks, but does not assign a private IP to the storage account or disable public access. The storage account would still have a public endpoint, and peering alone does not restrict access to a single VNet.

ZRS provides synchronous replication across multiple availability zones within a region, which is more expensive than LRS and offers more protection than needed for non-critical data that only requires protection against local disk or server failure within a single datacenter.

GRS replicates data to a paired secondary region, providing higher durability but at a higher cost. The question specifies lowest-cost redundancy for non-critical data needing only protection against local failures within a single datacenter, so GRS is overkill and more expensive.

GZRS (Geo-Zone-Redundant Storage) provides redundancy across multiple datacenters in different regions, which is overkill and more expensive than needed for the requirement of only protecting against local disk or server failure within a single datacenter.

ZRS provides zone redundancy but does not include geo-replication; it does not maintain a secondary copy in another region, let alone one that is readable during an outage.

GRS does not provide zone redundancy in the primary region; it only replicates data to a secondary region. The question requires zone resilience in the primary region, which GRS lacks.

LRS only replicates data within a single data center, providing no zone resilience or geo-replication, which fails to meet the requirement for zone resilience in the primary region and a readable geo-replicated secondary copy.

The storage account key grants full administrative access to the entire storage account, not just a single container, violating the requirement to limit access to one container. It also exposes the key to the partner, which is prohibited.

RBAC roles at the management group scope apply to all subscriptions and resources under that group, not to a single blob container. To restrict access to one container, you would need a role assignment at the container scope, which is not possible with management groups.

A private endpoint does not grant write access or any permissions by itself; it only provides a private IP connection to the storage account. Access control is still managed via keys, SAS, or RBAC, and it does not limit access to a single container.

ZRS only replicates data synchronously across availability zones within a single region, providing no read access to a secondary region for reporting during a primary region outage.

GZRS does not provide read access to the secondary region by default; it requires a manual failover to enable read access. The question requires read-only access to the secondary region even when the primary is unavailable, which only RA-GZRS provides.

RA-GRS does not provide zone redundancy; it only replicates data to a single datacenter in the primary region, so it cannot survive a zone outage.

Blobs in the archive tier are offline and cannot be read directly; they must be rehydrated to an online tier first. The archive endpoint does not provide immediate read access, and request rate is not relevant.

Azure Blob Storage archive tier does not delete blobs; it keeps them in an offline state. The file is still present but requires rehydration before reading.

Premium Block Blob storage is designed for low-latency workloads and does not support Azure Files shares, which require standard performance tiers. The question specifies standard performance is sufficient, so Premium is unnecessary and incompatible.

Creating a separate file server VM adds unnecessary cost and management overhead, and does not address the requirement to host an Azure Files share within the same storage account as the blob containers, which is only possible with a StorageV2 account.

NSG rules apply to network traffic at the subnet or NIC level, not to authentication or authorization for accessing an Azure Files share via SMB. Identity-based access is controlled by Azure RBAC and NTFS permissions, not by NSGs.

Blob access tier settings only affect the cost and performance of Azure Blob Storage, not Azure Files. Azure Files uses SMB shares, not blob tiers, so this option has no impact on folder access.

Route table next-hop selection controls network traffic routing between subnets or to on-premises, not access permissions to Azure Files shares. Identity-based access to Azure Files is governed by RBAC and NTFS permissions, not routing.

The Hot tier is designed for frequently accessed data and has higher storage costs, which contradicts the requirement to minimize storage cost for rarely accessed reports.

Archive tier has the lowest storage cost but retrieval times can be hours (up to 15 hours for standard priority), which violates the requirement that reports must be read within seconds.

Premium tier is designed for low-latency, high-transaction workloads (e.g., interactive apps), not for rarely accessed data. It costs significantly more than Cool and does not provide cost savings for infrequent access.

Option A is wrong because 'disable gateway transit' would prevent the spoke from using the hub's VPN gateway, and 'enable forwarded traffic' alone does not allow the spoke to use the hub gateway for on-premises connectivity.

Creating a second VPN gateway in the spoke defeats the purpose of using hub gateway transit, as it adds cost and complexity. The requirement is to avoid deploying a separate gateway in the spoke.

Service endpoints are used to secure Azure service access from a subnet to a service (e.g., Storage, SQL) over the Azure backbone, not to route traffic to a VPN gateway or enable gateway transit.

LRS replicates data within a single data center in a single availability zone, so it cannot survive a zone failure. The question requires availability across zones in the primary region.

Geo-redundant storage (GRS) replicates data to a secondary region, but the question explicitly states that replication to another region is not needed. GRS also does not protect against a single availability zone failure in the primary region because it uses LRS in the primary region.

RA-GRS replicates data to a secondary region, but the question explicitly states no replication to another region is needed, and it does not protect against a single availability zone failure in the primary region.

The question explicitly states the security team does not want a private IP or DNS changes, and they want to use the public endpoint. A private endpoint assigns a private IP and changes DNS resolution, contradicting these requirements.

Attaching a route table that sends storage traffic to the internet does not restrict access to only AppSubnet; it merely forces traffic to the internet, which is the default behavior and does not enforce subnet-level access control.

A Reader role assignment grants read-only access to the storage account resource itself, not network access to the data plane. It does not control which subnets can reach the storage account's public endpoint.

LRS replicates data only within a single datacenter, not to a paired region, so it does not survive a regional outage or provide a secondary endpoint for read access.

GRS replicates data to a paired region for regional disaster recovery, but it does not provide read access to the secondary copy unless a failover occurs. The question requires analysts to read the secondary copy through the secondary endpoint without waiting for failover, which only RA-GRS supports.

LRS replicates data within a single availability zone, so it cannot survive an entire zone outage, which is the requirement in this question.

Geo-redundant storage (GRS) replicates data to a secondary region, not within the same region's availability zones. It protects against region-wide outages, not zone failures within a single region.

RA-GRS provides read access to a secondary region, but the question requires availability during an availability zone outage within the same region, not a regional disaster. RA-GRS does not protect against zone failures because it relies on regional replication, not zone-level redundancy.

Blobs in the Archive tier are offline and cannot be read directly. They must first be rehydrated to Hot or Cool tier, which takes time, before any download is possible.

Disabling the lifecycle management policy does not change the access tier of the blob; the blob remains in the Archive tier and is still unavailable for reading until rehydrated.

Creating a new container and copying the archived blob does not change its Archive tier status; the blob remains in the Archive tier and cannot be read until rehydrated. The correct process is to change the tier to Hot or Cool and wait for rehydration.

Blob versioning preserves previous versions of blobs but does not restrict network access to a specific subnet; it does not meet the requirement to block public network access.

Assigning a ReadOnly lock prevents modifications to the storage account but does not restrict network access; it does not block public endpoints or enforce private connectivity.

A shared access signature (SAS) provides delegated access to storage resources but does not restrict access to a specific subnet or disable public network access; it still relies on the public endpoint.

LRS replicates data three times within a single datacenter, not across availability zones. It does not protect against an entire availability zone failure, which is the requirement in the question.

GRS replicates data to a secondary region, not across availability zones within the same region, so it does not protect against a single zone failure in the primary region.

RA-GRS provides read access to a secondary region, not availability zone resilience. The question requires availability within a single region if one zone fails, which ZRS provides, not RA-GRS.

ZRS replicates data synchronously across three availability zones in a single region, but does not provide a secondary region for disaster recovery. The requirement for reading from a secondary region immediately after a primary region outage is not met.

GZRS replicates data to a secondary region asynchronously, but it does not provide read access to the secondary region unless a failover is initiated. The requirement to read from the secondary region immediately after a primary region outage, without waiting for failover, necessitates RA-GZRS.

RA-GRS provides read-access to a secondary region during a primary region outage, but it does not guarantee data survival after a single availability zone outage in the primary region because GRS replicates across regions, not zones, and a zone failure could still cause data loss if the primary region has only one zone.

The Cool access tier is immediately readable, but the blob is currently in the Archive tier. Changing to Cool alone does not trigger rehydration; the blob remains frozen until explicitly rehydrated to Hot or Cool, which takes hours. Thus, it won't be readable by tomorrow morning.

Snapshots of an archived blob are also in the archived state and are not immediately readable; they must be rehydrated first, which does not solve the requirement for immediate access tomorrow morning.

Enabling versioning does not make an archived blob immediately readable; the blob is still in the Archive tier and must be rehydrated to an online tier before access.

Restoring the entire share from Azure Backup to yesterday's recovery point would roll back all changes made after that point, including modifications to other folders that must not be rolled back.

Blob soft delete is for Azure Blob Storage, not Azure Files. The question specifies an Azure file share, so blob soft delete cannot be used to recover deleted folders in a file share.

Creating a new file share and using synchronization would not restore the deleted subfolder tree to its previous state; it would merge current content, potentially overwriting modifications that must be preserved.

Regenerating both keys simultaneously would break the application's access immediately, as the app would have no valid key to use during the rotation, causing upload interruptions.

Disabling shared key authorization before rotating keys would immediately break the application's ability to upload documents, as it relies on access keys. This interrupts uploads, which the question explicitly aims to avoid.

Deleting and recreating the storage account would cause downtime and data loss, which is unnecessary and disruptive for key rotation.