CCNA Implement and Manage Storage Questions

LRS does not replicate data to a secondary region, so it cannot provide read access to a paired region. It only maintains three synchronous copies within a single datacenter.

Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, but does not provide any replication to a secondary region, so it cannot offer read access to a paired region.

GRS provides geo-redundancy but does not include read access to the secondary region; read access requires RA-GRS or RA-GZRS.

ZRS replicates data synchronously across availability zones within a single region, but does not provide geo-replication to a paired region. The question requires read access from the paired region if the primary region fails, which ZRS cannot fulfill.

GRS provides geo-redundancy but does not include zone-redundancy within the primary region, so it cannot remain available if an entire availability zone fails in the primary region.

RA-GRS provides geo-redundancy but not zone-redundancy within the primary region. The question requires resilience to an entire availability zone failure in the primary region, which RA-GRS does not offer.

Blobs in Archive tier are offline and cannot be directly downloaded; they must first be rehydrated to an online tier (Hot, Cool, or Cold) before any download operation.

Assigning a shorter retention policy does not affect the blob's access tier; Archive blobs remain offline until rehydrated, regardless of retention settings.

Moving a blob from Archive to Cool tier initiates a rehydration process that can take up to 15 hours, and the blob is not accessible for download until rehydration completes. Attempting to download immediately will fail.

LRS does not protect against an availability zone failure because it stores data within a single datacenter, not across zones. It also does not provide a readable copy in the paired region.

ZRS replicates data across availability zones within a single region, but does not provide a readable copy in the paired region for disaster recovery testing, which is required by the question.

GRS does not provide zone redundancy in the primary region; it only replicates to a single physical location in the primary region. The question requires availability if one availability zone fails in the primary region, which GRS cannot guarantee.

LRS replicates data only within a single data center in a single availability zone, so it does not protect against an entire zone outage.

RA-GRS provides read access to a secondary region copy, but the question explicitly states that a secondary region copy is not required. Additionally, RA-GRS does not guarantee availability during a zone outage in the primary region because it replicates to a secondary region, not across zones.

Shared access key authentication grants full access to the entire storage account, not limited to a single container, and exposes the account key, violating the requirement to avoid sharing the key.

An Account SAS grants access to multiple services or the entire storage account, not limited to a single container, and does not support delegation via Microsoft Entra ID for temporary write access without sharing the account key.

Service endpoint access with network rules only restricts traffic to a virtual network but does not provide temporary, time-limited write access to a specific container for an external partner. It lacks the granular delegation and expiration control needed for this scenario.

A premium block blob account does not support Azure Files shares, which are required by the company's need for a single storage account hosting both blob containers and Azure Files shares.

General-purpose v2 storage accounts support blob lifecycle management, so this option is false for the required account.

A general-purpose v2 storage account can simultaneously host multiple data services including blob containers and Azure Files shares, so it is not limited to one type at a time.

Azure Files alone does not provide local caching or synchronization; it requires a direct cloud connection for each branch, which may not meet the requirement for hot data caching at branch servers.

Azure Backup is a backup and restore service, not a file-sharing or synchronization solution. It does not provide continuous file sharing or caching capabilities to replace branch server shares.

Azure NetApp Files is a high-performance file service for enterprise workloads, but it does not provide the file synchronization and local caching capabilities required to replace branch server shares with a central Azure file share. The question's requirement is for a feature that synchronizes local servers with a central share and keeps hot data cached, which is exactly what Azure File Sync does.

Blob versioning is a feature for Azure Blob Storage, not Azure Files. The question specifically asks about files in an Azure file share, which requires share snapshots for version recovery.

A shared access signature (SAS) provides delegated access to storage resources, not version recovery. It cannot restore previous file versions or protect against accidental modification/deletion.

Storage account failover is a disaster recovery feature that switches the primary region to a secondary region in case of a regional outage. It does not provide point-in-time recovery of individual file versions after accidental modification or deletion.

Managed identities are for Azure resources to authenticate to other services, not for external users without an Azure account. They cannot be assigned to a contractor who lacks a user identity in the tenant.

The storage account access key grants full administrative access to the entire storage account, not read-only access to a single blob container, and it does not expire after three hours.

Enabling anonymous public access on the container would grant read access to anyone on the internet without time restriction, violating the temporary and controlled access requirement.

Storage account access keys provide full administrative access to the storage account but cannot retrieve or restore individual deleted files from a file share. They do not support granular file recovery.

An Azure VM snapshot captures the entire VM's disks, not the file share itself. It cannot be used to restore individual files from an Azure file share because the file share is a separate managed service, not part of the VM's disks.

A private endpoint provides secure, private connectivity to the file share over a virtual network, but it does not have any capability to restore deleted files or perform data recovery operations.

LRS replicates data three times within a single datacenter, so it does not protect against a full datacenter failure. The question requires availability if one datacenter fails, which ZRS provides by replicating across multiple availability zones within the region.

Geo-redundant storage (GRS) replicates data to a secondary region, which provides read access from the secondary region only after a failover. The question states the company does not need read access from a secondary region, making GRS unnecessary and more expensive than ZRS.

RA-GRS provides read access to a secondary region, but the question explicitly states the company does not need read access from a secondary region. Additionally, RA-GRS is more expensive and complex than ZRS, which meets the requirement of surviving a datacenter failure within a region.

The security team wants to allow traffic only from AppSubnet, not from any specific VM IP. Relying on the VM's source IP would require managing individual IPs and does not scale; also, the storage account firewall can be configured to allow a virtual network, which is more secure and manageable.

The security team explicitly does not want to deploy a private endpoint, so creating one contradicts the requirement. Additionally, leaving the firewall set to allow all networks would not restrict traffic to only AppSubnet.

Granting Contributor access to the VM does not enforce network rules; it only allows the VM to manage the storage account. The storage account firewall requires explicit network rules (like service endpoints) to restrict traffic by source network, not by RBAC role.

Shared key authorization requires storage account keys, which the security team explicitly prohibits. The question requires using existing AD DS credentials, which shared key authorization does not support.

A user delegation SAS does not map shares automatically to domain accounts; it provides delegated access to a specific resource using Azure AD credentials, not Active Directory Domain Services, and does not support automatic mapping via domain credentials.

Archived blobs are offline and cannot be read directly; they must first be rehydrated to an online tier (Hot or Cool) before access is possible.

Archive tier has the slowest retrieval time (hours for standard rehydration), not the fastest. Hot tier provides immediate access.

Changing a blob from Archive to Hot requires rehydration, which can take up to 15 hours, so it does not complete instantly or synchronously.

The team does not need a private IP address and is fine with the public endpoint, but a private endpoint disables public network access by default, which contradicts the requirement.

A user delegation SAS token grants access to specific resources but does not restrict access to a single subnet; it can be used from any IP address or network that has the token.

Changing redundancy to ZRS and enabling soft delete does not restrict network access to a subnet; ZRS provides data durability across zones, and soft delete protects against accidental deletion, neither of which controls network-level access.

LRS only replicates data within a single datacenter, so it cannot survive a datacenter outage, nor does it provide read access from a secondary region.

ZRS replicates data synchronously across three availability zones within a single region, so it does not provide a secondary region for read access during a regional outage, nor does it offer read access to replicated data in another region.

GZRS replicates data to a secondary region but does not provide read access to the secondary region during an outage; the application would need to wait for failover, violating the auditors' requirement for immediate read-only access.

A service endpoint on the destination storage account subnet would allow access from a specific virtual network, but the question requires bypassing the firewall for a trusted Microsoft service, not for a VNet. The destination storage account's firewall is set to deny all public access, and the source is a diagnostic setting, not a VNet.

A shared access signature (SAS) provides delegated access to a specific resource, but it does not bypass the storage account firewall. The firewall blocks all traffic unless explicitly allowed, and a SAS token does not override that restriction.

A private DNS zone linked to the workspace virtual network is used for custom domain name resolution within a virtual network, not for bypassing firewall rules on a storage account. The question requires enabling trusted Microsoft services to bypass the firewall, not DNS configuration.

Archived blobs can be read through public endpoints after rehydration; private endpoints are not required. The blob must be rehydrated to a hot or cool tier before access, regardless of network connectivity.

Converting to GZRS does not automatically restore archived blobs; rehydration requires changing the tier or using copy operations. Geo-replication only provides redundancy, not automatic rehydration.

Setting the container ACL to public does not rehydrate an archived blob; archived blobs are offline and cannot be read until rehydrated to Hot or Cool tier, regardless of public access.

The Archive tier is for data that is rarely accessed and has a retrieval latency of up to 15 hours; it is not for immediate access. The question requires blobs to stay online, but Archive tier data is offline until rehydrated.

Premium block blob accounts are designed for high transaction rates and low latency, not for long-term retention or low-cost storage. They are more expensive than standard tiers and are not optimized for infrequently accessed data.

The Cold tier is designed for data that can be stored for up to 30 days with infrequent access, but it is not intended for data that must stay online; it has a higher latency and lower availability than Hot or Cool tiers. The question requires blobs to stay online, which Cold does not guarantee.

The Hot tier is designed for frequently accessed data with high availability and low access latency, but it has the highest storage cost. For data accessed only a few times per year, the Hot tier would be unnecessarily expensive.

The Cool tier is designed for data accessed infrequently (30+ days) but still requires lower latency than Cold. However, the question specifies access only a few times per year, which aligns better with Cold tier's longer access interval and lower cost, making Cool more expensive than necessary.

The Archive tier has the lowest storage cost but requires hours to rehydrate data before reading, violating the requirement that files remain 'readable immediately' upon request.

Hot tier is designed for frequently accessed data with the lowest access latency, but it has the highest storage cost. The scenario requires lowest storage cost and only occasional access, making Hot unnecessarily expensive.

Archive tier has the lowest storage cost but retrieval times can take up to 15 hours, which does not meet the requirement of online access within hours.

Premium tier is designed for low-latency, high-performance workloads and has the highest cost, which contradicts the requirement for lowest storage cost. The scenario does not need sub-second access, only online access within hours.

Blob versioning is a feature of Azure Blob Storage, not Azure Files. The question specifies an Azure file share, which does not support blob versioning; it uses share snapshots for point-in-time recovery.

Azure File Sync cloud tiering optimizes storage by caching frequently accessed files locally, but it does not provide point-in-time recovery of file versions or deleted files at the share level.

Immutable blob storage is designed for Azure Blob Storage, not Azure Files, and it prevents deletion/modification rather than enabling recovery of previous versions at the file share level.

Direct download from Archive tier is not supported; the blob must be rehydrated first, which incurs additional cost and delay, and does not achieve the lowest ongoing storage cost during the review window.

Moving the blob to the Hot tier permanently incurs higher storage costs during the 3-day review window compared to rehydrating to Cool tier, which is sufficient for the access pattern and cheaper.

The Hot tier is optimized for frequent reads and writes, but the question specifies that files are accessed only a few times per year, making Hot unnecessarily expensive due to higher storage costs.

Cool tier is designed for infrequently accessed data, but the question specifies 'only a few times per year,' which aligns more with Cold tier's 90-day minimum and lower cost. Cool tier has a 30-day minimum and higher storage cost than Cold, making it less optimal for this access pattern.

Archive tier requires rehydration (which can take hours) before data is readable, contradicting the requirement for immediate readability without delay.

BlobStorage accounts do not support Azure Monitor diagnostic exports or lifecycle management policies, which are required for the scenario.

FileStorage accounts are optimized for SMB file shares, not block blobs, and do not support Azure Monitor diagnostic exports or access tier controls for blobs.

BlockBlobStorage accounts do not support Azure Monitor diagnostic exports or lifecycle management policies, and they lack general-purpose features like tables and queues.

Network isolation via a private endpoint does not authenticate users or satisfy the security policy forbidding storage account keys and SAS tokens; it only restricts network access.

The question explicitly forbids storage account keys, and SMB with Azure Files does not require shared-key authentication when using AD DS authentication.

Azure Files NFS authentication is not supported for Windows clients, and the question requires both Windows and Linux VMs to mount the same share over SMB, not NFS.

LRS only replicates data within a single datacenter, so if that datacenter fails, the artifacts become unavailable. The question requires availability if one datacenter fails, which ZRS provides by replicating across multiple availability zones within the region.

GRS replicates data to a secondary region, incurring cross-region costs, but the question explicitly states the business does not want to pay for replication to another region.

RA-GRS replicates to a paired secondary region (geo-redundancy), not within the same region, so it does not meet the requirement to avoid cross-region replication costs.

Hot tier is designed for frequently accessed data and has the highest storage cost, which contradicts the requirement for the lowest-cost online tier for rarely accessed files.

Cool tier requires a minimum of 30 days storage and has a higher per-GB cost than Cold, but the question specifies 'lowest-cost online tier' and 'immediately readable' — Cool is not the cheapest online tier for rarely accessed data.

Archive tier requires a rehydration step (which can take hours) to make data readable, contradicting the requirement for immediate readability without a rehydration step.

An availability set is a logical grouping of VMs to ensure high availability during planned or unplanned maintenance, not a mechanism for creating point-in-time copies of disks.

A load balancer backend pool is a configuration for distributing traffic across VMs, not a mechanism for creating point-in-time copies of a managed disk. It cannot be used to restore a disk to a previous state.

A resource lock prevents accidental deletion or modification of a resource, but it does not create a point-in-time copy of a managed disk. The question specifically requires a copy that can be restored later, which only a snapshot provides.

Rotating keys every 24 hours does not prevent new requests using shared key authorization; it only changes the key periodically, allowing continued use of shared key access.

Requiring secure transfer enforces HTTPS for all requests but does not block shared key authorization; it only ensures data is encrypted in transit, not that shared key authentication is disabled.

Creating a private endpoint restricts network access to the storage account via a private IP, but it does not prevent requests that use shared key authorization. The requirement is to block shared key access, not network-level access.

An account SAS signed with the storage account key would be invalidated if the storage account keys are rotated, which violates the requirement that the access token must keep working after key rotation.

Sharing the storage account key itself violates the requirement to avoid sharing the key, and rotating the key would invalidate any temporary script variable using it, failing the requirement that the access token keeps working after key rotation.

A service endpoint does not provide a private IP for the storage account; it only allows access from a specific VNet subnet. The storage account would still have a public endpoint, and the firewall exception would allow public traffic from the on-premises VPN gateway's public IP, not a private IP.

A NAT gateway provides outbound internet connectivity for private subnets, but it does not enable private access to a storage account. The storage account must not accept public network traffic, and a NAT gateway does not create a private endpoint or bypass the public endpoint.

Application security groups (ASGs) are used to group virtual machines and apply network security rules, not to control access to Azure PaaS services like Blob Storage. They cannot restrict public network traffic to a storage account.

Restoring the entire file share from the latest snapshot would roll back all changes, including the updates made after the deletion that must not be rolled back.

The Hot access tier affects storage costs and performance for blobs, not file shares. It does not provide any mechanism to restore deleted files or folders.

Deleting newer folders to match the snapshot would also remove the updates that must not be rolled back, violating the requirement to preserve those changes.

Blob containers cannot be mounted as file shares; they require Blob API access, not SMB or NFS, and do not support AD DS authentication for mounting by VMs.

Anonymous access on an Azure File share does not allow authentication via AD group memberships, and the security team forbids storage account keys, making it unsuitable for managing access with existing AD groups.

A premium NFS file share cannot be mounted by Windows VMs, and using a shared access signature (SAS) violates the security team's forbiddance of storage account keys, as SAS tokens are derived from keys.

The question requires allowing access from a specific subnet (AppSubnet) to a storage account. A private endpoint would assign a private IP to the storage account within a virtual network, but the requirement is to allow access from AppSubnet, not to disable all public access. Disabling all public network access would block other necessary connections, such as from on-premises or other services.

A VPN gateway connects on-premises networks to Azure, not subnets within Azure to Azure services. The requirement is to allow a subnet within the same virtual network to access a storage account, which is achieved via service endpoints or private endpoints, not a VPN.

A NAT gateway provides outbound internet connectivity for private subnets but does not enable private access to Azure storage from a subnet. The requirement is to allow the subnet to access the storage account, which is achieved via service endpoints or private endpoints, not NAT.

Archive tier requires rehydration (up to 15 hours) to read blobs, which contradicts the requirement for no rehydration delay.

Premium tier is not a general-purpose access tier for blob storage; it is a performance tier for Azure Files or for premium block blob storage, which does not support direct read access in the same way as Hot, Cool, or Cold tiers. The question asks for access tiers that can be read directly without rehydration, and Premium is not one of the three standard access tiers (Hot, Cool, Cold) that offer immediate read access.

Sharing a storage account key grants full administrative access to the entire storage account, not temporary read-only access to specific blobs, and violates the principle of least privilege.

A resource lock prevents accidental deletion or modification of resources but does not provide any form of access control or temporary read-only access to specific blobs.

Blob versioning preserves previous versions of blobs but does not provide temporary, granular read-only access to specific blobs for a third party without using storage account keys.

Enabling anonymous blob access allows public read access to blob data without authentication, but does not restrict network traffic to a specific subnet or block internet access to the public endpoint.

Assigning the Contributor role to a subnet grants management permissions but does not restrict network access to the storage account's public endpoint; it does not block internet traffic.

The Hot tier is optimized for frequent access (many times per month), but the scenario specifies files are read only a few times per year, making Hot unnecessarily expensive.

Cool tier is online and immediately readable, but it is designed for data accessed more than a few times per year (e.g., monthly). The question states files are read only a few times per year, making Cold tier more cost-effective while still online.

Archive tier requires rehydration (up to 15 hours) before data can be read, contradicting the requirement for immediate availability without waiting.

Setting network access to selected networks only restricts access based on IP address or virtual network, not authentication method. It does not block shared key authorization; it only limits which networks can reach the storage account.

Rotating the account keys does not disable shared key authorization; it only changes the keys. The question requires blocking new requests using shared key authorization, which is achieved by disabling shared key authorization entirely, not by rotating keys.

Object replication is used to asynchronously copy blobs between storage accounts for data redundancy or compliance, not to control authentication methods. It does not block shared key authorization.

Storing the storage account key in an environment variable violates the security requirement that forbids storing keys on the VM. The key grants full access to the storage account, not just the container.

A service SAS with write permission on the storage account would grant write access to all containers within the account, violating the requirement to restrict writes to only that specific container. Additionally, long-lived SAS tokens are forbidden by security policy.

Contributor role at the storage account scope grants full management access to the storage account, including the ability to read and write all containers and blobs, which violates the principle of least privilege and the requirement to restrict the application to write-only access to a single container.

The question explicitly states 'they do not want to use a private endpoint,' so creating a private endpoint contradicts the requirement. Additionally, leaving the firewall open to all networks would not restrict access to one subnet.

Azure RBAC roles like Contributor control permissions to manage resources, not network access. Assigning Contributor to a subnet does not restrict network traffic to the storage account; it only grants management rights to identities in that subnet.

Disabling the public endpoint would make the storage account unreachable from the subnet without a private endpoint or service endpoint, and relying on Internet routing does not restrict access to a single subnet.

Blob soft delete protects against accidental deletion but does not prevent overwrites or enforce a write-once-read-many (WORM) state, so it cannot ensure records remain unaltered for four years.

Lifecycle management moves data to Archive tier based on age, but does not prevent deletion or modification. The question requires a write-once-read-many (WORM) state with deletion protection, which lifecycle management cannot enforce.

A shared access signature (SAS) provides delegated access to storage resources but does not enforce write-once-read-many (WORM) compliance or prevent deletion or modification of blobs.

Sharing the storage account access key grants full access to all storage services and containers, which violates the requirement to limit access to a single container for a specific time period.

A management group assignment manages access and policies across multiple subscriptions, not temporary access to a single blob container. It does not provide time-limited, container-specific access.

A private endpoint restricts network access to the storage account but does not provide temporary, scoped access to a specific container without sharing the account key.

Blob soft delete protects against accidental deletion but does not prevent modifications, and administrators can still delete blobs within the retention period if they have sufficient permissions.

Lifecycle management moves blobs to different tiers or deletes them based on age, but it does not prevent modification or deletion by administrators. It cannot enforce a write-once, read-many (WORM) state required for legal hold or regulatory compliance.

Blob versioning preserves previous versions of blobs but does not prevent deletion or modification of the current version by administrators. It cannot enforce a legal hold or retention period that blocks all modifications and deletions.

LRS replicates data within a single datacenter, so it does not protect against a single datacenter outage in the region. The question requires resilience to a datacenter failure, which LRS cannot provide.

RA-GRS provides read access to a secondary region, but the question explicitly states that a secondary region is not needed and only requires protection against a single datacenter outage within the region. RA-GRS is overkill and adds complexity.

Blobs in the Archive tier are offline and cannot be downloaded directly; they must first be rehydrated to an online tier (Hot or Cool) before access.

Creating a snapshot does not rehydrate the blob from Archive tier; snapshots are read-only copies of the blob at the time of creation and remain in the same tier, so the user still cannot access the data without rehydration.

Enabling versioning does not rehydrate a blob from the Archive tier; it only creates new versions on writes. The user needs to rehydrate the blob to a hot or cool tier before accessing it.

The backup job is an Azure service (e.g., Azure Backup) that does not have a public IP address to add; it runs on Azure infrastructure. Adding a public IP would not work because the traffic originates from Azure's internal network, not a specific public IP.

Service endpoints allow access from a specific subnet to a storage account, but the backup job runs as an Azure service (e.g., Azure Backup) and not from a specific subnet. The question explicitly states the team does not want to use a private endpoint, and service endpoints still require the storage firewall to allow traffic from the subnet, which does not resolve the need to bypass the firewall for the Azure service itself.

Disabling the firewall temporarily creates a security gap where the storage account is exposed to all public traffic during the backup window, violating the requirement to deny all public traffic.

The Hot tier is optimized for frequent access and has higher storage costs, but the scenario requires infrequent access (quarterly audits) with immediate availability. The Hot tier would be unnecessarily expensive for data accessed only a few times per year.

Archive tier requires rehydration (which can take hours) to make blobs readable, contradicting the requirement that files must open immediately without waiting.

Premium tier is designed for high-performance, low-latency access with Azure Premium SSD storage, not for long-term archival or cost-effective infrequent access. It is significantly more expensive and not intended for rarely accessed data like quarterly audit files.

The blob is already in the Archive tier and needs to be accessed within a day. Setting it directly to the Archive tier again does not change its state; it remains archived and inaccessible for reading. The blob must first be rehydrated to a hot or cool tier to be readable.

Archived blobs are offline and cannot be directly snapshotted; you must first rehydrate the blob to an online tier (Hot or Cool) before creating a snapshot. Snapshotting an archived blob without rehydration will fail.

Increasing account redundancy to RA-GRS does not directly address the need to access an archived blob; it provides geo-redundant storage but does not rehydrate the blob from the Archive tier, which is required before any read operations.

LRS replicates data only within a single datacenter in the primary region, so it does not provide a readable secondary copy if the primary region becomes unavailable.

Storing a shared access signature in a text file on the VM still exposes credentials in a file, which violates the requirement to avoid storing account keys in code or configuration files. It also does not leverage Azure RBAC or managed identities for secure access.

Hard-coding the storage account access key in the application violates the requirement to avoid storing keys in code or configuration files, and it poses a security risk if the code is exposed.

Anonymous public access allows anyone on the internet to read blobs without authentication, which violates the requirement to restrict access to the application without storing keys.