AZ-104 Implement and Manage Storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A storage account access key

  Why it's wrong here

  A storage account access key is a shared secret that grants full control over all data-plane operations in the entire storage account, including read, write, delete, and the ability to edit containers and access policies. Sharing this key with an external partner gives them permanent, unrestricted access to every blob and service in the account, not just the single target blob. The key has no built-in expiration or permission granularity, so it violates the least-privilege requirement and is unsafe for a temporary, read-only delegation.

  When this WOULD be correct

  When the question asks for a method to grant full administrative access to a storage account (e.g., for management tasks) and does not restrict sharing the account key, or when delegating access to a trusted internal administrator who needs full control.

• ✓

  A shared access signature (SAS)

  Why this is correct

  A shared access signature (SAS) is the correct choice because you can scope it to a single blob, assign only the Read permission, and set precise start and expiry times. This allows an external partner to access just that one blob for a limited period while keeping the rest of the storage account private. You can also revoke the SAS before expiry or, if you use a user delegation SAS, invalidate the signing key, giving you full control over the temporary grant.

• ✗

  A resource lock

  Why it's wrong here

  A resource lock (CanNotDelete or ReadOnly) is a management-scope control that prevents accidental deletion or modification of a resource at the subscription, resource group, or resource level. It does not generate a credential or establish an external partner's identity, so it cannot authorize any data-plane operation like reading a blob. In fact, a ReadOnly lock would only restrict operations on the resource; it still requires another authentication mechanism to grant the partner read access to the content.

  When this WOULD be correct

  You need to prevent accidental deletion of a critical storage account or container. Create a resource lock (e.g., CanNotDelete) to protect the resource from being deleted by authorized users.

• ✗

  A private endpoint

  Why it's wrong here

  A private endpoint assigns a private IP address from your virtual network to the storage account, routing traffic exclusively over the Microsoft backbone and isolating the account from public network access. It is a network-level access control and does not issue credentials or define data-plane permissions for users. An external partner connecting via the private endpoint would still need an authorized token or identity to read the blob, meaning the private endpoint alone cannot grant temporary read access.

  When this WOULD be correct

  You need to ensure that all traffic to a storage account from a specific virtual network is routed through a private IP address, eliminating exposure to the public internet. In this scenario, creating a private endpoint would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question