Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
User delegation SAS
Service SAS
Account SAS
Storage account key
AZ-104 Implement and Manage Storage Practice Question
Match each access scenario to the SAS or key type that best fits it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Interactive logins: User delegation SAS
Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Interactive logins: User delegation SAS
Why this is correct
A user delegation SAS is signed with Azure AD credentials rather than a storage account key, meaning it can be issued to an individual user with narrowly scoped permissions and a configurable expiration. This makes it ideal for interactive logins where a human needs temporary, least-privilege access to specific blobs or containers. It requires the calling principal to have the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey permission.
- ✓
Automated backups: System-assigned managed identity
Why this is correct
Automated backups need to write data continuously without human intervention or the burden of maintaining credentials, and a system-assigned managed identity gives an Azure resource a first-class identity in Azure AD with no secrets to store or rotate. When a backup service or workload uses its own managed identity, it can authenticate to Azure Storage via Azure AD and be granted exactly the RBAC roles needed for backup operations. This is secure and fully automated, unlike key-based or SAS-based approaches.
- ✓
Cross-tenant access: Service principal with certificate
Why this is correct
Cross-tenant access requires an identity that exists outside the context of a single resource's tenant, and a service principal with a certificate provides that independent, strongly authenticated identity. The service principal is registered in the home tenant and can be granted RBAC permissions in another tenant, while the certificate proves the principal's identity without exposing secrets. This is a standard pattern for multi-tenant applications and federated automation scenarios.
- ✗
Interactive logins: Storage account access keys
Why it's wrong here
Storage account access keys are shared keys that confer full administrative control over the entire storage account, including the ability to read and delete all data, so they completely violate the principle of least privilege for an interactive user login. They cannot be scoped to a single user or operation, do not expire automatically, and are intended only for admin-level account management. In any interactive scenario, a user delegation SAS or Azure AD-based access should be used instead.
- ✗
Automated backups: User delegation SAS
Why it's wrong here
A user delegation SAS is inherently user-oriented because it is signed with an individual Azure AD user's credentials and expires after a short interval, so it is unsuitable for unattended, recurring backup processes. Automated backups need a credential that can authenticate without a manually signed token and that does not require scheduled rotation, which is exactly what a system-assigned managed identity provides. Relying on a SAS for backups would risk service interruption every time the token expires.
- ✗
Cross-tenant access: System-assigned managed identity
Why it's wrong here
A system-assigned managed identity is tied to both a single Azure resource and a single Azure AD tenant, so it cannot authenticate to resources in a different tenant where it has no identity or trust relationship. Cross-tenant access depends on a service principal that is explicitly registered and consent-granted in the target tenant, allowing its RBAC assignments to cross tenant boundaries. Managed identities are therefore limited to same-tenant scenarios such as reading storage in the same subscription.
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
Storage account
A cloud storage account is a container that holds a set of cloud storage services and their data, providing a unique namespace and access policies for storing and managing unstructured data.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.