Match each blob access method or setting to its best use case.
Drag a concept onto its matching description — or click a concept then click the description.
Provides full access to the storage account and should be protected carefully.
Grants time-limited access to specific resources and permissions.
Authorizes users or applications through Microsoft Entra ID at a chosen scope.
Allows anonymous read access when enabled for the container.
Lets an Azure-hosted app authenticate without storing credentials or secrets.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Public endpoint with anonymous access: Best use case for public content accessible without authentication
Public endpoint with anonymous access is for public content. Private endpoint with managed identity provides secure VM access. SAS tokens grant time-limited restricted access. Azure AD with RBAC centralizes identity management. Storage account key gives full admin control. Immutable storage with legal hold ensures data cannot be altered or deleted.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Public endpoint with anonymous access: Best use case for public content accessible without authentication
Why this is correct
Public endpoint with anonymous access is ideal for content that should be openly available to anyone on the internet without any authentication, such as static website assets, public images, or open datasets. This setting disables access key checks and permits unauthenticated requests to containers or blobs configured for public read access. However, enabling anonymous access requires careful planning to avoid exposing sensitive data, and it should never be used for private or regulated content.
SAS token: Best use case for granting time-limited restricted access to a specific resource
Why this is correct
A Shared Access Signature (SAS) token provides granular, time-limited access to specific blobs or containers, allowing you to delegate access without sharing the storage account key. You can restrict permissions (e.g., read-only), set an expiry time, and optionally limit access to a specific source IP address or allowed protocol. This makes SAS tokens perfect for scenarios like letting a third party upload a file to a specific container for a finite period, or downloading a specific blob without compromising the security of the overall account.
Azure AD with RBAC: Best use case for centralized identity management for access to blobs
Why this is correct
Using Azure AD with RBAC for Blob storage enables centralized identity-based access control, meaning you can assign roles like 'Storage Blob Data Reader' or 'Storage Blob Data Contributor' to users, groups, or service principals across the organization. This approach integrates with conditional access policies, allows for fine-grained permissions at the container or blob level, and eliminates the need to manage shared secrets. It is the recommended method for enterprise environments where identity management, auditing, and compliance are critical.
Storage account key: Best use case for full administrative control over storage account
Why this is correct
The storage account key grants full administrative control over the entire storage account, including all blobs, tables, queues, and files, as well as the ability to manage access control and regenerate keys. Because it provides unrestricted access for anyone who possesses it, it should be safeguarded like a root password and used only for administrative tasks or trusted internal applications, not for direct end-user access. Rotating keys regularly and avoiding hardcoding them in code are essential security practices when using this access method.
Private endpoint with managed identity: Best use case for public internet access from VMs
Why it's wrong here
This is incorrect because a private endpoint is used to connect to Azure Storage over a private IP address from within a virtual network, bypassing the public internet entirely and using the Microsoft backbone network. A managed identity is an Azure AD identity that allows a resource (like a VM) to authenticate to storage without storing credentials, but it does not provide public internet accessibility. The correct method for public internet access from VMs is to use the public endpoint with appropriate security controls such as SAS tokens or Azure AD authentication.
Immutable storage with legal hold: Best use case for temporary data that can be deleted
Why it's wrong here
Immutable storage with legal hold is designed to ensure data is protected from deletion or modification for legal or regulatory compliance purposes, storing data in a write-once, read-many (WORM) state. It is explicitly not for temporary data that can be deleted; rather, temporary data should use lifecycle management policies to expire or delete blobs automatically. Applying a legal hold prevents all changes and deletions until the hold is explicitly removed, making it contrary to the need for deletable temporary data.
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Learn chapter
Privileged Identity Management (PIM)
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.