CCNA AZ Storage Questions

The question explicitly requires that the app must not store a storage account key on the VM. Storing the key in an environment variable still places the key on the VM, violating the requirement.

The question explicitly states the app must not store a SAS token on the VM. Generating a service SAS and copying it into the application configuration violates this requirement.

The Contributor role at the resource group scope grants full management access to all resources in the group, but does not include the specific data permissions (e.g., Storage Blob Data Contributor) needed to upload blobs. Managed identities require a data role on the storage container or account to access blob data.

LRS only replicates data within a single datacenter, so it cannot survive a zone failure in the primary region, which is a requirement in the question.

ZRS protects against zone failures but does not replicate data to a paired region, failing the disaster recovery requirement for a secondary region.

Archive rehydration policy is used to change the access tier of a blob from Archive to a hot or cool tier, not to automatically move blobs to a cheaper tier after a set period.

Snapshot retention manages the lifecycle of blob snapshots, not the tiering of the base blob itself. The question requires moving the base blob to a cheaper tier after 90 days, which is not controlled by snapshot retention.

Storage account failover is a disaster recovery feature that switches the primary region to a secondary region, not a data tiering or cost optimization feature. It does not move blobs to cheaper tiers based on age.

Shared key authentication uses the storage account key, not domain credentials, so it does not meet the requirement to mount the share using domain credentials.

A storage account access key grants full administrative access to the entire storage account, not just a single container, and it cannot be time-limited. The question requires access limited to one container for six hours without exposing the account key.

A shared key connection string includes the storage account access key, which the contractor should not receive, and it does not limit access to a single container.

A managed identity token is used for Azure resources to authenticate to Azure services without storing credentials, but it cannot be used outside Azure directly. The contractor is external and needs access from outside Azure, so a managed identity token is not applicable.

BlobStorage accounts support only block blobs and append blobs, not Azure Files shares or standard access tiers with lifecycle management, which are required by the question.

General-purpose v1 does not support access tiers or lifecycle management, which are explicitly required by the question.

BlockBlobStorage is designed for premium block blob performance and does not support Azure Files shares, lifecycle management, or standard access tiers, which are all required by the question.

Using a storage account access key stored in Key Vault still requires the App Service to retrieve and manage the key, which involves secrets and manual credential rotation, contradicting the requirement to avoid storing secrets and rotating credentials manually.

A shared access signature (SAS) embedded in application settings still requires manual rotation and exposes a secret, contradicting the requirement to avoid storing secrets or rotating credentials manually.

A service endpoint on the App Service integration subnet restricts network access to the storage account but does not provide authentication or authorization for the App Service to read/write blobs. It does not eliminate the need for secrets or credentials.

Option A is wrong because enabling forwarded traffic alone does not allow the spoke to use the hub's VPN gateway; it only permits traffic to be forwarded between VNets. The correct approach requires enabling gateway transit on the hub peering and using remote gateways on the spoke peering.

A private endpoint is used for secure access to Azure PaaS services over a private IP, not for routing on-premises traffic through a hub VPN gateway. It does not provide transit routing between VNets or to on-premises.

Deploying a second VPN gateway in the spoke VNet contradicts the requirement to avoid deploying its own gateway. The goal is to route on-premises traffic through the hub gateway, not add another gateway.

ZRS replicates data synchronously across availability zones in a single region, but does not provide geo-replication to a secondary region. The question requires read-only access in a secondary region after a full regional outage, which ZRS cannot fulfill.

LRS only replicates data within a single datacenter, so it cannot survive a zone failure (which spans multiple datacenters in an availability zone) and provides no geo-replication for regional disaster recovery.

GRS does not provide read access to the secondary region unless a failover occurs, whereas the question requires auditors to have read-only access to the secondary region even when the primary region is available.

Deleting the current share and restoring the whole share from the most recent backup would roll back all modifications made after the deletion, which violates the requirement that other folders must not be rolled back.

Changing the access tier from Hot to Cool does not restore deleted data; it only affects storage costs and performance. It has no capability to recover deleted files or folders.

Azure file shares do not support blob soft delete; soft delete for blobs is a feature of Azure Blob Storage, not Azure Files. The deleted folder tree is in a file share, so blob soft delete cannot recover it.

A CanNotDelete lock prevents deletion of the resource but does not block configuration changes like changing the access tier or creating containers. The question describes read-only behavior, which is not caused by a CanNotDelete lock.

Azure Policy audit assignments only evaluate and report compliance; they do not block configuration changes. The question describes operations failing, which requires an enforcement mechanism like a lock or deny policy.

Moving a storage account to a different subscription does not cause configuration changes to fail; it only changes the subscription context. Users can still modify settings after the move.

Locally redundant storage (LRS) replicates data three times within a single availability zone in the primary region. If that zone fails, the storage becomes unavailable, so it does not meet the requirement of staying available if one availability zone fails.

Geo-redundant storage (GRS) replicates data to a secondary region, but within the primary region it uses locally redundant storage (LRS), which does not survive an availability zone failure. Therefore, GRS does not meet the requirement of staying available if one availability zone in the primary region fails.

RA-GRS provides read access to the secondary region during a regional failure, but it does not protect against a single availability zone failure in the primary region because it uses LRS within the primary region, which can lose data if that zone fails.

Blob soft delete is used to protect data from accidental deletion or overwrite, not to automate tier transitions based on age. It does not move blobs between access tiers.

A private endpoint is used to securely connect to Azure services over a private IP address, not to manage data tier transitions. It does not automate moving blobs between Hot and Cool tiers.

A CanNotDelete lock prevents deletion of the storage account or container but does not manage data tier transitions. It cannot move blobs from Hot to Cool tier based on age.

Copying the blob to a new container and leaving it in the Archive tier does not make it readable immediately; the blob remains offline and requires rehydration before access, which does not meet the urgent need for same-day availability.

Changing the access tier from Archive directly to Cool does not immediately make the blob readable; it initiates a standard-priority rehydration that can take up to 15 hours, which is too slow for the same-day requirement.

A service SAS uses a shared key to generate the token, which violates the requirement to disable shared key access. The app must use secretless access via managed identity, not a SAS.

Rotating storage account keys does not disable shared key access; it only changes the keys. The requirement is to prevent future requests from authenticating with shared keys, which requires disabling shared key access entirely, not just rotating keys.

Granting Reader access to the resource group does not grant the managed identity permissions to read blobs; it only allows viewing resource metadata, not data access. The app needs the Storage Blob Data Reader role on the storage account or container.

Anonymous public container with write access disabled does not allow the app to upload images; it only permits read access to blobs, and the question requires upload capability without storing credentials.

A private endpoint uses a private IP address in the VNet, which contradicts the requirement to avoid private IP addresses and manage private DNS zones.

VNet peering does not restrict access to a storage account by subnet; it connects VNets but does not provide subnet-level network rules. The storage account would still be publicly accessible unless additional firewall rules are applied, and the scenario requires using the public FQDN without private IPs or DNS zones.

Assigning a route table with a host route to the storage account does not restrict access to a specific subnet; it only influences network traffic routing. The storage firewall and service endpoints are required to limit access to a subnet, and a host route alone does not provide access control.

Blobs in the Archive tier are offline and cannot be downloaded directly; they must first be rehydrated to a hot or cool tier, which takes time.

Deleting the blob and restoring from a soft delete snapshot does not change the access tier; the restored blob would still be in the Archive tier, which does not allow immediate download. This process also risks data loss and is not designed for rehydration.

Adding a lifecycle rule to move the blob back to Archive after download does not help make the blob downloadable within the next hour; it only affects future tiering.

Azure Files uses SMB protocol, not Blob service endpoints. Mounting via Blob service endpoint would attempt to use HTTPS/REST, which is incompatible with Azure Files' SMB-based mounting.

An Azure VPN gateway is used for site-to-site or point-to-site connectivity between on-premises networks and Azure, not for mounting an Azure Files share. Azure Files supports direct mounting over SMB without requiring a VPN.

An Azure load balancer distributes network traffic across multiple VMs but does not provide file-level access or mount capabilities for Azure Files shares. It cannot present a file share to VMs as a mountable endpoint.

Azure Blob containers cannot be mounted as a local NTFS volume natively; they require third-party tools or custom applications, and Windows does not support mounting Blob storage as an NTFS volume without additional software.

A managed disk cannot be attached to multiple VMs in read-write mode simultaneously; Azure managed disks support shared attachments only with specific configurations (e.g., shared disks) that require cluster-aware file systems, not native OS tools for simple file sharing.

Azure Queue storage is a messaging service for asynchronous communication, not a file-sharing solution. It cannot be mounted as a shared working folder using native OS tools, and it lacks file system semantics required for concurrent read/write access.

Blob soft delete protects against accidental deletion but does not prevent modification or overwriting of blobs, nor does it enforce a write-once-read-many (WORM) state. It only retains deleted blobs for a specified period.

Lifecycle management moves data to Archive storage tier, but it does not prevent deletion or modification of blobs. The question requires a write-once-read-many (WORM) state with no alteration or deletion for three years, which lifecycle management cannot enforce.

A shared access signature (SAS) provides delegated access to storage resources but does not enforce a write-once-read-many (WORM) state. It cannot prevent deletion or modification of blobs by authorized users.

ZRS (Zone-Redundant Storage) synchronously replicates data across multiple Azure availability zones within a region, which provides higher durability than LRS but at a higher cost. The question specifies protection against local hardware failure within a single datacenter only, so ZRS is overkill and more expensive.

GRS (Geo-Redundant Storage) replicates data to a secondary region, which increases cost and is not limited to a single datacenter. The question specifically requires protection only within one datacenter and lowest cost.

GZRS (Geo-Zone-Redundant Storage) provides both zone-level and geo-redundancy, which is overkill and more expensive for a scenario requiring only protection against local hardware failure within a single datacenter.

The question explicitly states the team does not want to use a private endpoint, so creating a private endpoint (option C) contradicts the requirement.

Assigning the Reader role to the subnet does not restrict network access to the storage account; it only grants read permissions to resources in that subnet, but the subnet itself is not authorized to access the storage account over the network.

Blob soft delete is a data protection feature that allows recovering deleted blobs, but it does not restrict network access to the storage account. The question requires limiting access to a specific subnet, which soft delete cannot achieve.

Azure Blob Storage with lifecycle rules does not provide file-level synchronization or caching for on-premises file servers; it is object storage for unstructured data, not a solution for keeping multiple Windows file servers in sync with local caching.

A private endpoint to Blob Storage does not provide local caching for SMB file shares; it only secures network traffic to Azure storage. The question requires caching on local servers, which Azure File Sync's cloud tiering provides, not a private endpoint.

A managed disk cannot be simultaneously attached to multiple servers in read-write mode; it supports only one writer at a time, so it cannot provide the same shared content across 15 branch servers.

The Hot tier is designed for frequently accessed data with high availability, but the question specifies that the archive is accessed only a few times each month, making the Hot tier unnecessarily expensive compared to the Cool tier.

The Archive tier has a rehydration time of up to 15 hours, which violates the requirement that documents must open immediately without a rehydration wait.

Geo-redundant storage (GRS) is a replication strategy, not an access tier. The question asks for an access tier that provides immediate access without rehydration, which is not addressed by GRS.

Storing a SAS token with a 1-year expiry in an encrypted file on the VM violates the security policy forbidding long-lived tokens on the VM, and still requires managing a secret on the VM, which is not allowed.

Storing the storage account access key on the VM violates the security policy forbidding account keys on the VM, and monthly rotation does not eliminate the risk of key exposure.

ZRS only protects against a single zone failure in the primary region, but does not provide a secondary copy for recovery if the entire primary region fails, which is required by the compliance team.

GRS does not provide zone redundancy in the primary region, so if a zone fails, data may become unavailable until failover is initiated. The question requires availability during a zone failure, which GRS cannot guarantee.

GZRS provides zone redundancy and geo-replication but does not allow read access to the secondary region unless a failover is initiated. The question requires the ability to read the secondary copy while recovery is underway, which necessitates read-access geo-redundant storage (RA-GZRS).

Premium tier is designed for low-latency, high-performance workloads, not for infrequently accessed data. It costs significantly more than Cool tier, so it does not minimize storage costs for this scenario.

The Hot tier is designed for frequently accessed data, not infrequently accessed data. Using it would incur higher storage costs than necessary for data that is rarely accessed.

The Archive tier has the lowest storage cost but requires hours to rehydrate data before access, violating the requirement that data must remain available immediately when requested.

Option B violates the security policy that forbids storing storage account keys or long-lived SAS tokens on the VM. An account SAS token is a long-lived credential that would need to be stored on the VM, and it does not automatically expire when the VM is deleted.

The Reader role only allows read access to storage account metadata, not data operations like uploading blobs. The VM's computer account is not used for Azure RBAC; managed identity or service principal is required.

Option D suggests enabling shared key access and rotating keys regularly, but the security policy forbids storing storage account keys on the VM. Even with rotation, the key must be present on the VM at some point, violating the policy. Additionally, shared key access does not automatically revoke access when the VM is deleted.

Azure Blob containers provide object storage for unstructured data and do not support SMB protocol or drive letter mapping required for simultaneous file sharing across multiple Windows VMs.

Archive blob tier is for cost-effective storage of infrequently accessed blob data with high latency, not for simultaneous file sharing with drive letter mapping.

A storage account access key only provides authentication to the storage account, not a shared drive letter mapping or concurrent file access. It does not offer the SMB protocol support needed for Windows VMs to map a drive letter.

Copying a blob directly from the Archive tier to a local machine is not possible because the blob is offline and must first be rehydrated (moved to a hot or cool tier) before it can be accessed or copied.

Changing a blob to the Cool tier does not immediately make it available; Archive blobs must be rehydrated first, which can take hours. The Cool tier also has a higher latency than Hot, and the question requires availability later today with multiple reads, making Hot with high priority rehydration the correct choice.

Creating a lifecycle rule to move the blob back to Hot automatically on the next day does not meet the immediate need for the file to be available later today. Lifecycle rules run once per day, so the blob would not be available until the next day at the earliest.

The question requires the data to remain online (not offline). Archive tier is offline and requires rehydration to access, so transitioning to Archive violates the requirement for a cheaper online tier.

File share snapshots are used for point-in-time recovery of Azure Files, not for automatic tier transitions. Lifecycle management rules do apply to blobs, making this option incorrect.

Soft delete is used to protect blobs from accidental deletion or overwrites, not to automatically change access tiers. It does not transition blobs between tiers based on age.

The Hot tier has the highest storage cost, and lifecycle rules that delete after 90 days do not provide a path to restore a single file on demand after deletion. The requirement is for low-cost storage with on-demand restore, not deletion.

The Cool tier is an online tier with low latency access; it does not require rehydration and is not offline. It offers lower cost than Hot but higher than Archive, so it does not achieve the lowest storage cost for rarely accessed files.

The Cold tier is offline and requires a rehydration job before reading, which can take up to 15 hours, making it unsuitable for same-day retrieval requests from auditors.

A Blob SAS token provides delegated access to Azure Blob Storage, not to Azure Files SMB shares. Azure Files supports SMB authentication via storage account key or AD DS credentials, not SAS tokens.

Network security group (NSG) rules control inbound/outbound traffic to Azure resources but are not authentication methods for mounting an Azure Files share over SMB.

Azure resource locks prevent accidental deletion or modification of resources but do not provide any authentication mechanism for mounting an Azure Files share over SMB.

Turning off the storage account firewall and mounting anonymously would bypass authentication entirely, which is insecure and not a supported method for Azure Files SMB access. Azure Files requires proper authentication, and anonymous access is not available for SMB shares.

The mount failure is due to authentication, not network connectivity. NSG rules control network traffic but do not address identity-based authentication required for accessing Azure Files without the storage account key.

Converting to a premium block blob account does not address authentication for Azure Files; block blobs are for object storage, not SMB file shares, and the issue is identity-based access, not performance.

A BlobStorage account is specialized for block blobs and append blobs only; it cannot host Azure Files shares or support lifecycle management rules for blobs in the same way as a general-purpose v2 account.

Lifecycle management rules do not require zone-redundant storage (ZRS); they work with any replication type, including LRS, GRS, and RA-GRS.

Lifecycle management policies are specifically designed for blobs and are supported in General-purpose v2 and BlobStorage accounts, so the statement that it cannot use lifecycle management for blobs is false.

Enabling versioning does not allow immediate reading of an archived blob; the blob must be rehydrated to a hot or cool tier before it can be accessed.

Moving a blob to a different container does not change its access tier; the blob remains in the Archive tier and cannot be read until rehydrated.

Switching replication from LRS to ZRS does not change the blob's tier; the blob remains in Archive tier and still requires rehydration before it can be read.

LRS (Locally Redundant Storage) replicates data three times within a single data center in a single region, so it cannot survive an entire Azure region becoming unavailable.

ZRS replicates data synchronously across three availability zones within a single region, so it does not protect against a full regional outage.

GRS provides region-level redundancy but only within a single secondary region, not across multiple regions. The question requires availability even if an entire Azure region becomes unavailable, which GZRS meets by replicating to a secondary region with zone redundancy.

Azure Archive tier blobs are offline and cannot be downloaded directly; they must first be rehydrated to Hot or Cool tier, which takes time.

Moving a blob to a different container does not change its tier; the blob remains in the Archive tier and is still offline, requiring rehydration before download.

Disabling the lifecycle rule does not change the blob's current tier; the blob remains in the Archive tier and is still offline. The blob must be rehydrated to a hot or cool tier before it can be read.

Blob versioning preserves previous versions of blobs in Azure Storage, but it does not synchronize data between on-premises servers and Azure. It lacks the two-way sync, tiering, and cloud backup capabilities required for hybrid file server scenarios.

Azure NetApp Files provides high-performance NFS/SMB file shares for enterprise workloads, but it does not offer cloud sync or tiering with on-premises servers. The question requires bidirectional synchronization with an on-premises Windows file server, which is a feature of Azure File Sync, not Azure NetApp Files.

Storage account failover is a disaster recovery feature for Azure Storage that switches from the primary to a secondary region in case of an outage. It does not synchronize on-premises file servers with Azure file shares.

Blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to Hot or Cool tier, which takes time.

Copying a blob from Archive tier does not bypass the rehydration requirement; the copy operation itself triggers rehydration, and the blob remains inaccessible until rehydration completes.

Assigning an Azure RBAC role does not change the blob's access tier; archived blobs remain offline until rehydrated, regardless of permissions.

Storing the storage account access key in app settings and runbook variables violates the requirement to avoid stored secrets, as the key is a long-lived secret that must be securely stored and managed.

The Contributor role on the storage account includes management plane permissions (e.g., delete the account) but does NOT automatically grant data plane permissions like blob upload/read/delete. You need a separate data role such as Storage Blob Data Contributor.

A shared SAS token without an expiration date violates the principle of least privilege and introduces a persistent security risk; the question explicitly requires avoiding stored secrets and limiting permissions.

Lifecycle rules operate on a schedule (typically once per day) and cannot be triggered on-demand to move a specific blob within an hour. The blob is already in Archive tier and must be explicitly rehydrated.

Blobs in the Archive tier are offline and cannot be directly set to Hot; they must be rehydrated first, which takes time. Setting the tier directly would fail or not make the blob available for immediate download.

Copying an archived blob directly via the portal copy command fails because the blob is in the Archive tier and must be rehydrated (moved to a hot tier) before any copy or download operation can succeed.

Storage Blob Data Owner at the storage account scope grants full control over all blobs and containers, including the ability to list, delete, or modify any container, which violates the requirement to restrict actions to only the configs container.

Contributor at the resource group scope grants full management access to all resources in the resource group, including the ability to list, delete, or modify any storage containers, which violates the requirement to restrict actions to only uploading/overwriting JSON files in the configs container.

Storage Queue Data Contributor grants permissions to queue data (messages), not blob storage. The job needs to upload/overwrite JSON files in a blob container, not interact with queues.

ZRS replicates data synchronously across multiple availability zones within a single region, but does not copy data to a paired region for disaster recovery, failing to meet the requirement for protection against a datacenter failure in the primary region and cross-region DR.

RA-GZRS provides read access to the secondary region, but the question states they do not need to read from the secondary during normal operations, making GZRS (without read access) the correct choice.

GRS replicates data to a paired region for disaster recovery but does not provide protection against a datacenter failure within the primary region because it uses LRS locally. The question requires protection against a datacenter failure within the primary region, which GRS lacks.

Copying the storage account access key into a configuration file violates the security policy forbidding storage of keys on the VM, and it exposes the key to potential compromise.

The Reader role only allows read access to Azure resources but does not grant permissions to write data to a blob container. The VM needs to upload logs, which requires write permissions, so the Storage Blob Data Contributor role is necessary.

A SAS token that never expires violates the security policy forbidding long-lived tokens, and storing it on the VM contradicts the requirement to avoid storing credentials on the VM.

Archived blobs are offline and cannot be read directly; they must be rehydrated to an online tier (Hot, Cool, or Cold) before access.

The Cold tier is not designed for archived content; it is for data accessed less frequently but still requiring immediate availability. Archived blobs must be rehydrated to Hot or Cool tier before reading, and Cold tier does not support direct reading of archived blobs.

Snapshots of an archived blob are also in the Archive tier and cannot be read directly; they require rehydration just like the base blob.

A service endpoint does not keep traffic private; it still uses the public endpoint of the storage account, only with source IP filtering. The question requires that the public endpoint not be used.

A shared access signature (SAS) uses the public endpoint, which violates the requirement that traffic must stay private and the public endpoint must not be used.

Keeping the public endpoint open violates the requirement that the public endpoint must not be used. A virtual network rule alone does not block public access; it only restricts access to traffic from the specified subnet, but the public endpoint remains accessible.

A service endpoint allows access from a specific subnet but does not provide a private IP address for the storage account; the storage account still uses its public endpoint, only restricted to the subnet's traffic.

A public IP address with an NSG rule allows inbound traffic from the internet, which contradicts the requirement to restrict access to a single virtual network and use a private IP address.

A VPN gateway connection is used for site-to-site or point-to-site connectivity from on-premises networks, not for restricting access to a single Azure virtual network with a private IP address.

The storage account access key provides full administrative access to the entire storage account, including the ability to list all blobs and write data, which violates the requirement for read-only access to a single blob and no listing capability.

A private endpoint provides secure network access to the storage account but does not enforce read-only or time-limited access to a single blob; it allows full access to the storage account over a private network.

Contributor access at the storage account level grants full read/write/list permissions to all blobs, violating the requirement to restrict access to a single blob with read-only and no list capability.

LRS only replicates data within a single datacenter, so it does not protect against an entire availability zone failure, which is the requirement in this question.

GRS replicates data to a secondary region, which the question explicitly says is not needed, and it does not protect against an entire availability zone failure within the primary region.

GZRS is not required for zone resilience; ZRS already provides zone-level redundancy within a single region. GZRS adds geo-replication to a secondary region, which the question explicitly states is not needed, and it is more complex and costly.

Blob versioning maintains multiple versions of blobs in Azure Storage, but it does not provide local caching or sync capabilities for SMB file shares. It is designed for object-level version control, not for caching files locally to reduce WAN latency.

Share snapshots provide point-in-time read-only copies of files for recovery, not local caching or synchronization. They do not keep a local cache on a Windows Server to reduce WAN traffic.

A private endpoint provides secure, private connectivity to Azure Files over the Microsoft backbone, but it does not create a local cache on-premises. The requirement is to cache files locally on a Windows Server in Branch01, which Azure File Sync does by syncing files to the server.

Blob soft delete protects against accidental deletion or overwriting, but it does not enforce a write-once-read-many (WORM) state; data can still be modified or deleted within the retention period if the soft delete policy is changed.

Blob lifecycle management moves data between tiers (e.g., Hot to Cool) based on age, but does not prevent deletion or modification. It cannot enforce a write-once-read-many state or protect against alterations.

A shared access signature (SAS) provides delegated access to blobs but does not prevent deletion or modification of blobs; it only controls who can access them, not enforce immutability.

The question explicitly states the team wants to keep using the public endpoint and does not want to deploy a private endpoint. Option A requires deploying a private endpoint, which contradicts the requirement.

RA-GRS provides geo-redundant storage with read access to the secondary region, but it does not restrict network access to a single subnet. It is a replication and data access feature, not a network security control.

Archive access tier is for cost-effective storage of rarely accessed data, not for network access control. It does not restrict traffic to a specific subnet.

Sharing the storage account key grants full access to the entire storage account, not just the container, and does not automatically expire after two hours, violating the requirement for automatic expiry and limited access.

An account SAS grants broad permissions (e.g., all containers) and does not automatically expire within two hours unless explicitly set; it also does not prevent the contractor from learning the storage account key because the SAS is derived from the key. The requirement for automatic expiry and no key exposure is not fully met.

Assigning the Storage Blob Data Contributor role at the storage account scope does not provide automatic expiry; access would persist until manually revoked, violating the requirement that access expire automatically without manual cleanup.

The team explicitly does not want to create a private endpoint or change DNS, and the storage account should remain reachable via its public endpoint. Option A requires a private endpoint and private DNS zone, which contradicts these requirements.

The storage account firewall can only filter by source IP address ranges, not by subnet or public IP address of a subnet. Configuring a public IP for the subnet does not enable the firewall to identify traffic from that subnet specifically.

An NSG rule controls traffic within the virtual network but does not restrict access to the storage account's public endpoint from other networks; the storage account firewall must be configured to allow only specific subnets.

You cannot directly copy a blob while it remains in the Archive tier; the blob must first be rehydrated to an online tier (Hot, Cool, or Cold) before any read or copy operation.

Changing the blob back to the Archive tier after starting a rehydration request does not accelerate access; the blob must be rehydrated to a hot or cool tier before it can be read. The rehydration process is already in progress, and reverting to Archive would cancel or delay access.

Snapshots of an archived blob remain in the Archive tier and are not immediately readable; they must be rehydrated first, which takes time. A snapshot does not bypass the rehydration requirement.

Service endpoints do not assign a private IP address to the storage account; they provide direct connectivity from the subnet to the storage service over the Azure backbone, but the storage account still uses a public endpoint.

A shared access signature (SAS) provides delegated access to storage resources, but it does not restrict network access to a specific subnet; it controls access via tokens, not network boundaries.

Storage account access keys do not restrict access to a specific subnet; they provide full administrative access to the storage account from any network location if the keys are known.

The Hot tier is designed for frequently accessed data with high transaction costs, making it unnecessarily expensive for rarely read archived case files that must remain online.

The Archive tier has the highest retrieval latency (up to 15 hours) and requires rehydration before data can be accessed, which violates the requirement that files must be 'available immediately when needed.'

The Premium tier is designed for low-latency, high-performance workloads with consistent access, not for rarely-read archived files. It incurs higher costs and is unnecessary for files that must remain online but are seldom accessed.

The Reader role on the subscription grants read access to Azure Resource Manager resources (e.g., VM, storage account metadata) but does not grant data-level permissions to blob containers. The 403 error occurs because the app lacks data-plane authorization, which requires a role like Storage Blob Data Reader.

Enabling shared key access would allow the app to bypass Azure AD authorization, but the storage account is configured to use Azure AD authorization, and the issue is that the app is not using Azure AD tokens. The correct fix is to assign the appropriate RBAC role, not to enable a less secure authentication method.

Moving a container to the Hot tier does not affect Azure AD authentication; tier changes impact cost and performance, not authorization. The 403 error is due to missing RBAC role assignment, not storage tier.

ZRS only protects against zone failure within a single region, but does not provide read access to a secondary region for reporting users if the primary region becomes unavailable.

RA-GRS provides read access to the secondary region but does not offer zone redundancy in the primary region, so a zone failure would interrupt writes, failing the requirement to continue serving writes if one availability zone fails.

GRS does not provide read access to the secondary region unless a failover occurs, so reporting users cannot read replicated data if the primary region becomes unavailable. It also lacks zone redundancy in the primary region.

Deleting the archived blob and re-uploading from backup is disruptive and time-consuming for a 200-GB blob, and unnecessary because Azure Blob Storage supports rehydration from the Archive tier to Hot or Cool tiers without data loss.

Enabling soft delete does not rehydrate an archived blob; it only protects against accidental deletion. The blob is still in the archive tier and unreadable until rehydrated.

Converting to premium performance does not affect blob tier or rehydration; the blob is archived and must be rehydrated to a hot or cool tier before reading. Premium performance is for low-latency workloads, not for recovering archived blobs.

The question requires connecting over the SQL server's public endpoint, but a private endpoint uses a private IP address, which contradicts the requirement to not deploy any private IPs. Additionally, the security team does not want to change DNS, but a private endpoint typically requires a private DNS zone to resolve the server name to the private IP.

NSG rules control traffic within the virtual network but do not bypass the SQL server's firewall. The SQL server's public endpoint still requires firewall rules to allow the source IP, and NSG rules alone cannot grant access.

The question requires that only AppSubnet be allowed to connect, but publishing the AppSubnet public IP range in the firewall allows any subnet with those IPs, and the SQL server's public endpoint remains accessible from the internet if the firewall rule is misconfigured. Additionally, the security team wants to avoid using private IPs or changing DNS, but this option does not restrict access to only AppSubnet.

The requirement states the storage account must remain reachable through its public endpoint, but option A disables public network access, which violates that condition.

A NAT gateway provides outbound internet access but does not restrict inbound access to the storage account to a specific subnet; it only changes the source IP for outbound traffic, so the storage account firewall cannot filter by subnet.

A VPN gateway routes traffic over an encrypted tunnel to a branch office, not directly to Azure Storage. It does not restrict storage access to a specific subnet's traffic; instead, it adds unnecessary complexity and latency.

Restoring the entire storage account from an account-level backup would roll back all data in the account, not just the deleted folders, and would affect other shares and blobs, which is not the requirement.

A shared access signature (SAS) with read permissions allows reading files but does not provide any restore or rollback capability for deleted folders in an Azure file share.

Manually changing blob tiers requires ongoing human intervention, which contradicts the requirement for automatic movement without manual effort.

Moving the entire storage account to the Archive tier permanently would make all blobs inaccessible for immediate reads (requiring rehydration) and incurs higher costs for blobs that are accessed frequently. The question requires a lower-cost online tier, and Archive is an offline tier with higher retrieval costs and latency.

LRS replicates data within a single datacenter, not across availability zones, so it cannot survive an entire zone outage.

GRS replicates data to a paired secondary region, which is unnecessary because the question explicitly states that a secondary region is not required for read access. It also costs more than ZRS and does not provide zone-level resilience within the primary region.

RA-GRS provides read access to a secondary region, but the question explicitly states that a secondary region is not required. The requirement is only for zone-level resilience within the same region, which ZRS fulfills.