Which two authentication methods let an app access blob data without storing the storage account key on the machine? Select two.

The storage account access key.

An access key is a long-lived secret and must be stored somewhere the app can read it, which breaks the requirement.

A service SAS generated directly from the account key.

A service SAS still depends on the account key for signing, so the key must be protected and is not eliminated.

Anonymous public access to the container.

Anonymous access exposes data broadly and is not appropriate for a secure application that needs controlled blob access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID authorization with an appropriate Azure RBAC role. — The two keyless options are Microsoft Entra ID with the right RBAC role, and a user delegation SAS. Both avoid embedding the storage account key in the application or on the machine. This is the preferred pattern for modern Azure workloads because it reduces secret management and supports revocation through identity controls. Why others are wrong: The storage account key and a service SAS both depend on the account key, so neither removes the need to protect a long-lived secret. Anonymous access is insecure and unsuitable for most business workloads. The question is focused on ways to authenticate without storing the account key, and those two answers are the secure options.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.