AZ-104 Implement and Manage Storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A shared access signature stored in a text file on VM-App01.

  Why it's wrong here

  Placing a SAS token in a text file is just another form of static credential storage: the file sits on the VM filesystem where malware or bad actors could read it, and the SAS itself is a bearer token that grants access to whoever possesses it. Even if you scope and expire the SAS, the application still depends on a secret artifact rather than an identity, and you must manually manage rotation, revocation, and storage. Because the token is not tied to VM-App01's identity, there is no native way to enforce Azure AD policies or audit which principal actually used it, leaving a security gap that a managed identity would close.

  When this WOULD be correct

  If the question required granting time-limited, delegated access to specific blobs without using Azure AD authentication, and the application could securely retrieve the SAS from a file (e.g., via Azure Key Vault or a secure configuration management system), then a shared access signature stored in a text file could be correct.

• ✗

  The storage account access key hard-coded in the application.

  Why it's wrong here

  Hard-coding the storage account access key in the application is fundamentally the same as embedding a super-admin password: the account key grants full control over the entire storage account (blobs, tables, queues, files, and any RBAC restrictions are bypassed), so a single exposed key can lead to data theft, deletion, or even cross-service compromise. Rotating that key requires a coordinated deployment to update the application, creating downtime or build-step complexity, and you cannot scope permissions in the same way RBAC rules do. This approach also forfeits the benefit of per-identity auditing, as every use of the key is indistinguishable from the account owner, making it a poor fit for least-privilege security.

  When this WOULD be correct

  In a scenario where the application runs in a trusted environment, the storage account access key is managed securely (e.g., via Azure Key Vault), and the question does not prohibit storing keys in code, using the access key directly might be acceptable for simplicity.

• ✓

  A managed identity for VM-App01 and Azure RBAC on the storage account.

  Why this is correct

  For the correct approach, configure a system-assigned managed identity on VM-App01 so the application acquires an Azure AD token automatically at runtime, then grant that identity the Storage Blob Data Contributor (or a minimally scoped custom) RBAC role at the storage account or container level. This completely removes secret management because the managed identity is the security principal, tokens are issued by Azure AD, and credentials are rotated automatically. Unlike keys or SAS, there is no embedded secret to leak, and access can be surgically revoked by removing the role assignment—making this the only option that satisfies a strict identity-based, no-secrets security requirement.

• ✗

  Anonymous public access for the blob container.

  Why it's wrong here

  Turning on anonymous public access for the blob container removes authentication entirely: any Internet user who discovers the container URL can read or list blobs without presenting an Azure AD token, a SAS, or an account key. This not only violates the implied requirement to secure application data but also can expose sensitive, business-critical files—especially since public access settings apply to the container at the storage account level and require careful review of every blob. Even if the container is used for non-critical content, the default recommendation is to disable anonymous access altogether unless the solution is explicitly designed as a static website or public dataset, so this option is categorically wrong for an application handling private data.

  When this WOULD be correct

  If the question asked for a method to allow public read access to blobs in a container for a website or public dataset, and security or authentication is not a concern, then enabling anonymous public access on the container would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question