AZ-104 Implement and Manage Storage Practice Question
Your application stores compliance records in Azure Blob Storage. The records must remain in a write-once-read-many state for three years and must not be altered or deleted during that period. What should you configure?
⚠ Common exam trap
Many candidates confuse soft delete (which only recovers deleted blobs) with immutability, or think lifecycle management or SAS can enforce retention, but neither prevents modification or deletion during the required period.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Immutable blob storage with a time-based retention policy
Immutable blob storage with a time-based retention policy enforces a WORM (Write-Once, Read-Many) state, preventing any modification or deletion of blobs for a specified retention period. This meets the requirement of keeping compliance records unaltered for three years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Blob soft delete
Why it's wrong here
Blob soft delete protects against accidental or malicious deletion by keeping deleted blobs in a recoverable state for a configured retention interval, but it does not place any restriction on modifying or deleting active blobs. During the soft-delete period, an authorized user can still delete or overwrite a blob; the feature simply captures the deleted state for potential restoration. Therefore, soft delete supports recovery objectives, but it does not enforce the write-once, read-many compliance requirement.
When this WOULD be correct
A scenario where the requirement is to recover blobs that were accidentally deleted or overwritten within a retention period, without needing to prevent modifications or enforce immutability. For example, 'You need to ensure that blobs deleted by mistake can be restored within 30 days.'
- ✓
Immutable blob storage with a time-based retention policy
Why this is correct
Immutable blob storage with a time-based retention policy enforces write-once-read-many (WORM) behavior, meaning blobs cannot be modified or deleted during the assigned retention period. This is the only option that provides the explicit, unalterable retention required for compliance records, and the policy is enforced at the storage container level. The retention period is counted from the blob's last modification time, and it cannot be shortened while the policy is active.
- ✗
Lifecycle management to move data to Archive
Why it's wrong here
Lifecycle management policies move blobs between access tiers (hot, cool, archive) or delete them after a specified number of days, enabling cost optimization and automated retention cleanup. These rules act on age and last-modified time, so they can remove blobs, but they provide no protection against overwrites or early deletion. Consequently, lifecycle management alone cannot satisfy a compliance mandate for immutable retention.
When this WOULD be correct
A scenario where the goal is to reduce storage costs by automatically moving blobs to cooler tiers after a specified period, without any compliance or immutability requirements. For example: 'You need to automatically move blobs older than 30 days to Cool tier and blobs older than 90 days to Archive tier to minimize costs.'
- ✗
A shared access signature
Why it's wrong here
A shared access signature (SAS) is a token that grants delegated, time-limited access to specific storage resources, but it only controls authorization, not data governance. SAS permissions can include read, write, and delete, so a holder with these permissions can overwrite or delete blobs at will, making it wholly unsuitable for enforcing compliance-grade immutability. Expiration on the SAS token limits access duration, but it does not create any WORM retention guarantee.
When this WOULD be correct
A shared access signature would be correct if the question asked for a way to grant time-limited, restricted access to a specific blob or container for external users without exposing storage account keys.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Immutable blob storage with a time-based retention policyCorrect answer▾
Why this is correct
Immutable blob storage with a time-based retention policy enforces write-once-read-many (WORM) behavior, meaning blobs cannot be modified or deleted during the assigned retention period. This is the only option that provides the explicit, unalterable retention required for compliance records, and the policy is enforced at the storage container level. The retention period is counted from the blob's last modification time, and it cannot be shortened while the policy is active.
✗Blob soft deleteWrong answer — click to see why▾
Why this is wrong here
Blob soft delete protects against accidental deletion but does not prevent modification or overwriting of blobs, nor does it enforce a write-once-read-many (WORM) state. It only retains deleted blobs for a specified period.
★ When this WOULD be the correct answer
A scenario where the requirement is to recover blobs that were accidentally deleted or overwritten within a retention period, without needing to prevent modifications or enforce immutability. For example, 'You need to ensure that blobs deleted by mistake can be restored within 30 days.'
Why candidates choose this
Candidates may confuse soft delete with immutability because both involve retention periods, but soft delete does not prevent writes or enforce WORM compliance.
✗Lifecycle management to move data to ArchiveWrong answer — click to see why▾
Why this is wrong here
Lifecycle management moves data to Archive storage tier, but it does not prevent deletion or modification of blobs. The question requires a write-once-read-many (WORM) state with no alteration or deletion for three years, which lifecycle management cannot enforce.
★ When this WOULD be the correct answer
A scenario where the goal is to reduce storage costs by automatically moving blobs to cooler tiers after a specified period, without any compliance or immutability requirements. For example: 'You need to automatically move blobs older than 30 days to Cool tier and blobs older than 90 days to Archive tier to minimize costs.'
Why candidates choose this
Candidates may think that moving data to Archive tier makes it immutable because Archive is offline and not directly modifiable, but Archive blobs can still be deleted or overwritten. They confuse cost optimization with data protection.
✗A shared access signatureWrong answer — click to see why▾
Why this is wrong here
A shared access signature (SAS) provides delegated access to storage resources but does not enforce a write-once-read-many (WORM) state. It cannot prevent deletion or modification of blobs by authorized users.
★ When this WOULD be the correct answer
A shared access signature would be correct if the question asked for a way to grant time-limited, restricted access to a specific blob or container for external users without exposing storage account keys.
Why candidates choose this
Candidates may confuse SAS with a method to enforce retention because SAS can include expiration times, leading them to think it can prevent modifications or deletions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.