AZ-204 Implement Azure security Practice Question
A company deploys an Azure App Service web app that stores sensitive data in Azure Blob Storage. The security team requires that all access to the blob storage must be authenticated and authorized via Microsoft Entra ID, and that no anonymous access is permitted. The web app must also be able to access the storage using its managed identity. Which configuration should the company implement?
⚠ Common exam trap
A common mix-up: candidates confuse RBAC roles with access keys or SAS tokens, mistakenly thinking any form of credential (like a key or token) satisfies the 'authenticated and authorized via Microsoft Entra ID' requirement, when in fact only managed identity with RBAC and disabled anonymous access enforces Entra ID as the sole authentication method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the web app's system-assigned managed identity, assign the Storage Blob Data Contributor role to the identity, and disable anonymous access on the storage account.
It satisfies all requirements: enabling a system-assigned managed identity for the web app allows it to authenticate to Azure Blob Storage without storing credentials, assigning the Storage Blob Data Contributor RBAC role authorizes that identity to read/write blobs, and disabling anonymous access ensures no unauthenticated requests are permitted. This configuration enforces Microsoft Entra ID (formerly Azure AD) as the sole authentication mechanism, meeting the security team's mandate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a custom RBAC role that allows full access to the storage account and assign it to the web app's service principal.
Why it's wrong here
Creating a custom RBAC role for full storage account access is excessive and violates the principle of least privilege when a built-in role like Storage Blob Data Contributor is sufficient for data plane operations. Furthermore, relying on a separate service principal registration for the web app, rather than its system-assigned managed identity, introduces manual credential management complexities and security risks that managed identities are designed to eliminate.
- ✓
Enable the web app's system-assigned managed identity, assign the Storage Blob Data Contributor role to the identity, and disable anonymous access on the storage account.
Why this is correct
This is the correct and recommended approach for secure access. Enabling a system-assigned managed identity provides the web app with an identity in Microsoft Entra ID, eliminating the need for credential management. Assigning the Storage Blob Data Contributor role grants the necessary data plane permissions to the identity, adhering to the principle of least privilege. Disabling anonymous access on the storage account ensures all interactions are authenticated and authorized via Microsoft Entra ID and RBAC.
- ✗
Use storage account access keys and store them in Key Vault, then configure the web app to retrieve them at runtime.
Why it's wrong here
Using storage account access keys, even when stored in Key Vault, provides full administrative control over the storage account and bypasses Microsoft Entra ID for authorization to the storage data plane. While Key Vault secures the key itself, the underlying authentication mechanism relies on a shared secret rather than an identity-based approach, making it less secure, less auditable, and harder to manage granular permissions compared to RBAC with managed identities.
- ✗
Generate a shared access signature (SAS) token with read permissions, store it in App Settings, and configure the web app to use it.
Why it's wrong here
Shared Access Signature (SAS) tokens provide delegated, time-bound access to specific storage resources but are not an identity-based solution. They do not leverage Microsoft Entra ID or RBAC for the web app's authentication and authorization to the storage account, making them less secure and harder to manage for persistent server-side access. Storing static SAS tokens in App Settings also requires manual rotation and lacks the automatic credential management benefits of managed identities.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.