AZ-204 Develop for Azure storage Practice Question
You need to allow a client application to read a specific blob from Azure Blob Storage for one hour, without exposing your storage account key. Which approach should you use?
⚠ Common exam trap
Candidates often confuse RBAC with SAS, thinking RBAC can be used for temporary access, but RBAC does not support built-in expiry and requires manual revocation, whereas SAS provides precise time-bound delegation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a shared access signature (SAS) URI with read permission and expiry of one hour
A shared access signature (SAS) URI allows you to delegate limited access (read permission) to a specific blob for a defined time period (one hour) without exposing your storage account key. The SAS token is generated using the account key but does not reveal it, ensuring secure, time-bound access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide the storage account access key to the client
Why it's wrong here
Providing the storage account access key grants the client full administrative control over the entire storage account, including all containers and blobs, with no time-based restrictions. This level of access is highly insecure and violates the principle of least privilege, as it allows for deletion, modification, and creation of resources far beyond the requirement to read a single blob. It exposes the entire account to potential compromise if the key is intercepted or misused, making it unsuitable for temporary, limited access.
- ✓
Generate a shared access signature (SAS) URI with read permission and expiry of one hour
Why this is correct
Generating a Shared Access Signature (SAS) URI is the most appropriate and secure method for this scenario. A SAS token provides delegated access to specific Azure Storage resources, allowing precise control over permissions (e.g., read-only), the resource itself (a specific blob), and the duration of access (one hour). This ensures the client can only perform the required action for a limited time, adhering to the principle of least privilege and minimizing security risks by not exposing full account credentials.
- ✗
Use Azure RBAC to grant the client the Storage Blob Data Reader role for one hour
Why it's wrong here
While Azure Role-Based Access Control (RBAC) can grant the Storage Blob Data Reader role, RBAC assignments are persistent and apply to an identity (user, group, service principal), not a temporary, anonymous client. There is no built-in mechanism to automatically revoke an RBAC role assignment after a specific duration like one hour. Manually assigning and then removing the role for such a short, temporary need is operationally inefficient and not the intended use case for RBAC's persistent authorization model, which is better suited for long-term identity-based access.
- ✗
Make the blob publicly accessible for one hour using a stored access policy
Why it's wrong here
Making the blob publicly accessible, even for a limited time via a stored access policy, grants anonymous read access to *anyone* on the internet, not just the intended client application. While a stored access policy can define permissions and an expiry, applying it to enable public container or blob access is a broader security concession than necessary. A SAS token provides a more granular and secure approach by delegating access specifically to the client with the token, without exposing the resource to the general public.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.