Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
AZ-204 Implement Azure security Practice Question
Arrange the steps to create and use a shared access signature (SAS) for an Azure Storage blob in the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create storage account, create container, upload blob, generate SAS, construct URL, then access.
First create storage and container, upload blob, generate SAS, construct URL, then access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create storage account, create container, upload blob, generate SAS, construct URL, then access.
Why this is correct
This sequence correctly establishes the necessary hierarchy and dependencies for Azure Blob Storage. A storage account must exist to host containers, and a container must exist within that account to hold blobs. The specific blob resource itself must be present before a Shared Access Signature (SAS) can be generated to grant specific, time-limited permissions to it. Finally, the SAS token is appended to the blob's URL to enable authorized access.
- ✗
Upload blob, create storage account, create container, generate SAS, construct URL, then access.
Why it's wrong here
This order is fundamentally flawed because an Azure Blob Storage blob cannot be uploaded into a non-existent location. The prerequisite steps of creating a storage account and then a container within that account must be completed *before* any blob can be uploaded. Attempting to upload a blob without these foundational resources would result in an immediate error, as there would be no target destination for the data.
- ✗
Generate SAS, create storage account, create container, upload blob, construct URL, then access.
Why it's wrong here
Generating a Shared Access Signature (SAS) token requires specifying the target resource it will grant access to, such as a specific blob, container, or the entire storage account. In this sequence, attempting to generate a SAS *before* the storage account, container, and especially the blob itself are created is impossible. The SAS generation process needs a concrete, existing resource to bind the permissions to, making this step premature and invalid.
- ✗
Create storage account, create container, generate SAS, upload blob, construct URL, then access.
Why it's wrong here
This is incorrect because the SAS token should be generated after the blob is uploaded, as the SAS is tied to the blob resource. Generating it before upload may result in an invalid or unnecessary token.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.