AZ-204 Develop for Azure storage Practice Question
You are developing a C# application that stores sensitive documents in Azure Blob Storage. The application needs to generate a time-limited shared access signature (SAS) that allows a client to only read and list blobs in a specific container. The SAS must be valid for exactly 1 hour from the current time. Which code snippet correctly creates the SAS? (Assume the BlobServiceClient and BlobContainerClient are properly initialized.)
⚠ Common exam trap
A common mix-up: candidates think they must set `StartsOn` to the current time to make the SAS valid immediately, but Azure Storage automatically treats the SAS as valid from the time of generation if `StartsOn` is omitted, and including it can cause failures due to clock skew.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
var sasBuilder = new BlobSasBuilder { BlobContainerName = container.Name, Permissions = "rl", ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);
It creates a `BlobSasBuilder` with the container name, permissions set to "rl" (read and list), and an expiration time of exactly 1 hour from the current UTC time. The `GenerateSasUri` method then produces a SAS URI that grants the specified permissions for the container. This matches the requirement for a time-limited SAS that allows only read and list operations on blobs in the container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
var sasBuilder = new BlobSasBuilder { BlobContainerName = container.Name, Permissions = "rl", ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);
Why this is correct
This code correctly instantiates a BlobSasBuilder and sets the essential BlobContainerName property to scope the SAS to the target container. It grants both read ('r') and list ('l') permissions, which are appropriate for accessing and enumerating documents, and defines a valid expiry time of one hour. Finally, the GenerateSasUri method on the BlobContainerClient correctly produces the full URI including the generated Shared Access Signature.
- ✗
var sasBuilder = new BlobSasBuilder { Permissions = "r", ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);
Why it's wrong here
This code is incorrect because it fails to specify the BlobContainerName property within the BlobSasBuilder. For a container-level Shared Access Signature, this property is mandatory to indicate which specific container the SAS should apply to. Additionally, setting permissions to only 'r' (read) would prevent listing the contents of the container, which might be necessary for managing sensitive documents.
- ✗
var sasToken = container.GetSasToken(permissions: "rl", duration: TimeSpan.FromHours(1));
Why it's wrong here
This option is fundamentally incorrect because the BlobContainerClient class in the Azure Storage SDK for .NET does not expose a method named GetSasToken. The standard and correct approach for generating a Shared Access Signature URI is to utilize the GenerateSasUri method, which requires a BlobSasBuilder object to define the desired permissions, expiry, and scope.
- ✗
var sasBuilder = new BlobSasBuilder { Permissions = "rl", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1) }; var sasUri = container.GenerateSasUri(sasBuilder);
Why it's wrong here
While this code correctly specifies the 'rl' permissions and sets both StartsOn and ExpiresOn properties for the Shared Access Signature, it critically omits the BlobContainerName property. Without explicitly setting BlobContainerName in the BlobSasBuilder, the generated SAS will not be correctly scoped to the intended container, rendering it invalid for container-level access.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.