Develop for Azure storage →easyMultiple ChoiceObjective-mapped

AZ-204 Develop for Azure storage Practice Question

Exhibit

{
  "version": "2019-04-01",
  "properties": {
    "cors": {
      "corsRules": [
        {
          "allowedOrigins": ["https://www.contoso.com"],
          "allowedMethods": ["GET", "PUT"],
          "allowedHeaders": ["*"],
          "exposedHeaders": ["x-ms-request-id"],
          "maxAgeInSeconds": 3600
        }
      ]
    },
    "deleteRetentionPolicy": {
      "enabled": true,
      "days": 7
    }
  }
}

Refer to the exhibit. You are analyzing the Azure Blob Storage service properties configured for a storage account. A web application hosted at https://www.contoso.com attempts to make a PUT request to a blob. The request fails with a CORS error. What is the most likely cause?

⚠ Common exam trap

A common mix-up: candidates assume CORS errors are always caused by missing methods or headers, but the most common cause is a mismatch between the request's Origin header and the allowed origins list, especially when the allowed origins are not configured to include the exact domain of the web application.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The request's Origin header does not match the allowed origin.

The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request. Since the question states the request fails with a CORS error and the exhibit shows allowed origins that do not include https://www.contoso.com, this is the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The request includes a header that is not in the allowed headers list.
Why it's wrong here
The request fails due to an Origin mismatch, not because of a header not in the allowed list. While an unallowed header can cause a CORS error, the most common cause is the Origin not matching, especially when the web application's domain is different from the allowed origins.
✓
The request's Origin header does not match the allowed origin.
Why this is correct
The CORS error occurs because the request's Origin header (https://www.contoso.com) does not match any allowed origin in the CORS rule. Azure Blob Storage enforces exact string matching for the Origin header against the allowed origins list; a mismatch causes the browser to block the PUT request.
✗
The CORS rule does not include the DELETE method.
Why it's wrong here
The PUT request is failing due to an Origin mismatch, not because of the DELETE method. The absence of the DELETE method does not affect a PUT request; CORS errors are method-agnostic but origin-specific.
✗
The exposedHeaders list does not include a required response header.
Why it's wrong here
The exposedHeaders list controls which response headers the browser can expose to the web application. The CORS error occurs before the response is sent, so the exposedHeaders are not relevant to the failure.

Quick reference

Azure Blob Storage Tier Comparison

Tier	Storage Cost	Retrieval Cost	Latency	Use Case
Hot	Highest	Lowest	Immediate	Active data, frequent reads
Cool	Lower	Higher	Immediate	Data accessed < once / month
Cold	Lower still	Higher	Immediate	Data accessed < once / quarter
Archive	Lowest	Highest + rehydration delay	Hours	Long-term compliance retention

Go deeper

AZ-204 Develop for Azure storage Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Azure Blob Storage Tier Comparison

Related to this question