AZ-204 Implement Azure security Practice Question
Which FOUR of the following are true regarding Microsoft Entra ID authentication for Azure Storage?
⚠ Common exam trap
Candidates may mistakenly think that enabling Microsoft Entra ID authentication automatically disables Shared Key authorization, but in fact Shared Key access remains enabled by default unless explicitly disabled via the 'AllowSharedKeyAccess' property.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
RBAC roles can be used to grant permissions to a user or service principal.
Microsoft Entra ID authentication for Azure Storage uses OAuth 2.0 access tokens. Users, service principals, and managed identities can be granted access through Azure RBAC roles. Managed identities authenticate without stored credentials. Shared Key authorization remains enabled by default even when Microsoft Entra ID authentication is enabled; it must be explicitly disabled by setting AllowSharedKeyAccess to false. SAS tokens are supported and are not incompatible with Microsoft Entra ID authentication, so option A is false.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SAS tokens are not supported when using Microsoft Entra ID authentication.
Why it's wrong here
SAS tokens can still be used alongside Microsoft Entra ID.
- ✓
RBAC roles can be used to grant permissions to a user or service principal.
Why this is correct
RBAC roles control access to storage resources.
- ✓
When Microsoft Entra ID authentication is enabled, Shared Key authorization is still allowed by default.
Why this is correct
Shared Key authorization can be disabled; it is not automatically allowed.
- ✓
Managed identities can authenticate to Azure Storage without storing credentials.
Why this is correct
Managed identities provide secure authentication.
- ✓
The authentication process uses OAuth 2.0 access tokens.
Why this is correct
Microsoft Entra ID uses OAuth 2.0 tokens for authentication.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.