AZ-204 Develop for Azure storage Practice Question
Which TWO authentication methods can be used to authorize access to Azure Blob Storage without requiring shared keys?
⚠ Common exam trap
Microsoft often tests the misconception that a SAS token is a keyless method, but in reality, a SAS token is generated using a shared key (account key or user delegation key), so it does not meet the 'without requiring shared keys' condition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID (formerly Azure AD) authentication
Microsoft Entra ID (formerly Azure AD) authentication and managed identities for Azure resources are both identity-based authentication methods that do not require shared keys. Entra ID authentication uses OAuth 2.0 tokens to authorize access to Blob Storage, while managed identities provide an automatically managed identity in Entra ID for Azure resources, eliminating the need for developers to manage credentials. Both methods support role-based access control (RBAC) for fine-grained permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shared access signature (SAS) token
Why it's wrong here
Shared Access Signatures (SAS) tokens provide delegated access to Azure Storage resources with granular control over permissions and validity. However, SAS tokens are fundamentally derived from either storage account access keys or user delegation keys, which are themselves shared secrets. Since the question specifically asks for authentication methods that do not use shared keys, SAS tokens are not a suitable answer because their security model is inherently tied to these underlying shared secrets.
- ✓
Microsoft Entra ID (formerly Azure AD) authentication
Why this is correct
Microsoft Entra ID (formerly Azure AD) authentication is a primary method for securing Azure Storage without relying on shared keys. It enables identity-based access control through Azure Role-Based Access Control (RBAC), where users, groups, or service principals are assigned specific roles to storage resources. This method leverages OAuth 2.0 tokens issued by Entra ID, providing a secure and auditable way to authorize requests without ever exposing or managing shared secrets like account keys.
- ✗
Storage account access keys
Why it's wrong here
Storage account access keys are highly privileged shared secrets that grant full administrative access to an entire Azure Storage account. These keys are symmetric cryptographic keys, meaning the same key is used for both signing and verifying requests. Since the question specifically seeks authentication methods that do not use shared keys, relying on storage account access keys directly contradicts this requirement, making them an incorrect choice.
- ✗
Client certificate-based authentication
Why it's wrong here
Client certificate-based authentication is a method where a client presents a digital certificate to prove its identity. However, Azure Blob Storage does not natively support direct client certificate-based authentication for authorizing requests to storage resources. While certificates can be used in conjunction with other services like Azure Key Vault or for authenticating service principals to Microsoft Entra ID, it is not a standalone, supported authentication method for direct access to Blob Storage itself.
- ✓
Managed identities for Azure resources
Why this is correct
Managed identities for Azure resources provide an automatically managed identity in Microsoft Entra ID for Azure services, such as virtual machines or Azure Functions. This eliminates the need for developers to manage credentials directly. Managed identities obtain OAuth 2.0 tokens from Entra ID and use them to authenticate to Azure Storage, enabling secure access via Azure RBAC without any shared keys or secrets being stored in application code or configuration.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.