AZ-204 Develop for Azure storage Practice Question
Which TWO of the following are valid authentication options for accessing Azure Storage from an application? (Choose TWO.)
⚠ Common exam trap
It's easy for candidates to confuse Managed Service Identity (MSI) as a standalone authentication method, when in reality it is an identity provider that relies on Entra ID tokens, and they may also mistake SAS tokens as an authentication option rather than a delegated authorization mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage account key (Shared Key).
The storage account key (Shared Key) provides full administrative access to the storage account, allowing the application to authenticate requests via the Authorization header using HMAC-SHA256. Option B is correct because Microsoft Entra ID (formerly Azure AD) supports role-based access control (RBAC) for Azure Storage, enabling applications to authenticate using OAuth 2.0 tokens for fine-grained access without exposing account keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Storage account key (Shared Key).
Why this is correct
A storage account key, also known as a Shared Key, provides full administrative access to all data within an Azure storage account. When using Shared Key authentication, every request to Azure Storage is cryptographically signed with this key, allowing the storage service to verify the request's authenticity. This method grants comprehensive control over blobs, files, queues, and tables, making it a powerful but sensitive authentication mechanism that should be protected diligently.
- ✓
Microsoft Entra ID (formerly Azure AD) authentication.
Why this is correct
Microsoft Entra ID authentication for Azure Storage leverages OAuth 2.0 tokens to grant access. Users, groups, or applications authenticate with Entra ID, receive a token, and then present this token to Azure Storage. Access is then authorized based on Azure role-based access control (RBAC) assignments, allowing for fine-grained permissions to specific containers or blobs without sharing secret keys, enhancing security and manageability.
- ✗
Certificate-based authentication.
Why it's wrong here
While certificate-based authentication is utilized in various Azure services, such as for VPN gateways or client authentication to Azure App Service, it is not a directly supported authentication method for accessing data plane operations within Azure Storage itself. Azure Storage primarily relies on Shared Key, Microsoft Entra ID, or Shared Access Signatures for authenticating and authorizing data access requests. Direct certificate validation for storage data access is not an available option.
- ✗
Managed Service Identity (MSI).
Why it's wrong here
Managed Service Identity (MSI), now known as Managed Identities for Azure resources, is a feature that provides an identity for Azure services to authenticate to other services that support Azure AD authentication. MSI itself is not an authentication method; rather, it is an identity provider that allows an Azure resource to securely obtain an OAuth 2.0 access token from Microsoft Entra ID. This token is then used as the actual authentication credential to target services like Azure Storage.
- ✗
Shared access signature (SAS) token.
Why it's wrong here
A Shared Access Signature (SAS) token provides delegated access to resources in your storage account with specified permissions and validity period. While a SAS token allows *authorization* to perform specific operations, it does not *authenticate* the identity of the user or application presenting it. Instead, the SAS itself is signed with a storage account key or a user delegation key, and the storage service validates this signature to authorize the request, not to verify the caller's identity.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.