AZ-204 Develop Azure compute solutions Practice Question
You are developing a solution that uses Azure Container Instances (ACI) to run a batch processing job. The job runs for approximately 30 minutes and requires access to a configuration file stored in Azure Files. You need to ensure the container instance can access the file share securely without using a public endpoint. Which TWO actions should you take?
⚠ Common exam trap
Many exam-takers assume managed identities can be used for any Azure resource authentication, but Azure Container Instances does not support managed identities for Azure Files mounts, and they may overlook that service endpoints provide private connectivity without needing to change the authentication method.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mount the Azure Files share using the storage account name and key.
Mounting an Azure Files share using the storage account name and key is a supported method in Azure Container Instances. This approach uses the SMB protocol to directly attach the file share to the container, providing access to the configuration file without requiring a public endpoint. The storage account key is passed securely as part of the container group configuration, and the mount is handled internally within the Azure infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mount the Azure Files share using the storage account name and key.
Why this is correct
Azure Container Instances (ACI) supports mounting Azure Files shares directly, enabling persistent storage for containers. To mount an Azure Files share, the container group requires the storage account name and its corresponding storage account key. This key acts as the primary credential for authentication and authorization to access the file share. For security, the storage account key should be passed to the container securely, typically via environment variables marked as secure or through Azure Key Vault integration, rather than hardcoding it in the container definition.
- ✗
Use a managed identity assigned to the container group to authenticate to the storage account.
Why it's wrong here
While managed identities are a robust and secure way for Azure resources to authenticate to services that support Azure AD authentication, they are not directly supported for mounting Azure Files shares within an Azure Container Instance. Mounting an Azure Files share typically relies on SMB/NFS protocols, which require a storage account key for authentication, not an Azure AD token. Managed identities are primarily used for programmatic access to storage data (e.g., Blob storage via SDK) where Azure AD authentication is integrated.
- ✓
Deploy the container group in an Azure virtual network that has a service endpoint to Azure Storage.
Why this is correct
Deploying the Azure Container Instance container group into an Azure virtual network (VNet) allows for private and secure communication with other VNet-integrated services. Configuring a service endpoint for Azure Storage on that VNet enables the container group to access the Azure Files share directly over the Azure backbone network, bypassing the public internet. This enhances security by restricting access to the storage account only from within the specified VNet, preventing data exfiltration and reducing exposure to public threats.
- ✗
Use a shared access signature (SAS) token to mount the file share.
Why it's wrong here
Shared Access Signatures (SAS) tokens provide granular, time-bound access to specific Azure Storage resources, such as blobs, queues, tables, or individual files. However, the underlying SMB/NFS protocols used by Azure Files for mounting a file share do not natively support authentication via SAS tokens. Mounting an Azure Files share requires the full storage account key or Active Directory Domain Services (AD DS) authentication, not a temporary SAS credential.
- ✗
Enable the storage account's firewall to allow access from the container group's public IP.
Why it's wrong here
While technically possible to configure a storage account firewall to allow access from a specific public IP address, this approach is generally less secure for Azure Container Instances. ACI container groups often have dynamic public IP addresses, making firewall configuration difficult to maintain, or they might not have a static public IP. More importantly, exposing the storage account to the public internet, even with IP restrictions, increases the attack surface compared to leveraging private networking solutions like virtual networks and service endpoints, which keep traffic within the Azure backbone.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Files Shares
Azure Files Shares are fully managed cloud file shares that you can access from anywhere using standard industry protocols like SMB and NFS.
Key term
Azure Container Instances
Azure Container Instances (ACI) is a PaaS service that lets you run a container directly in Azure without managing any underlying servers or orchestration.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.