AZ-204 Develop Azure compute solutions Practice Question
You are developing a web application that allows users to upload images. The application runs on Azure App Service. You need to ensure that uploaded images are stored in Azure Blob Storage and that the application remains responsive. What should you use?
⚠ Common exam trap
Many candidates assume all uploads must go through the App Service (Option A) because they think the app must 'own' the data first, missing the SAS-based direct upload pattern that Azure Blob Storage explicitly supports for offloading work.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a SAS token for the user to upload directly to Blob Storage.
Generating a SAS token allows the user's browser to upload images directly to Azure Blob Storage without routing the data through the App Service. This keeps the web application responsive by offloading the upload workload to Azure Storage, avoiding blocking the App Service's limited HTTP request threads and reducing latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upload the image to the App Service and then copy it to Blob Storage.
Why it's wrong here
Uploading images to the App Service as an intermediary before copying them to Blob Storage introduces significant overhead. This approach consumes valuable App Service bandwidth, CPU, and memory resources unnecessarily, especially with high user traffic or large files. It also adds latency to the user experience and creates a scalability bottleneck, as the App Service instance becomes a single point of contention rather than offloading the direct data transfer to Azure Storage.
- ✓
Generate a SAS token for the user to upload directly to Blob Storage.
Why this is correct
Generating a Shared Access Signature (SAS) token is the most secure and efficient method for direct client-to-storage uploads. The web application can generate a time-limited SAS token with specific write permissions for a particular blob or container, which the client then uses to upload the image directly to Azure Blob Storage. This approach offloads the data transfer burden from the App Service, improving scalability, reducing latency, and minimizing resource consumption on the application server.
- ✗
Use Azure Files for image storage.
Why it's wrong here
Azure Files provides fully managed file shares accessible via SMB and NFS protocols, primarily designed for scenarios like lifting-and-shifting on-premises applications or providing shared storage for virtual machines. It is not optimized for direct, high-volume client uploads of individual images via HTTP/REST APIs, which is the typical pattern for web applications interacting with object storage. While technically possible to store images, it would be less cost-effective and less performant for this specific use case compared to Azure Blob Storage.
- ✗
Make the Blob container public for anonymous uploads.
Why it's wrong here
Making a Blob container publicly accessible for anonymous write uploads is a severe security vulnerability that should be avoided in almost all production scenarios. This configuration allows any user on the internet to upload arbitrary content without authentication, leading to potential abuse, storage cost overruns, and the risk of malicious content being hosted. It completely bypasses any access control mechanisms, making it impossible to track or restrict who is uploading data.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.