AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are using Azure Blob Storage to store large media files. Clients upload files directly to the storage account using SAS tokens. You need to ensure that the SAS token expires 1 hour after creation. Which parameter should you set when generating the SAS token?
⚠ Common exam trap
Many candidates confuse SignedStart (st) with SignedExpiry (se), mistakenly thinking setting a start time alone controls the token's lifetime, when in fact without an expiry, the token remains valid indefinitely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SignedExpiry (se)
The SignedExpiry (se) parameter explicitly defines the expiration time of a SAS token. When generating a SAS token for Azure Blob Storage, setting 'se' to a UTC time 1 hour from creation ensures the token is valid only for that duration, meeting the requirement that clients can upload files directly using the SAS token for exactly 1 hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SignedProtocol (spr)
Why it's wrong here
The SignedProtocol (spr) parameter in an Azure Storage Shared Access Signature (SAS) token is used to enforce the network protocol that clients must use when making requests, typically restricting access to HTTPS only for secure communication. While vital for ensuring data encryption in transit and enhancing overall security, this parameter solely governs the communication protocol. It has no function in defining or controlling the duration or expiration timestamp of the SAS token itself, making it irrelevant for setting an expiry.
- ✗
IP range (sip)
Why it's wrong here
The IP range (sip) parameter within an Azure Storage Shared Access Signature (SAS) token enables administrators to specify a precise range of public IP addresses from which requests using the token are permitted. This security feature effectively limits access to trusted client networks, preventing unauthorized access attempts from outside the defined range. However, `sip` is exclusively focused on network-level access control and does not influence, determine, or manage the validity period or expiration time of the SAS token.
- ✓
SignedExpiry (se)
Why this is correct
The SignedExpiry (se) parameter is the fundamental and correct mechanism for defining the lifespan of an Azure Storage Shared Access Signature (SAS) token. It specifies the exact Coordinated Universal Time (UTC) date and time at which the SAS token will cease to be valid. Once this time is reached, any subsequent attempts to use the token for accessing storage resources will be met with an authorization failure, thereby enforcing time-limited access and adhering to security best practices.
- ✗
SignedStart (st)
Why it's wrong here
The SignedStart (st) parameter in an Azure Storage Shared Access Signature (SAS) token designates the specific UTC date and time when the token officially becomes active and valid for use. Its primary purpose is to delay the token's usability, allowing for future-dated access or preventing premature access to resources. While `st` defines the beginning of the token's operational window, it does not control or specify the token's end-of-life or expiration, which is handled by a separate parameter.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.