AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are using Azure Cognitive Search to index documents stored in Azure Blob Storage. The indexer is failing with the error 'Data source credentials are invalid.' You have verified that the connection string for the storage account is correct. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume a valid connection string guarantees access, overlooking that network-level restrictions (firewalls, service endpoints, or private endpoints) can block the indexer's traffic even with correct credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The storage account is behind a firewall and the Cognitive Search service IP is not allowed.
When a storage account is protected by a firewall, Azure Cognitive Search's indexer must be granted explicit network access. Even if the connection string is correct, the indexer's outbound requests will be blocked unless the storage account's firewall rules include the IP address or subnet of the Cognitive Search service. This is a common misconfiguration that results in 'Data source credentials are invalid' errors despite valid credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Cognitive Search service is in a different region than the storage account.
Why it's wrong here
While Azure services are designed to communicate across regions, a difference in region between the Cognitive Search service and the storage account does not inherently cause credential or access errors. Azure's global infrastructure allows services to connect securely regardless of their geographical deployment, provided network security rules permit the communication. Latency or data transfer costs might be impacted, but the ability to authenticate and authorize access is not directly hindered by regional separation alone.
- ✗
The Cognitive Search service's admin key is missing.
Why it's wrong here
The Cognitive Search service's admin key is primarily used for authenticating API calls to manage the search service itself, such as creating, updating, or deleting indexes, indexers, and data sources. When an indexer connects to an external data source like Azure Blob Storage, it uses the credentials specific to that data source, typically a storage account connection string or a Managed Identity. Therefore, a missing search service admin key would not prevent the indexer from accessing the storage account.
- ✗
The indexer configuration is missing the storage account key.
Why it's wrong here
When configuring an Azure Cognitive Search indexer to connect to a storage account, the necessary authentication information is typically provided via a complete storage account connection string, which already embeds the storage account key. Alternatively, a Managed Identity can be used, which eliminates the need for any explicit key or connection string. There is no separate configuration field for providing just the storage account key in addition to a connection string, making this option incorrect.
- ✓
The storage account is behind a firewall and the Cognitive Search service IP is not allowed.
Why this is correct
Azure Storage accounts can be secured with network firewalls that restrict access to specific virtual networks or IP addresses. If the storage account has a firewall enabled and the outbound IP address of the Azure Cognitive Search service (or its associated VNet if integrated) is not explicitly added to the allowed list, the connection attempt will be blocked. This results in an access denied error, as the search service is prevented from establishing a network connection to the storage account.
Visual reference
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.