AZ-204 Develop for Azure storage Practice Question
You have a web application that writes user-uploaded images to Azure Blob Storage. The application uses a shared access signature (SAS) token with read and write permissions. Users report that sometimes they receive 'AuthorizationFailure' errors when uploading images, but the issue is intermittent. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse intermittent failures with network or firewall issues, but the key clue is 'intermittent' — which points to a time-based expiry rather than a static configuration problem like IP restrictions or soft-delete policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SAS token has expired and the application is not regenerating it before it expires
SAS tokens have a defined expiration time. If the application does not regenerate the token before it expires, uploads will intermittently fail with 'AuthorizationFailure' errors. The intermittent nature is explained by the token being valid for some requests and expired for others, depending on when the token was last refreshed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The blob container has a soft-delete policy that is preventing uploads
Why it's wrong here
Azure Blob Storage soft-delete is a data protection feature designed to recover accidentally deleted blobs or snapshots, not to prevent new data uploads. When enabled, deleted data transitions to a soft-deleted state for a configurable retention period, rather than being permanently erased. This policy has no impact on the ability to write new blobs to a container, making it an irrelevant factor for upload failures.
- ✗
The storage account firewall is blocking requests from the web application's IP
Why it's wrong here
A storage account firewall operates as a network access control layer, permitting or denying requests based on specified IP addresses or virtual networks. If the web application's IP address were blocked by the firewall, all requests originating from that IP would consistently fail, not just intermittently. Intermittent failures suggest a transient condition rather than a static network access restriction.
- ✓
The SAS token has expired and the application is not regenerating it before it expires
Why this is correct
Shared Access Signatures (SAS) are time-limited credentials that grant delegated access to Azure Storage resources. When a SAS token expires, any subsequent requests attempting to use that token will be unauthorized and fail. If the application does not proactively regenerate a new SAS token before the current one's expiration, operations will intermittently succeed until expiration, then consistently fail until a valid token is obtained, perfectly aligning with intermittent failure symptoms.
- ✗
The SAS token was generated with an incorrect IP range restriction
Why it's wrong here
An IP range restriction within a SAS token specifies the exact IP addresses or ranges from which requests using that token are permitted. If the web application's IP address falls outside this defined range, all attempts to use the SAS token would consistently fail due to an authorization error. This static condition would not result in intermittent upload failures, as the IP restriction either applies or it doesn't for every request.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.