AZ-204 Develop for Azure storage Practice Question
You have an application that stores user profile pictures in Azure Blob Storage. Users upload images via a web app. You need to ensure that the images are served securely over HTTPS and that only authenticated users can access them. The web app uses Azure App Service with built-in authentication. You want to avoid storing any access keys in the web app's configuration. What should you do to grant the web app access to the blobs?
⚠ Common exam trap
Candidates often think a SAS token or access key is necessary for programmatic access, but Azure AD authentication via managed identity is the secure, keyless method that satisfies the 'no stored keys' requirement while still enforcing authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable system-assigned managed identity on the App Service and assign the 'Storage Blob Data Reader' role on the blob container.
Enabling a system-assigned managed identity on the App Service allows it to authenticate to Azure Storage without storing any credentials. By assigning the 'Storage Blob Data Reader' role on the blob container, the web app can securely access blobs using Azure AD authentication, which is the recommended approach for server-side access. This avoids storing access keys or SAS tokens in configuration, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the storage account access key in the web app's configuration.
Why it's wrong here
Storing storage account access keys directly in the web app's configuration is a significant security risk. These keys grant full administrative access to the storage account, and if compromised, could lead to data breaches or unauthorized modifications. Furthermore, managing key rotation becomes complex, requiring application redeployments or restarts, which introduces operational overhead and potential downtime. This approach violates the principle of least privilege and secure credential management.
- ✓
Enable system-assigned managed identity on the App Service and assign the 'Storage Blob Data Reader' role on the blob container.
Why this is correct
Enabling a system-assigned managed identity on the App Service provides an Azure Active Directory identity for the application, eliminating the need to manage credentials directly. By assigning the 'Storage Blob Data Reader' role to this identity on the specific blob container, the App Service gains secure, token-based access to read profile pictures without storing any secrets. This method adheres to the principle of least privilege and leverages Azure AD for robust authentication and authorization, simplifying credential management and enhancing security.
- ✗
Enable anonymous public read access on the blob container.
Why it's wrong here
Enabling anonymous public read access on the blob container would allow anyone on the internet to view the user profile pictures without any authentication. While it simplifies access, this approach completely bypasses any security or privacy requirements for user data. It makes the data publicly discoverable and accessible, which is generally unacceptable for personal user information and contradicts the need for controlled access.
- ✗
Generate a SAS token with long expiration and store it in the web app's configuration.
Why it's wrong here
Generating a Shared Access Signature (SAS) token with a long expiration and storing it in the web app's configuration introduces a different set of security vulnerabilities. If this long-lived SAS token is compromised, it grants unauthorized access to the blob container for its entire duration, which could be extensive. Unlike managed identities, SAS tokens are not tied to an Azure AD identity and offer limited revocation capabilities, making them harder to manage securely over time.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.