AZ-204 Implement Azure security Practice Question
You have an Azure Storage account that hosts blobs for a public website. You need to grant a partner application read-only access to a specific container for 24 hours without using a storage account key. What should you create?
⚠ Common exam trap
It's easy for candidates to confuse a stored access policy (Option B) with a SAS, not realizing that a policy alone does not grant access—it only defines constraints that a SAS must reference, and without a SAS token, no access is provided.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A shared access signature (SAS) URI with read permission and expiry set to 24 hours
A shared access signature (SAS) URI with read permission and a 24-hour expiry provides time-limited, delegated access to a specific container without exposing the storage account key. This meets the requirement for read-only access for exactly 24 hours, as the SAS token can be scoped to a single container and its permissions set to read.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A shared access signature (SAS) URI with read permission and expiry set to 24 hours
Why this is correct
A Shared Access Signature (SAS) URI provides delegated access to Azure Storage resources with granular control over permissions and a defined validity period. By generating a SAS with read-only permission and a 24-hour expiry, the partner receives a time-limited URI that grants access only for the specified duration, minimizing security risks associated with long-term credentials and avoiding exposure of the sensitive storage account key. This approach perfectly aligns with the requirement for temporary, scoped external access.
- ✗
An access policy for the container with read permission
Why it's wrong here
An access policy, also known as a stored access policy, defines permissions and validity periods that can be referenced by a Service SAS or Account SAS. While it offers a centralized way to manage and revoke multiple SAS tokens, an access policy itself does not directly grant access to the storage container. A separate SAS token, which incorporates or references this policy, must still be generated and provided to the partner for them to access the blobs.
- ✗
A storage account key
Why it's wrong here
Providing a storage account key grants full administrative access to all data and resources within the entire storage account, not just specific blobs or containers. This poses an extreme security risk, as the key never expires unless manually regenerated, making it entirely unsuitable for granting time-limited, read-only access to an external partner. Exposure of this key could lead to complete compromise of the storage account.
- ✗
A managed identity for the partner application
Why it's wrong here
A managed identity is an Azure Active Directory feature that provides an identity for Azure services to authenticate to other Azure services without managing credentials. This mechanism is designed for applications running *within* Azure and requires an Azure RBAC role assignment (e.g., Storage Blob Data Reader) to the managed identity. It is not suitable for external partners who are not running their application within Azure, nor does it inherently provide time-bound access without additional complex configurations.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.