AZ-204 Implement Azure security Practice Question
You have an Azure Storage account with a blob container. You need to grant a user read-only access to a specific blob for 24 hours without requiring them to authenticate with Microsoft Entra ID. What should you use?
⚠ Common exam trap
Many candidates confuse a user delegation SAS with a stored access policy, thinking the policy alone grants access, or they incorrectly assume that assigning an RBAC role (Option C) can bypass authentication requirements, but RBAC always requires Entra ID authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a user delegation SAS token
A user delegation SAS token is the correct choice because it provides time-limited, delegated access to a specific blob using Microsoft Entra ID credentials without requiring the user to authenticate directly. The token is signed with the user's delegated key, granting read-only access for exactly 24 hours as specified, and it does not expose the storage account access key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Generate a user delegation SAS token
Why this is correct
Generating a user delegation SAS token is the most secure and recommended method for granting granular, time-limited access to Azure Blob Storage resources without exposing storage account keys. This type of SAS is signed using Azure Active Directory (Azure AD) credentials, allowing for precise control over permissions (e.g., read-only, write, list), the specific resources it applies to (container, blob), and its validity period. It integrates with Azure AD for auditing and adheres to the principle of least privilege.
- ✗
Provide the storage account access key
Why it's wrong here
Providing the storage account access key is a significant security risk because it grants full administrative control over the entire storage account, including all containers, blobs, queues, and tables. Sharing an access key bypasses all granular access controls and audit trails, making it impossible to revoke specific permissions or track individual resource access. This method violates the principle of least privilege and is never recommended for granting limited access.
- ✗
Assign the Storage Blob Data Reader role
Why it's wrong here
Assigning the Storage Blob Data Reader role is a valid Azure Role-Based Access Control (RBAC) method for granting read access to blob data, but it requires the accessing entity (user, group, or service principal) to authenticate directly with Azure Active Directory. This option is not about generating a token for external or anonymous access where direct Entra ID authentication by the consumer might not be feasible or desired. RBAC defines who can access, while a SAS token defines how and when specific resources can be accessed without direct Entra ID authentication.
- ✗
Configure a stored access policy
Why it's wrong here
Configuring a stored access policy defines a set of permissions and a validity period that can be referenced by one or more Service SAS tokens, providing a server-side mechanism to manage and revoke them. However, a stored access policy itself does not directly grant access to storage resources; it merely serves as a template or anchor for Service SAS tokens. You must still generate a Service SAS token that references this policy to provide actual access, and user delegation SAS tokens do not utilize stored access policies.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.