AZ-204 Develop for Azure storage Practice Question
You need to grant a user access to read and write blobs in a specific container for exactly 24 hours. The user is external to your organization. Which two methods can you use? (Choose two.)
⚠ Common exam trap
Candidates often confuse an account SAS with a service SAS, assuming an account SAS can be scoped to a single container, but in reality, an account SAS applies to the entire storage account and cannot be restricted to a specific container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a shared access signature (SAS) token with an expiry time of 24 hours
A shared access signature (SAS) token can be scoped to a specific container and granted read and write permissions, with an expiry time set to exactly 24 hours. This allows the external user to access only that container for the specified duration without exposing the storage account key or requiring Azure AD authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a shared access signature (SAS) token with an expiry time of 24 hours
Why this is correct
A service-level Shared Access Signature (SAS) token is the most appropriate solution here because it allows for granular, time-limited access to specific resources, such as a container or blob. By generating a service SAS for the target container with read and write permissions and a 24-hour expiry, the user gains the necessary access without compromising the entire storage account. This method adheres to the principle of least privilege, providing temporary, scoped access.
- ✗
Share the storage account access key with the user
Why it's wrong here
Sharing the storage account access key is a severe security risk as it grants full, unrestricted administrative access to all data and services within the entire storage account. These keys are not time-limited and provide root-level control, making them completely unsuitable for granting temporary or restricted permissions to a user. This approach bypasses all security best practices and auditing capabilities.
- ✗
Create an account SAS token with read and write permissions
Why it's wrong here
An account-level Shared Access Signature (SAS) token provides broad access across all services (Blob, File, Queue, Table) and all containers or resources within the entire storage account. While it can be time-limited, its wide scope makes it overly permissive for a requirement to access only specific blobs in a single container. This violates the principle of least privilege by granting far more access than necessary.
- ✓
Generate a user delegation SAS key using Azure AD credentials
Why this is correct
Generating a user delegation SAS key is a highly secure and recommended method, especially when integrating with Azure Active Directory (Azure AD) for authorization. This type of SAS is signed with Azure AD credentials, allowing for better auditing and integration with identity management systems. It can be precisely scoped to a specific container or blob with defined permissions and an expiry, providing secure, temporary, and auditable access.
- ✗
Assign the 'Storage Blob Data Contributor' role to the user's Microsoft account
Why it's wrong here
Assigning an Azure Role-Based Access Control (RBAC) role like 'Storage Blob Data Contributor' grants persistent permissions that remain active until explicitly removed. While this role provides the correct read/write access to blobs, it is not designed for temporary access requirements, nor is it typically the preferred method for external users needing short-term access. RBAC is best suited for long-term, internal access management within an organization's Azure AD tenant.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Microsoft Identity Platform
Microsoft Identity Platform is a unified authentication and authorization service that enables applications to sign in users and access resources using Microsoft Entra ID and modern protocols.
Key term
Shared Access Signatures
A Shared Access Signature (SAS) is a secure token that grants limited, time-bound access to specific Azure Storage resources without exposing your account key.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A storage account for thumbnail metadata must allow an application to read only blobs under one container for two hours. The application should not receive the account key. What should be issued? The design must avoid adding custom operational scripts.
hard- A.A public access level on the container
- ✓ B.A service SAS scoped to the container with read permission and expiry
- C.A management group assignment
- D.The storage account access key
Why B: A service SAS (Shared Access Signature) scoped to a specific container with read permission and an expiry time of two hours meets the requirement: it grants time-limited read access to blobs under that container without exposing the account key. The SAS token is issued to the application, which can then use it to authenticate requests directly to Azure Blob Storage, avoiding the need for custom scripts.
Variation 2. A storage account for thumbnail metadata must allow an application to read only blobs under one container for two hours. The application should not receive the account key. What should be issued?
hard- A.A public access level on the container
- ✓ B.A service SAS scoped to the container with read permission and expiry
- C.A management group assignment
- D.The storage account access key
Why B: A service SAS scoped to a container with read permission and an expiry of two hours is the correct approach because it provides delegated, time-limited access to specific blobs under that container without exposing the storage account key. The SAS token is generated using the account key but the application only receives the token, not the key itself, ensuring the key remains secure. This meets the requirement for read-only access to a single container for a limited duration.
Variation 3. You have an Azure Storage account that contains a blob container with thousands of small files. You need to generate a URL that allows users to download a single file for a limited time without changing the storage account's firewall rules or requiring authentication. Which approach should you use?
medium- ✓ A.Create a Shared Access Signature (SAS) for the specific blob with a time limit
- B.Provide the storage account key to the user so they can authenticate
- C.Assign the user an RBAC role (e.g., Storage Blob Data Reader) and have them authenticate via Microsoft Entra ID
- D.Set the blob container's public access level to Blob (anonymous read access for blobs)
Why A: A Shared Access Signature (SAS) for a specific blob provides delegated, time-limited access to that blob without requiring the storage account key or changing firewall rules. By generating a SAS token with a defined expiration time and attaching it to the blob URL, users can download the file directly via HTTPS while the storage account remains secured behind its firewall and authentication requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.