AZ-204 Develop for Azure storage Practice Question
You need to grant a user the ability to read and write blobs in a specific container for 24 hours. The solution must use delegated access without exposing the storage account key. What should you use?
⚠ Common exam trap
Many exam-takers confuse a service SAS (which is scoped to a single service like Blob) with a user delegation SAS, but the key differentiator is that a user delegation SAS uses Azure AD for signing, not the account key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User delegation shared access signature (SAS)
A user delegation SAS is secured with Azure AD credentials and is the only SAS type that uses delegated authorization without exposing the storage account key. It allows you to grant granular, time-limited access (e.g., 24 hours) to a specific container for read and write operations, meeting the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage account access key
Why it's wrong here
Using a storage account access key grants full administrative control over the entire storage account, including all services and data within it. This approach violates the principle of least privilege as it cannot be scoped to specific operations like reading/writing blobs or limited to a particular user. Distributing these keys poses a significant security risk, as their compromise grants unrestricted access to all storage resources.
- ✗
Account shared access signature (SAS)
Why it's wrong here
An Account SAS is signed with the storage account key and provides access to resources across all Azure Storage services (Blob, File, Queue, Table) within that account. While it offers more granular control than directly sharing the account key, it is still too broad for delegating specific blob read/write permissions to a user. Its reliance on the account key for signing makes it less secure for user delegation compared to Azure AD-backed methods.
- ✗
Service shared access signature (SAS)
Why it's wrong here
A Service SAS is signed with the storage account key and grants access to resources within a specific Azure Storage service, such as the Blob service. Although it can be scoped to a container or even a specific blob, its underlying security mechanism still depends on the storage account key. This method is not ideal for user delegation because it requires managing and potentially exposing the account key, rather than leveraging Azure AD identities.
- ✓
User delegation shared access signature (SAS)
Why this is correct
A User delegation SAS is the most secure and recommended method for granting delegated access to Azure Storage resources, as it is signed with an Azure AD credential. This SAS token allows permissions to be granted based on Azure RBAC roles assigned to the user or service principal, ensuring adherence to the principle of least privilege. It eliminates the need to distribute or manage storage account keys, significantly enhancing security for user-specific access to blobs.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.