AZ-204 Develop for Azure storage Practice Question
You need to grant access to a blob stored in Azure Blob Storage for 30 minutes to a user who does not have an Azure account. Which security mechanism should you use?
⚠ Common exam trap
Test-takers frequently confuse SAS tokens with storage account access keys, mistakenly thinking keys can be scoped or time-limited, or they assume RBAC can be used for external users without understanding the Azure AD dependency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared Access Signature (SAS) token
A Shared Access Signature (SAS) token is the correct choice because it provides delegated, time-limited access to a specific blob resource without requiring the user to have an Azure account. You can set the token's expiry to 30 minutes, granting temporary access via a URI that includes the necessary authentication parameters. This mechanism is designed for scenarios where you need to grant granular, time-bound access to external users or clients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC roles
Why it's wrong here
Azure RBAC (Role-Based Access Control) roles are designed to manage access to Azure resources for Azure Active Directory (Azure AD) identities, including users, groups, service principals, and managed identities. While powerful for identity-based access within the Azure ecosystem, RBAC is not suitable for granting time-limited access to external clients or applications that do not possess an Azure AD identity. It requires the principal to authenticate against Azure AD, which is often not the scenario for temporary, external blob access.
- ✗
Storage account access keys
Why it's wrong here
Storage account access keys provide full administrative access to all data within an entire storage account, including all containers, blobs, queues, and tables. These keys are static, long-lived credentials that offer no granularity in permissions (e.g., read-only access to a specific blob) and do not support time-limited validity. Sharing them broadly is a significant security risk, as they grant complete control, making them inappropriate for secure, temporary, or restricted access to a single blob.
- ✗
Managed identity
Why it's wrong here
Managed identities provide an Azure Active Directory identity for Azure resources, such as virtual machines or Azure App Services, enabling them to authenticate to other Azure services without managing credentials. They are specifically designed for secure Azure-to-Azure communication and resource authentication within the Azure environment. Managed identities cannot be directly used by external users or applications outside of Azure to access storage resources, as they are tied to the lifecycle of an Azure resource.
- ✓
Shared Access Signature (SAS) token
Why this is correct
A Shared Access Signature (SAS) token is a URI that grants delegated access to specific Azure Storage resources with granular permissions and a defined validity period. It allows clients to access resources like a single blob, a container, or even an entire storage account, without sharing the storage account key or requiring an Azure AD identity. SAS tokens are ideal for securely providing time-limited, restricted access to external users or applications, ensuring the principle of least privilege.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.