AZ-204 Develop for Azure storage Practice Question
You need to provide temporary access to a file in Azure Blob Storage for a duration of one hour. The solution must not require authentication. What should you generate?
⚠ Common exam trap
A common mix-up: candidates confuse a SAS with a storage account key or user delegation key, mistakenly thinking those provide temporary access without authentication, when in fact they are secrets used to generate SAS tokens or require authentication themselves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A shared access signature (SAS) with read permission and an expiration time of one hour.
A shared access signature (SAS) with read permission and a one-hour expiration provides time-limited, delegated access to a specific blob without requiring authentication. The SAS token is appended to the URL and grants the specified permissions for the defined duration, meeting the requirement of temporary access without authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage account key.
Why it's wrong here
A storage account key grants full administrative access to *all* resources within the entire storage account, not just a single file. This level of access is permanent until the key is regenerated, making it highly insecure and inappropriate for providing temporary, granular access to a specific blob. Sharing it would expose all data and operations, far exceeding the requirement for temporary file access.
- ✗
Enable anonymous public read access on the container.
Why it's wrong here
Enabling anonymous public read access on a container makes *all* blobs within that container accessible to anyone on the internet, indefinitely, without any form of authentication. This approach fails to meet the requirement for *temporary* access to a *single specific file* and introduces a significant security risk by exposing potentially sensitive data broadly. It lacks control over duration or scope for individual files.
- ✗
A user delegation key.
Why it's wrong here
A user delegation key is a security credential obtained from Azure Active Directory that is used to *sign* a user delegation shared access signature (SAS). It does not directly provide access to Azure Blob Storage resources itself. Instead, it acts as an authorization mechanism for creating a time-limited, permission-scoped SAS token that *then* grants access, rather than being the access mechanism itself.
- ✓
A shared access signature (SAS) with read permission and an expiration time of one hour.
Why this is correct
A Shared Access Signature (SAS) is the ideal solution for providing temporary, delegated access to specific Azure Storage resources, such as a single blob. By configuring it with read permission and a one-hour expiration time, you grant precisely the required access without exposing your storage account key or making the resource permanently public. The SAS token provides a secure, time-limited URI that can be shared with the intended recipient, fulfilling all requirements.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.