AZ-204 Develop for Azure storage Practice Question
Your application stores user-generated content in Azure Blob Storage. You need to implement a shared access signature (SAS) that allows users to upload files to a specific container but not read or delete. The SAS must be valid for one hour. Which type of SAS should you use?
⚠ Common exam trap
Many exam-takers confuse 'Service SAS' with 'Account SAS' because both can be used for blobs, but the Account SAS applies to the entire storage account and cannot be restricted to a single container, whereas the Service SAS is resource-specific.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service SAS
A Service SAS is the correct choice because it allows you to delegate access to a specific Azure Blob Storage resource (in this case, a container) with granular permissions. You can generate a Service SAS scoped to the container with only the 'Create' and 'Write' permissions (no 'Read' or 'Delete'), and set its expiry to one hour. This meets the requirement of allowing uploads while preventing reads or deletes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Account SAS
Why it's wrong here
An Account SAS grants broad access to *all* services (Blob, File, Queue, Table) and *all* resources within a storage account. While it can be restricted by IP address and protocol, it cannot be scoped down to a single container or specific permissions like "write-only" for a particular resource type. This makes it overly permissive and a security risk for delegating access to user-generated content in a specific container, violating the principle of least privilege.
- ✓
Service SAS
Why this is correct
A Service SAS is the most appropriate choice as it allows for highly granular control over access to a specific storage service, such as Azure Blob Storage. It can be precisely scoped to a particular container, defining exact permissions like "write-only," and setting an expiry time. This ensures that users can upload content to the designated container without gaining any other access, aligning perfectly with the principle of least privilege for this scenario.
- ✗
Stored access policy
Why it's wrong here
A stored access policy is not a type of Shared Access Signature (SAS) itself, but rather a server-side construct used to manage and revoke Service SAS tokens. It defines permissions, start time, and expiry for SAS tokens that reference it, providing a centralized control point. While useful for managing multiple SAS tokens, it does not *generate* the SAS token; it merely provides a template for its parameters, making it an incorrect answer for a "SAS type."
- ✗
User delegation SAS
Why it's wrong here
A User delegation SAS provides delegated access to Azure Storage resources using Azure Active Directory (Azure AD) credentials. While it offers robust security and can be scoped to specific resources and permissions, it requires an Azure AD security principal with appropriate RBAC roles to sign the SAS. This introduces additional complexity and overhead compared to a Service SAS when the primary requirement is simple, time-limited, write-only access to a container for potentially anonymous users.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.