AZ-204 Develop for Azure storage Practice Question
Your company develops a REST API for a global e-commerce platform that stores product images in Azure Blob Storage. The API uses shared access signatures (SAS) to grant temporary read access to the images. The security team requires that SAS tokens be generated using a user delegation key derived from the application's Microsoft Entra ID credentials, not from the storage account key. Additionally, the SAS must be scoped to a specific container and have a maximum validity of 1 hour. You need to implement the SAS generation in the API using the Azure Storage SDK for .NET. The application authenticates with Microsoft Entra ID using a managed identity assigned to the Azure App Service hosting the API. Which approach should you use?
⚠ Common exam trap
Watch out — candidates often confuse the user delegation SAS workflow with the simpler account-key-based SAS, or mistakenly think that a direct 'GenerateUserDelegationSas' method exists on a container client. Additionally, candidates might confuse the conceptual 'generate SAS' with the specific SDK method `ToSasQueryParameters` on `BlobSasBuilder`, which is used after obtaining the user delegation key from the service client.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync, then create a BlobSasBuilder with the key and call ToSasQueryParameters.
It follows the required pattern for generating a user delegation SAS: authenticate with managed identity via a BlobServiceClient, call GetUserDelegationKeyAsync to obtain a key derived from Microsoft Entra ID (not the storage account key), then use BlobSasBuilder with that key to call ToSasQueryParameters, which produces a SAS token query string scoped to a specific container with a 1-hour validity. This meets the security team's requirement of using Entra ID credentials and avoids exposing the storage account key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync to get a key, and then call BlobSasBuilder.GenerateSas using the key.
Why it's wrong here
This option correctly describes the secure and recommended process for generating a User Delegation SAS (UDSAS) token. It leverages Azure AD authentication via managed identity to obtain a temporary user delegation key from the Blob service using `GetUserDelegationKeyAsync`. Subsequently, this key is used with `BlobSasBuilder.GenerateSas` to cryptographically sign and produce the time-limited, granular SAS token, ensuring the storage account key is never directly exposed.
- ✗
Use the StorageSharedKeyCredential with the storage account key to create a BlobSasBuilder and generate a SAS token.
Why it's wrong here
This approach generates a Service SAS or Account SAS, not a User Delegation SAS. While `StorageSharedKeyCredential` can create a valid SAS, it relies on the storage account's shared key, which grants extensive permissions and poses a significant security risk if compromised. The goal of a User Delegation SAS is to provide a more secure, Azure AD-backed method for delegated access without exposing the master account key.
- ✗
Use DefaultAzureCredential to authenticate, then call GenerateUserDelegationSas on the BlobContainerClient.
Why it's wrong here
While `DefaultAzureCredential` is appropriate for authenticating with Azure AD, the `BlobContainerClient` (or `BlobClient`) does not directly offer a `GenerateUserDelegationSas` method that encapsulates the entire UDSAS generation process. To create a User Delegation SAS, you must explicitly obtain a `UserDelegationKey` from the `BlobServiceClient` first, using an Azure AD identity, and then use that key to construct the SAS with a `BlobSasBuilder`.
- ✓
Use the managed identity credentials to create a BlobServiceClient, then call GetUserDelegationKeyAsync, then create a BlobSasBuilder with the key and call ToSasQueryParameters.
Why this is correct
This option correctly identifies the initial steps of using managed identity and `GetUserDelegationKeyAsync` to retrieve the user delegation key. However, `ToSasQueryParameters` on `BlobSasBuilder` only converts the builder's configured parameters into an unsigned query string fragment. It does not perform the crucial step of signing the SAS with the user delegation key to generate a complete, cryptographically secure SAS token; that function is performed by `GenerateSas`.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Shared Access Signatures
A Shared Access Signature (SAS) is a secure token that grants limited, time-bound access to specific Azure Storage resources without exposing your account key.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.