AZ-204 Develop for Azure storage Practice Question
Your company stores sensitive financial documents in Azure Blob Storage. You need to ensure that only authorized users can access the blobs, and you must avoid exposing storage account keys. You want to generate time-limited URLs that grant access to specific blobs. What should you use?
⚠ Common exam trap
Azure exam often tests the misconception that RBAC or managed identities can generate time-limited URLs, but they cannot—only SAS tokens provide the ability to create scoped, time-bound URLs without exposing account keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Shared Access Signatures (SAS)
Shared Access Signatures (SAS) are the correct choice because they allow you to delegate access to specific blobs with granular permissions (read, write, delete) and enforce a time-limited validity period, all without exposing the storage account keys. This directly meets the requirement of generating time-limited URLs for authorized access while keeping the account keys secure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Shared Access Signatures (SAS)
Why this is correct
SAS tokens provide time-limited, delegated access to specific blobs.
- ✗
Storage account access keys
Why it's wrong here
Access keys provide full account access and are not time-limited.
- ✗
Azure role-based access control (RBAC)
Why it's wrong here
RBAC does not generate time-limited URLs for specific blobs.
- ✗
Managed identities for Azure resources
Why it's wrong here
Managed identities are used for authentication, not for generating URLs.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.