Describe considerations for working with non-relational data on Azure →easyMultiple ChoiceObjective-mapped
DP-900 Practice Question: Describe considerations for working with non-relational data on Azure
A company stores user profile images in Azure Blob Storage. Each image is accessed via a URL that includes a Shared Access Signature (SAS) token generated using the storage account key. The company needs to immediately revoke access to all images for a specific user. Which action should they take?
⚠ Common exam trap
Many exam-takers think SAS tokens can be individually deleted or regenerated, but Azure does not maintain a token registry; the only way to invalidate all tokens derived from an account key is to rotate the key itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the storage account access keys.
Changing the storage account access keys invalidates all SAS tokens that were generated using those keys, including any existing tokens. This immediately revokes access to all images for all users, including the specific user, without needing to manage individual tokens. SAS tokens are signed with the account key, so rotating the key renders all tokens generated with the old key invalid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the individual SAS tokens associated with that user's images.
Why it's wrong here
Azure Blob Storage does not persist or track issued SAS tokens; they are client-generated signed strings that include a signature computed from the storage account key or a stored access policy. Therefore, there is no management operation to delete a single SAS token, and no way to target and revoke one token without affecting others. Revocation only occurs when the token expires, the signing key is changed, or the referenced stored access policy is removed or altered.
- ✓
Change the storage account access keys.
Why this is correct
Rotating an Azure Storage account access key immediately invalidates every SAS token whose signature was computed with that key, because the signature is a keyed hash that can no longer be verified. This provides a definitive way to revoke the user's images access without deleting any data, though it also revokes all other SAS tokens that used the same key, so new tokens must be issued to legitimate users. The account key is the root credential for all types of SAS tokens, making this the most forceful revocation mechanism available.
- ✗
Delete the container containing the user's images.
Why it's wrong here
Deleting the container in which the user's profile images reside is an irreversible and non-targeted action that removes blobs belonging to every user stored in that container. Even if the container is deleted, any SAS token that references a now-missing blob would fail only because the blob no longer exists, not because the token was revoked; the token itself remains technically valid until it expires. This approach causes widespread data loss and would not specifically address the user's access, making it an incorrect method.
- ✗
Regenerate the SAS token for each image.
Why it's wrong here
Generating a new SAS token for each image does not invalidate previously issued tokens; the old SAS token remains valid until its embedded expiration time, independent of any new tokens created. Unless the new token is generated under a different signing key or a stored access policy that is modified, the old credential still grants access to the blob. Thus, regenerating tokens is an ineffective operational fix for immediate revocation and only helps with proactive issuance of fresh credentials.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.