Storage — Microsoft Azure Administrator AZ-104 practice questions

Azure Files supports identity-based authentication over SMB. Which identity sources can be used?

1. Microsoft Entra ID alone, with cloud-only user accounts authenticating directly to the share
2. On-premises Windows Server Active Directory Domain Services alone, over a private link
3. On-premises Active Directory, Microsoft Entra Domain Services, or Microsoft Entra Kerberos
4. Local user accounts defined per share, with the storage account key supplied as the password

Answer: C — On-premises Active Directory, Microsoft Entra Domain Services, or Microsoft Entra Kerberos

C lists the supported sources: on-premises Active Directory Domain Services, the managed Microsoft Entra Domain Services, and Microsoft Entra Kerberos for hybrid user accounts, each giving Windows ACL enforcement on the share. A and B are half-right answers that name one supported source and exclude the others. D describes key-based access, which authenticates to the account rather than to an identity and cannot honour per-file NTFS permissions.

A lifecycle management rule moves blobs to cool after 30 days and deletes them after 365. A team reports that a blob they downloaded yesterday was moved to cool anyway. The MOST likely reason is:

1. The rule's condition is based on the last modified time, and reading a blob does not change it
2. The rule ran before the download completed, so the next daily evaluation will move it back
3. Lifecycle rules ignore their stated conditions whenever the account's default access tier is cool
4. The blob carried an index tag that overrode the rule's own prefix and filter configuration

Answer: A — The rule's condition is based on the last modified time, and reading a blob does not change it

A) Correct — the usual lifecycle condition counts days since last modification, so downloads and other reads leave the clock untouched; a last-accessed condition must be chosen deliberately and requires access tracking. B) Lifecycle rules do not move blobs back to a warmer tier on their own. C) The account default tier applies to new blobs and does not suspend rule conditions. D) Index tags can filter which blobs a rule targets but do not override an otherwise matching condition.

Which storage redundancy option provides zone redundancy WITHIN the primary region AND read access to the secondary region?

1. LRS, which keeps three synchronous copies inside a single datacentre in the primary region
2. ZRS, which spreads three synchronous copies across separate availability zones in one region
3. GRS, which keeps locally redundant copies and replicates them asynchronously to a second region
4. RA-GZRS, which is zone redundant in the primary region and readable in the secondary region

Answer: D — RA-GZRS, which is zone redundant in the primary region and readable in the secondary region

D is the only option that satisfies both halves: geo-zone-redundant storage writes across three availability zones in the primary region, replicates asynchronously to a secondary region, and the read-access variant exposes that secondary for reads. B covers zones but has no secondary region. C has a secondary region but its primary copies are locally redundant, and plain GRS is not readable without the RA variant. A has neither property.

Which capability is available with an account SAS but NOT with a service SAS?

1. Granting read and write permissions on a single named blob for a limited period of time
2. Granting service-level operations such as reading the account's properties
3. Restricting the allowed source IP address range that may use the token
4. Restricting the token to the HTTPS protocol so plain HTTP is refused

Answer: B — Granting service-level operations such as reading the account's properties

B) Correct — an account SAS can authorise service-level operations, such as reading account properties or listing containers across services, which a service SAS cannot reach. A) Delegating access to an individual blob is precisely what a service SAS is for. C) Source IP restrictions are available on both kinds of shared access signature. D) The HTTPS-only protocol restriction is likewise available on both.

Which storage account type supports blobs, files, queues and tables together with the full set of blob access tiers?

1. General-purpose v1, a legacy account type that predates the access tier feature
2. Block blob storage, a premium account type that holds block and append blobs only
3. File storage, a premium account type that hosts SMB and NFS file shares only
4. General-purpose v2, the standard account type recommended for most new workloads
5. Blob storage, a legacy account type limited to block blobs and append blobs

Answer: D — General-purpose v2, the standard account type recommended for most new workloads

D is the general-purpose account Microsoft recommends by default: it offers all four services in one namespace and supports hot, cool, cold and archive tiering. A supports the same four services and is therefore the closest trap, but it has no access tiers and Microsoft advises upgrading it. B and C are premium single-purpose accounts chosen for latency, so each covers only part of the requirement. E predates general-purpose v2 and carries blobs alone.

A new storage account must support blob containers, file shares, queues and tables in one account, with the option to move blobs between access tiers later. Which account choice is MOST appropriate?

1. A general-purpose v2 account with a standard performance tier
2. A premium block blob account with locally redundant storage
3. A premium file storage account with zone-redundant storage
4. A general-purpose v2 account restricted to blob storage services only

Answer: A — A general-purpose v2 account with a standard performance tier

A) Correct — a general-purpose v2 account on standard performance hosts all four data services and supports the blob access tiers including archive. B) A premium block blob account serves blobs only and does not offer the standard access tier model. C) A premium file storage account hosts file shares alone. D) Restricting an account to blob storage removes the file, queue and table services the requirement names.

An account is configured for geo-redundant storage. During a regional incident, an application team wants to keep serving read requests from the secondary region without waiting for a failover. What must be true?

1. The account must be configured for read access to the secondary and the app must use the secondary endpoint
2. The account must have object replication configured between the primary and secondary regions beforehand
3. The application must hold a user delegation SAS that is explicitly scoped to the secondary region's endpoint
4. The account must be upgraded to a premium performance tier so that reads are served from both regions

Answer: A — The account must be configured for read access to the secondary and the app must use the secondary endpoint

A) Correct — plain geo-redundant storage keeps the secondary copy inaccessible until failover; the read-access variant exposes a secondary endpoint the application can read from directly. B) Object replication copies blobs between accounts an administrator chooses and is not how geo-redundancy's secondary is reached. C) A shared access signature authorises a caller; it does not make an unreadable secondary readable. D) Premium tiers change performance characteristics, not secondary read availability.

Which blob access tier has the lowest storage cost but the highest cost to read the data back?

1. Hot, which carries the highest storage cost together with the lowest per-transaction cost
2. Cool, intended for data that is expected to stay untouched for at least thirty days
3. Cold, intended for data that is expected to stay untouched for at least ninety days
4. Archive, which holds blobs offline and requires a rehydration before they can be read
5. Premium block blob, which uses solid-state media to deliver consistently low latency

Answer: D — Archive, which holds blobs offline and requires a rehydration before they can be read

D is the offline tier: blobs are not readable in place, so a rehydration to an online tier must complete before any read, which is why its retrieval cost is the highest while its storage cost is the lowest. B and C follow the same cost curve but remain online, so their retrieval cost is lower. A inverts the trade-off entirely. E is a performance tier chosen at account creation and is the most expensive to store, which is the opposite of what the question describes.

A storage account has Allow Blob anonymous access set to Disabled. What happens to existing containers configured for public access?

1. The containers convert automatically to the private access level and the change is recorded
2. The containers stay anonymously reachable until an administrator changes each one by hand
3. Anonymous requests are refused at the account level regardless of the container access level
4. The public blob data is deleted by the platform once the account-level setting is applied
5. The setting applies only to containers created later, leaving the existing ones reachable

Answer: C — Anonymous requests are refused at the account level regardless of the container access level

C reflects how the account-level switch works: it is evaluated before the container setting, so anonymous requests fail even though the container is still marked public. B and E both assume the setting is advisory or forward-looking, which is the common misreading. A sounds tidy but the container's own access level is left untouched, which matters if the account setting is later re-enabled. D never happens; Azure does not delete customer data in response to a configuration change.

A service SAS with a thirty-day expiry has leaked. The administrator must revoke that one token without disrupting other applications using the same account. Which prior design decision makes this possible?

1. The SAS was issued against a stored access policy on the container
2. The SAS was issued with an HTTPS-only protocol restriction applied
3. The SAS was issued with a start time set several minutes in the past
4. The SAS was issued with read and list permissions rather than write

Answer: A — The SAS was issued against a stored access policy on the container

A) Correct — a SAS tied to a stored access policy inherits its constraints from that policy, so deleting or changing the policy invalidates just those tokens while other applications continue. B) Requiring HTTPS protects the token in transit but gives no way to revoke it once leaked. C) A backdated start time avoids clock-skew failures and has nothing to do with revocation. D) Narrower permissions limit the damage but the token remains valid until it expires.

Lifecycle management?

Auto-tier or delete blobs based on rules. Saves cost.

Azure storage account types?

General-purpose v2 (recommended), Blob, FileStorage, BlockBlobStorage, etc.

Why is a service SAS tied to a stored access policy easier to revoke than an ad hoc SAS?

The policy on the container holds the start time, expiry and permissions, so deleting or editing the policy invalidates every SAS issued against it immediately. An ad hoc SAS embeds those terms in the token itself, so the only way to revoke it is to rotate the account key that signed it.