Microsoft AZ-104 Azure Storage Access and Security Practice Test

 

Topic 05 focuses on Storage Network Access, SAS, Access Keys, and Identity-Based Access for the Microsoft Certified: Azure Administrator Associate certification and the AZ-104 exam, using Microsoft Azure administration scenarios. For broader exam preparation, review the Microsoft Azure Administrator AZ-104 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

To limit storage access to approved networks, addresses, or private connectivity paths, which Azure configuration should be selected?

1. Storage account firewall
2. Service SAS
3. SAS expiry
4. IP network rule

Correct Answer: A

 

Correct Answer

Answer A is correct because Storage account firewall is the network-access control that restricts requests to a storage account according to configured network rules and public network access settings. It directly supports the requirement to limit storage access to approved networks, addresses, or private connectivity paths.

Incorrect Answers

Answer B is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

Answer C is incorrect because SAS expiry is used to reduce the exposure window of delegated storage access; it does not provide the capability described in the scenario.

Answer D is incorrect because IP network rule is used to allow approved public client addresses while blocking other public network sources; it does not provide the capability described in the scenario.

 

Question 2

For Storage account firewall, which administrative outcome is expected?

1. Limit storage access to approved networks, addresses, or private connectivity paths
2. Allow users to access SMB file shares with organizational identities
3. Reduce the exposure window of delegated storage access
4. Provide scoped time-limited access at the storage-account service level

Correct Answer: A

 

Correct Answer

Answer A is correct because Storage account firewall is the network-access control that restricts requests to a storage account according to configured network rules and public network access settings. Its intended administrative use is to limit storage access to approved networks, addresses, or private connectivity paths.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Identity-based access for Azure Files, which is used to allow users to access SMB file shares with organizational identities; it is not the primary purpose of Storage account firewall.

Answer C is incorrect because that outcome belongs to SAS expiry, which is used to reduce the exposure window of delegated storage access; it is not the primary purpose of Storage account firewall.

Answer D is incorrect because that outcome belongs to Account SAS, which is used to provide scoped time-limited access at the storage-account service level; it is not the primary purpose of Storage account firewall.

 

Question 3

To allow a designated Azure subnet to reach a storage account through approved network configuration, which Azure configuration should be selected?

1. Virtual network rule
2. Storage account firewall
3. Shared Key authorization setting
4. Account SAS

Correct Answer: A

 

Correct Answer

Answer A is correct because Virtual network rule is a storage network rule that authorizes traffic from selected virtual network subnets. It directly supports the requirement to allow a designated Azure subnet to reach a storage account through approved network configuration.

Incorrect Answers

Answer B is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

Answer C is incorrect because Shared Key authorization setting is used to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization; it does not provide the capability described in the scenario.

Answer D is incorrect because Account SAS is used to provide scoped time-limited access at the storage-account service level; it does not provide the capability described in the scenario.

 

Question 4

For Virtual network rule, which administrative outcome is expected?

1. Provide scoped time-limited access at the storage-account service level
2. Allow a designated Azure subnet to reach a storage account through approved network configuration
3. Replace exposed or aging shared keys without requiring a simultaneous outage for all clients
4. Avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID

Correct Answer: B

 

Correct Answer

Answer B is correct because Virtual network rule is a storage network rule that authorizes traffic from selected virtual network subnets. Its intended administrative use is to allow a designated Azure subnet to reach a storage account through approved network configuration.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Account SAS, which is used to provide scoped time-limited access at the storage-account service level; it is not the primary purpose of Virtual network rule.

Answer C is incorrect because that outcome belongs to Access key rotation, which is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it is not the primary purpose of Virtual network rule.

Answer D is incorrect because that outcome belongs to Microsoft Entra authorization for Blob Storage, which is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it is not the primary purpose of Virtual network rule.

 

Question 5

To allow approved public client addresses while blocking other public network sources, which Azure configuration should be selected?

1. Access key rotation
2. Service SAS
3. User delegation SAS
4. IP network rule

Correct Answer: D

 

Correct Answer

Answer D is correct because IP network rule is a storage firewall rule that permits requests from specified public IPv4 address ranges. It directly supports the requirement to allow approved public client addresses while blocking other public network sources.

Incorrect Answers

Answer A is incorrect because Access key rotation is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it does not provide the capability described in the scenario.

Answer B is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

Answer C is incorrect because User delegation SAS is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it does not provide the capability described in the scenario.

 

Question 6

For IP network rule, which administrative outcome is expected?

1. Grant blob data modification permissions using Azure RBAC
2. Replace exposed or aging shared keys without requiring a simultaneous outage for all clients
3. Allow approved public client addresses while blocking other public network sources
4. Reduce the exposure window of delegated storage access

Correct Answer: C

 

Correct Answer

Answer C is correct because IP network rule is a storage firewall rule that permits requests from specified public IPv4 address ranges. Its intended administrative use is to allow approved public client addresses while blocking other public network sources.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Storage Blob Data Contributor, which is used to grant blob data modification permissions using Azure RBAC; it is not the primary purpose of IP network rule.

Answer B is incorrect because that outcome belongs to Access key rotation, which is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it is not the primary purpose of IP network rule.

Answer D is incorrect because that outcome belongs to SAS expiry, which is used to reduce the exposure window of delegated storage access; it is not the primary purpose of IP network rule.

 

Question 7

To grant time-limited scoped access to a storage service resource without sharing the account key directly, which Azure configuration should be selected?

1. Access key rotation
2. Stored access policy
3. Service SAS
4. Identity-based access for Azure Files

Correct Answer: C

 

Correct Answer

Answer C is correct because Service SAS is a shared access signature that delegates limited access to a specific Azure Storage service resource such as a blob container or file share. It directly supports the requirement to grant time-limited scoped access to a storage service resource without sharing the account key directly.

Incorrect Answers

Answer A is incorrect because Access key rotation is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it does not provide the capability described in the scenario.

Answer B is incorrect because Stored access policy is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it does not provide the capability described in the scenario.

Answer D is incorrect because Identity-based access for Azure Files is used to allow users to access SMB file shares with organizational identities; it does not provide the capability described in the scenario.

 

Question 8

For Service SAS, which administrative outcome is expected?

1. Delegate Blob Storage access while using Microsoft Entra authorization for SAS signing
2. Grant time-limited scoped access to a storage service resource without sharing the account key directly
3. Avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID
4. Grant blob data modification permissions using Azure RBAC

Correct Answer: B

 

Correct Answer

Answer B is correct because Service SAS is a shared access signature that delegates limited access to a specific Azure Storage service resource such as a blob container or file share. Its intended administrative use is to grant time-limited scoped access to a storage service resource without sharing the account key directly.

Incorrect Answers

Answer A is incorrect because that outcome belongs to User delegation SAS, which is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it is not the primary purpose of Service SAS.

Answer C is incorrect because that outcome belongs to Microsoft Entra authorization for Blob Storage, which is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it is not the primary purpose of Service SAS.

Answer D is incorrect because that outcome belongs to Storage Blob Data Contributor, which is used to grant blob data modification permissions using Azure RBAC; it is not the primary purpose of Service SAS.

 

Question 9

To provide scoped time-limited access at the storage-account service level, which Azure configuration should be selected?

1. Identity-based access for Azure Files
2. Storage account firewall
3. Service SAS
4. Account SAS

Correct Answer: D

 

Correct Answer

Answer D is correct because Account SAS is a shared access signature that can delegate permissions across one or more services in a storage account. It directly supports the requirement to provide scoped time-limited access at the storage-account service level.

Incorrect Answers

Answer A is incorrect because Identity-based access for Azure Files is used to allow users to access SMB file shares with organizational identities; it does not provide the capability described in the scenario.

Answer B is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

Answer C is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

 

Question 10

For Account SAS, which administrative outcome is expected?

1. Limit storage access to approved networks, addresses, or private connectivity paths
2. Provide scoped time-limited access at the storage-account service level
3. Limit a SAS token to only the operations the recipient actually requires
4. Reduce the exposure window of delegated storage access

Correct Answer: B

 

Correct Answer

Answer B is correct because Account SAS is a shared access signature that can delegate permissions across one or more services in a storage account. Its intended administrative use is to provide scoped time-limited access at the storage-account service level.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Storage account firewall, which is used to limit storage access to approved networks, addresses, or private connectivity paths; it is not the primary purpose of Account SAS.

Answer C is incorrect because that outcome belongs to SAS permissions, which is used to limit a SAS token to only the operations the recipient actually requires; it is not the primary purpose of Account SAS.

Answer D is incorrect because that outcome belongs to SAS expiry, which is used to reduce the exposure window of delegated storage access; it is not the primary purpose of Account SAS.

 

Question 11

To delegate Blob Storage access while using Microsoft Entra authorization for SAS signing, which Azure configuration should be selected?

1. Account SAS
2. User delegation SAS
3. SAS permissions
4. Storage account firewall

Correct Answer: B

 

Correct Answer

Answer B is correct because User delegation SAS is a Blob Storage SAS secured with Microsoft Entra credentials rather than directly with the storage account key. It directly supports the requirement to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing.

Incorrect Answers

Answer A is incorrect because Account SAS is used to provide scoped time-limited access at the storage-account service level; it does not provide the capability described in the scenario.

Answer C is incorrect because SAS permissions is used to limit a SAS token to only the operations the recipient actually requires; it does not provide the capability described in the scenario.

Answer D is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

 

Question 12

For User delegation SAS, which administrative outcome is expected?

1. Delegate Blob Storage access while using Microsoft Entra authorization for SAS signing
2. Grant time-limited scoped access to a storage service resource without sharing the account key directly
3. Allow users to access SMB file shares with organizational identities
4. Reduce the exposure window of delegated storage access

Correct Answer: A

 

Correct Answer

Answer A is correct because User delegation SAS is a Blob Storage SAS secured with Microsoft Entra credentials rather than directly with the storage account key. Its intended administrative use is to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Service SAS, which is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it is not the primary purpose of User delegation SAS.

Answer C is incorrect because that outcome belongs to Identity-based access for Azure Files, which is used to allow users to access SMB file shares with organizational identities; it is not the primary purpose of User delegation SAS.

Answer D is incorrect because that outcome belongs to SAS expiry, which is used to reduce the exposure window of delegated storage access; it is not the primary purpose of User delegation SAS.

 

Question 13

To centrally modify or revoke access represented by service SAS tokens linked to the policy, which Azure configuration should be selected?

1. Service SAS
2. Access key rotation
3. Stored access policy
4. SAS permissions

Correct Answer: C

 

Correct Answer

Answer C is correct because Stored access policy is a named server-side policy on a supported storage resource that can define constraints for associated service SAS tokens. It directly supports the requirement to centrally modify or revoke access represented by service SAS tokens linked to the policy.

Incorrect Answers

Answer A is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

Answer B is incorrect because Access key rotation is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it does not provide the capability described in the scenario.

Answer D is incorrect because SAS permissions is used to limit a SAS token to only the operations the recipient actually requires; it does not provide the capability described in the scenario.

 

Question 14

For Stored access policy, which administrative outcome is expected?

1. Grant blob data modification permissions using Azure RBAC
2. Centrally modify or revoke access represented by service SAS tokens linked to the policy
3. Delegate Blob Storage access while using Microsoft Entra authorization for SAS signing
4. Limit storage access to approved networks, addresses, or private connectivity paths

Correct Answer: B

 

Correct Answer

Answer B is correct because Stored access policy is a named server-side policy on a supported storage resource that can define constraints for associated service SAS tokens. Its intended administrative use is to centrally modify or revoke access represented by service SAS tokens linked to the policy.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Storage Blob Data Contributor, which is used to grant blob data modification permissions using Azure RBAC; it is not the primary purpose of Stored access policy.

Answer C is incorrect because that outcome belongs to User delegation SAS, which is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it is not the primary purpose of Stored access policy.

Answer D is incorrect because that outcome belongs to Storage account firewall, which is used to limit storage access to approved networks, addresses, or private connectivity paths; it is not the primary purpose of Stored access policy.

 

Question 15

To limit a SAS token to only the operations the recipient actually requires, which Azure configuration should be selected?

1. SAS permissions
2. User delegation SAS
3. Storage account firewall
4. Microsoft Entra authorization for Blob Storage

Correct Answer: A

 

Correct Answer

Answer A is correct because SAS permissions is the operations encoded in a shared access signature, such as read, write, delete, or list. It directly supports the requirement to limit a SAS token to only the operations the recipient actually requires.

Incorrect Answers

Answer B is incorrect because User delegation SAS is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it does not provide the capability described in the scenario.

Answer C is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

Answer D is incorrect because Microsoft Entra authorization for Blob Storage is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it does not provide the capability described in the scenario.

 

Question 16

For SAS permissions, which administrative outcome is expected?

1. Centrally modify or revoke access represented by service SAS tokens linked to the policy
2. Limit a SAS token to only the operations the recipient actually requires
3. Grant blob data modification permissions using Azure RBAC
4. Reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization

Correct Answer: B

 

Correct Answer

Answer B is correct because SAS permissions is the operations encoded in a shared access signature, such as read, write, delete, or list. Its intended administrative use is to limit a SAS token to only the operations the recipient actually requires.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Stored access policy, which is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it is not the primary purpose of SAS permissions.

Answer C is incorrect because that outcome belongs to Storage Blob Data Contributor, which is used to grant blob data modification permissions using Azure RBAC; it is not the primary purpose of SAS permissions.

Answer D is incorrect because that outcome belongs to Shared Key authorization setting, which is used to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization; it is not the primary purpose of SAS permissions.

 

Question 17

To reduce the exposure window of delegated storage access, which Azure configuration should be selected?

1. SAS expiry
2. SAS permissions
3. Service SAS
4. Storage account access key

Correct Answer: A

 

Correct Answer

Answer A is correct because SAS expiry is the end time after which a shared access signature is no longer accepted. It directly supports the requirement to reduce the exposure window of delegated storage access.

Incorrect Answers

Answer B is incorrect because SAS permissions is used to limit a SAS token to only the operations the recipient actually requires; it does not provide the capability described in the scenario.

Answer C is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

Answer D is incorrect because Storage account access key is used to support shared-key authentication when required while treating the key as a sensitive credential; it does not provide the capability described in the scenario.

 

Question 18

For SAS expiry, which administrative outcome is expected?

1. Delegate Blob Storage access while using Microsoft Entra authorization for SAS signing
2. Support shared-key authentication when required while treating the key as a sensitive credential
3. Reduce the exposure window of delegated storage access
4. Limit a SAS token to only the operations the recipient actually requires

Correct Answer: C

 

Correct Answer

Answer C is correct because SAS expiry is the end time after which a shared access signature is no longer accepted. Its intended administrative use is to reduce the exposure window of delegated storage access.

Incorrect Answers

Answer A is incorrect because that outcome belongs to User delegation SAS, which is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it is not the primary purpose of SAS expiry.

Answer B is incorrect because that outcome belongs to Storage account access key, which is used to support shared-key authentication when required while treating the key as a sensitive credential; it is not the primary purpose of SAS expiry.

Answer D is incorrect because that outcome belongs to SAS permissions, which is used to limit a SAS token to only the operations the recipient actually requires; it is not the primary purpose of SAS expiry.

 

Question 19

To support shared-key authentication when required while treating the key as a sensitive credential, which Azure configuration should be selected?

1. Stored access policy
2. SAS expiry
3. Storage account access key
4. Storage account firewall

Correct Answer: C

 

Correct Answer

Answer C is correct because Storage account access key is one of the high-privilege shared keys that can authorize broad access to a storage account. It directly supports the requirement to support shared-key authentication when required while treating the key as a sensitive credential.

Incorrect Answers

Answer A is incorrect because Stored access policy is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it does not provide the capability described in the scenario.

Answer B is incorrect because SAS expiry is used to reduce the exposure window of delegated storage access; it does not provide the capability described in the scenario.

Answer D is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

 

Question 20

For Storage account access key, which administrative outcome is expected?

1. Allow approved public client addresses while blocking other public network sources
2. Allow users to access SMB file shares with organizational identities
3. Reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization
4. Support shared-key authentication when required while treating the key as a sensitive credential

Correct Answer: D

 

Correct Answer

Answer D is correct because Storage account access key is one of the high-privilege shared keys that can authorize broad access to a storage account. Its intended administrative use is to support shared-key authentication when required while treating the key as a sensitive credential.

Incorrect Answers

Answer A is incorrect because that outcome belongs to IP network rule, which is used to allow approved public client addresses while blocking other public network sources; it is not the primary purpose of Storage account access key.

Answer B is incorrect because that outcome belongs to Identity-based access for Azure Files, which is used to allow users to access SMB file shares with organizational identities; it is not the primary purpose of Storage account access key.

Answer C is incorrect because that outcome belongs to Shared Key authorization setting, which is used to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization; it is not the primary purpose of Storage account access key.

 

Question 21

To replace exposed or aging shared keys without requiring a simultaneous outage for all clients, which Azure configuration should be selected?

1. Storage account firewall
2. Stored access policy
3. Access key rotation
4. Shared Key authorization setting

Correct Answer: C

 

Correct Answer

Answer C is correct because Access key rotation is the process of regenerating one storage account key after clients have moved to the other key. It directly supports the requirement to replace exposed or aging shared keys without requiring a simultaneous outage for all clients.

Incorrect Answers

Answer A is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

Answer B is incorrect because Stored access policy is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it does not provide the capability described in the scenario.

Answer D is incorrect because Shared Key authorization setting is used to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization; it does not provide the capability described in the scenario.

 

Question 22

For Access key rotation, which administrative outcome is expected?

1. Limit a SAS token to only the operations the recipient actually requires
2. Replace exposed or aging shared keys without requiring a simultaneous outage for all clients
3. Reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization
4. Centrally modify or revoke access represented by service SAS tokens linked to the policy

Correct Answer: B

 

Correct Answer

Answer B is correct because Access key rotation is the process of regenerating one storage account key after clients have moved to the other key. Its intended administrative use is to replace exposed or aging shared keys without requiring a simultaneous outage for all clients.

Incorrect Answers

Answer A is incorrect because that outcome belongs to SAS permissions, which is used to limit a SAS token to only the operations the recipient actually requires; it is not the primary purpose of Access key rotation.

Answer C is incorrect because that outcome belongs to Shared Key authorization setting, which is used to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization; it is not the primary purpose of Access key rotation.

Answer D is incorrect because that outcome belongs to Stored access policy, which is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it is not the primary purpose of Access key rotation.

 

Question 23

To avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID, which Azure configuration should be selected?

1. IP network rule
2. Identity-based access for Azure Files
3. Microsoft Entra authorization for Blob Storage
4. Storage account firewall

Correct Answer: C

 

Correct Answer

Answer C is correct because Microsoft Entra authorization for Blob Storage is identity-based authorization that uses Microsoft Entra identities and Azure RBAC data roles for blob access. It directly supports the requirement to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because IP network rule is used to allow approved public client addresses while blocking other public network sources; it does not provide the capability described in the scenario.

Answer B is incorrect because Identity-based access for Azure Files is used to allow users to access SMB file shares with organizational identities; it does not provide the capability described in the scenario.

Answer D is incorrect because Storage account firewall is used to limit storage access to approved networks, addresses, or private connectivity paths; it does not provide the capability described in the scenario.

 

Question 24

For Microsoft Entra authorization for Blob Storage, which administrative outcome is expected?

1. Replace exposed or aging shared keys without requiring a simultaneous outage for all clients
2. Avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID
3. Support shared-key authentication when required while treating the key as a sensitive credential
4. Reduce the exposure window of delegated storage access

Correct Answer: B

 

Correct Answer

Answer B is correct because Microsoft Entra authorization for Blob Storage is identity-based authorization that uses Microsoft Entra identities and Azure RBAC data roles for blob access. Its intended administrative use is to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Access key rotation, which is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it is not the primary purpose of Microsoft Entra authorization for Blob Storage.

Answer C is incorrect because that outcome belongs to Storage account access key, which is used to support shared-key authentication when required while treating the key as a sensitive credential; it is not the primary purpose of Microsoft Entra authorization for Blob Storage.

Answer D is incorrect because that outcome belongs to SAS expiry, which is used to reduce the exposure window of delegated storage access; it is not the primary purpose of Microsoft Entra authorization for Blob Storage.

 

Question 25

To grant blob data modification permissions using Azure RBAC, which Azure configuration should be selected?

1. Storage Blob Data Contributor
2. IP network rule
3. SAS expiry
4. SAS permissions

Correct Answer: A

 

Correct Answer

Answer A is correct because Storage Blob Data Contributor is an Azure built-in data role that can read, write, and delete blob data without granting full management-plane control of the storage account. It directly supports the requirement to grant blob data modification permissions using Azure RBAC.

Incorrect Answers

Answer B is incorrect because IP network rule is used to allow approved public client addresses while blocking other public network sources; it does not provide the capability described in the scenario.

Answer C is incorrect because SAS expiry is used to reduce the exposure window of delegated storage access; it does not provide the capability described in the scenario.

Answer D is incorrect because SAS permissions is used to limit a SAS token to only the operations the recipient actually requires; it does not provide the capability described in the scenario.

 

Question 26

For Storage Blob Data Contributor, which administrative outcome is expected?

1. Limit storage access to approved networks, addresses, or private connectivity paths
2. Allow a designated Azure subnet to reach a storage account through approved network configuration
3. Provide scoped time-limited access at the storage-account service level
4. Grant blob data modification permissions using Azure RBAC

Correct Answer: D

 

Correct Answer

Answer D is correct because Storage Blob Data Contributor is an Azure built-in data role that can read, write, and delete blob data without granting full management-plane control of the storage account. Its intended administrative use is to grant blob data modification permissions using Azure RBAC.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Storage account firewall, which is used to limit storage access to approved networks, addresses, or private connectivity paths; it is not the primary purpose of Storage Blob Data Contributor.

Answer B is incorrect because that outcome belongs to Virtual network rule, which is used to allow a designated Azure subnet to reach a storage account through approved network configuration; it is not the primary purpose of Storage Blob Data Contributor.

Answer C is incorrect because that outcome belongs to Account SAS, which is used to provide scoped time-limited access at the storage-account service level; it is not the primary purpose of Storage Blob Data Contributor.

 

Question 27

To allow users to access SMB file shares with organizational identities, which Azure configuration should be selected?

1. Microsoft Entra authorization for Blob Storage
2. Storage account access key
3. User delegation SAS
4. Identity-based access for Azure Files

Correct Answer: D

 

Correct Answer

Answer D is correct because Identity-based access for Azure Files is Azure Files authentication that uses a supported directory identity source and share or file permissions instead of relying only on storage keys. It directly supports the requirement to allow users to access SMB file shares with organizational identities.

Incorrect Answers

Answer A is incorrect because Microsoft Entra authorization for Blob Storage is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it does not provide the capability described in the scenario.

Answer B is incorrect because Storage account access key is used to support shared-key authentication when required while treating the key as a sensitive credential; it does not provide the capability described in the scenario.

Answer C is incorrect because User delegation SAS is used to delegate Blob Storage access while using Microsoft Entra authorization for SAS signing; it does not provide the capability described in the scenario.

 

Question 28

For Identity-based access for Azure Files, which administrative outcome is expected?

1. Allow users to access SMB file shares with organizational identities
2. Grant time-limited scoped access to a storage service resource without sharing the account key directly
3. Replace exposed or aging shared keys without requiring a simultaneous outage for all clients
4. Avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID

Correct Answer: A

 

Correct Answer

Answer A is correct because Identity-based access for Azure Files is Azure Files authentication that uses a supported directory identity source and share or file permissions instead of relying only on storage keys. Its intended administrative use is to allow users to access SMB file shares with organizational identities.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Service SAS, which is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it is not the primary purpose of Identity-based access for Azure Files.

Answer C is incorrect because that outcome belongs to Access key rotation, which is used to replace exposed or aging shared keys without requiring a simultaneous outage for all clients; it is not the primary purpose of Identity-based access for Azure Files.

Answer D is incorrect because that outcome belongs to Microsoft Entra authorization for Blob Storage, which is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it is not the primary purpose of Identity-based access for Azure Files.

 

Question 29

To reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization, which Azure configuration should be selected?

1. Virtual network rule
2. Storage Blob Data Contributor
3. Service SAS
4. Shared Key authorization setting

Correct Answer: D

 

Correct Answer

Answer D is correct because Shared Key authorization setting is the storage account control that determines whether requests signed with account keys are accepted. It directly supports the requirement to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization.

Incorrect Answers

Answer A is incorrect because Virtual network rule is used to allow a designated Azure subnet to reach a storage account through approved network configuration; it does not provide the capability described in the scenario.

Answer B is incorrect because Storage Blob Data Contributor is used to grant blob data modification permissions using Azure RBAC; it does not provide the capability described in the scenario.

Answer C is incorrect because Service SAS is used to grant time-limited scoped access to a storage service resource without sharing the account key directly; it does not provide the capability described in the scenario.

 

Question 30

For Shared Key authorization setting, which administrative outcome is expected?

1. Avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID
2. Allow users to access SMB file shares with organizational identities
3. Centrally modify or revoke access represented by service SAS tokens linked to the policy
4. Reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization

Correct Answer: D

 

Correct Answer

Answer D is correct because Shared Key authorization setting is the storage account control that determines whether requests signed with account keys are accepted. Its intended administrative use is to reduce reliance on shared-key authentication when workloads can use Microsoft Entra authorization.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Microsoft Entra authorization for Blob Storage, which is used to avoid distributing shared account keys when users or applications can authenticate with Microsoft Entra ID; it is not the primary purpose of Shared Key authorization setting.

Answer B is incorrect because that outcome belongs to Identity-based access for Azure Files, which is used to allow users to access SMB file shares with organizational identities; it is not the primary purpose of Shared Key authorization setting.

Answer C is incorrect because that outcome belongs to Stored access policy, which is used to centrally modify or revoke access represented by service SAS tokens linked to the policy; it is not the primary purpose of Shared Key authorization setting.