Microsoft AZ-104 Exam Dumps, Practice Test Questions

That exception may authorize a broader set of eligible services than the one named resource instance. It does not meet the request for a narrow, resource-specific network allowance.

A permissive default would remove the account's intended network isolation. The design explicitly requires a narrow exception under an otherwise restrictive firewall.

Owner can authorize management operations but cannot replace a network rule permitting packets to the storage endpoint. Both layers must be satisfied.

A public IP firewall rule expects an allowed public source; it is not a way to allow private RFC1918 addresses on an approved Private Link path. The scenario explicitly uses a private endpoint. Adding an unrelated address would not be the necessary control and could enlarge the public exposure surface.

A private endpoint gives the service a private IP inside the consumer VNet, and clients can reach it over private routing when DNS is correct. The public IPv4 route is precisely what private endpoint connectivity is intended to avoid. The public firewall's default Deny applies to the public path, not this already approved private endpoint.

A network rule and a data-plane role solve different problems. The private endpoint supplies a network route, while the storage service still checks the client's credential and Blob data permissions. Removing Blob Data Reader from this read-only workload could produce authorization errors even with a functioning private endpoint.

Subscription Reader permits viewing resource metadata, not creating blob objects. Storage Blob Data Contributor or another supported data-plane permission must be effective at the destination container scope.

Storage Blob Data Reader grants read operations but not the create or write DataActions required for uploading. Firewall access and an appropriate data role are independent requirements.

Removing the rule can make connectivity worse and does not add DataActions. Network and identity permissions are cumulative security boundaries, not replacements.

An account SAS is signed using an account key, contradicting the restriction on account-key material. Broad service permissions would also grant more than the read-only analytics task requires.

A public container bypasses the authenticated, time-limited access requirement and may expose data to anyone who knows the objects. It provides no two-hour authorization boundary.

A connection string containing a storage account key conveys long-lived broad authority unless separately controlled. It would defeat the credential policy and the required minimum permissions.

Long expirations enlarge a leaked token’s exposure window and do not restrict access by source address. This worsens the specified threat.

A storage key is broader than the single read task and can be used to sign other requests. It does not implement the desired token IP scope.

Renaming a storage account is not a supported routine SAS access-control technique. It would disrupt endpoints rather than safely constrain source IPs.

Expiry limits lifetime but does not prevent destructive operations during that period. Unneeded write/delete permissions violate the stated requirement.

Account-service operations are broader and do not match the vendor’s single data download task. A scoped container permission is more appropriate.

A shared account key can authorize far more than reading the requested blobs and lacks the fine-grained operation scope of the SAS.

Both tokens remain Blob-specific; an additional Blob SAS is not a queue authorization path or one cross-service token.

A Blob service SAS cannot grant write operations in Azure Queue Storage; it is constrained to the service for which it is signed.

Current Microsoft documentation supports user-delegation SAS authorization for multiple Azure Storage services. But the proposed token explicitly grants Blob List, not the Queue write operation, and uses an Entra-derived signing key rather than the account-key authorization required by this scenario. An appropriately scoped Shared-Key account SAS meets the combined requirement.

An RBAC role can authorize an Entra-authenticated client, but it does not retroactively widen the permissions or resource scope encoded in a separately signed SAS URL.

Blob-level anonymous access, where permitted, grants direct blob reads, not container listing; it also changes public exposure against the least-privilege design.

The token already permits the individual blob download; Read does not grant container enumeration, which needs suitable container scope and List permission.

Key rotation does not create an SMB-authenticated partner principal with appropriate share-level and file-level rights.

Even where SAS can authorize supported Azure Files REST actions, SMB identity authentication uses a separate mechanism and cannot accept a SAS as a Kerberos ticket.

Blob Data Contributor covers Blob Storage data actions rather than Azure Files SMB share and NTFS file permissions.

Blob Data Reader can authorize object read, but a container-level data role does not necessarily include the storage account-level generateUserDelegationKey action requested by the signing operation.

This grants container data-plane operations but does not replace the separate delegation key generation permission at the required storage scope.

Public anonymous access is neither required nor appropriate for generating time-limited Entra-secured SAS credentials.

The token remains not yet valid until its signed start time is reached, regardless of how long the expiry is extended. The clock skew remains unaddressed.

Key rotation changes which signatures are valid, but a newly signed token still fails when its start time lies ahead of Azure Storage time. It is not the timing correction.

A stored access policy can constrain a service SAS, but the future start still prevents immediate use. The server-side policy does not fix the issuer clock.