Microsoft AZ-104 Exam Dumps, Practice Test Questions

The signed services field b correctly identifies the Blob service for Get Blob. Changing it to f would scope the SAS to Azure Files instead, causing further authorization failures for Blob endpoints. The resource type, not the service code, is the missing dimension for this particular object request.

List is used for supported listing operations at service or container level; it does not convert a service/container scoped account SAS into an object scoped token. Get Blob is an object-level read operation, so a missing object resource type cannot be compensated by adding an unrelated signed permission.

A valid expiry is already established and does not distinguish service-level from object-level operations. Infinite SAS validity is not a supported solution to resource-type scoping, and unnecessarily long expiry creates additional credential exposure. The decisive field is the signed resource types.

User delegation SAS tokens cannot use stored access policies. Removing one would not invalidate these delegation-key-signed tokens.

An ARM resource-group move does not revoke the cryptographic delegation key that signs outstanding SAS tokens. Their authorization would remain.

A user delegation SAS is signed with a user delegation key obtained through Microsoft Entra authorization, not with an Azure Storage account shared key. Rotating an account key affects Shared Key-authenticated SAS credentials, but it does not selectively invalidate the leaked user delegation SAS family. Revoke user delegation keys for this account instead.

A storage-account SAS policy can specify an upper recommended or enforced interval, but it does not remove the independent maximum on a user delegation SAS. An expiry longer than the delegation key can authorize is not made valid by a permissive account setting.

Stored access policies are associated with service SAS rather than changing a user delegation SAS key’s validity cap. Adding a container policy does not turn a 12-day user delegation token into a supported credential.

Disabling shared-key authorization can be a security hardening measure, but it does not remove token expiry or expand the maximum lifetime of user delegation SAS credentials. The lifetime constraint remains in force.

IP restrictions do not increase the maximum stored access policies supported by the service. An additional identifier still exceeds the container limit.

Stored access policies exist on several storage service resource types, including blob containers. The container itself is subject to the five-policy limit.

Signed identifiers distinguish policies but their length does not change the maximum count. A sixth identifier still exceeds the per-resource stored access policy limit.

Rotating the account access key would invalidate existing tokens signed with that key rather than activate the newly created stored policy. The valid SAS already begins working once server-side policy changes propagate. Regeneration is a response to a compromised signing credential, not a prerequisite for every legitimate service SAS associated with a new policy identifier.

Azure Storage documents an approximately 30-second, not 24-hour, activation interval for stored access-policy updates. Waiting a whole day would neither diagnose a real authorization problem nor be required for a correctly configured signed identifier. If the problem persisted beyond propagation, inspect the policy, token fields and timestamps rather than assume an arbitrary daily refresh cycle.

Service SAS authorization can be used regardless of whether anonymous blob read is enabled; the signed token and any referenced access policy govern access. Turning on public anonymous access would weaken the container's security boundary without activating the stored policy. The brief 403 response following creation is compatible with policy propagation, not a public-access prerequisite.

Changing the numeric expiry does not resolve the conflict when the same signed constraint is supplied in both the SAS and stored access policy. Choose one source for that constraint.

Even matching permissions cannot be defined redundantly in both places for the bound service SAS. The constraint must be specified in one place, not both.

Changing the signing key does not remove a signed-field versus stored-policy constraint conflict. The SAS and stored access policy still define the same permission and expiry independently.

Blob tags do not define the signature's cryptographic validity. The leaked token can remain usable until its signed constraints or signing credential are invalidated.

ARM locks do not update the signature or add a policy reference to an issued bearer token. They are not SAS revocation controls.

Unlinked tokens carry no stored policy identifier. A policy created later cannot be applied to those previously signed URLs by name alone.

The sr=c value permits container-level operations on the named container and does not itself constrain the token to exports/2026. Omitting signed-directory depth also fails the specific directory-scope field requirement. A correctly constructed directory SAS needs the directory resource type with its depth and canonicalized directory resource, not an assumed UI folder limitation.

The sr=b resource type scopes a signature to an individual blob, not an ADLS Gen2 directory subtree. Depth zero refers to the container root, not the two nested segments in the question. Neither the requested descendant access nor the directory-depth requirement is satisfied by pretending a directory is an ordinary root blob.

The srt resource-type list is a parameter of account SAS, whereas this scenario explicitly generates a service SAS. It does not substitute for the service SAS signedResource=directory field or the mandatory sdd depth. Mixing token-model fields fails the intended directory-bound authorization design, even if the overall account also supports account SAS.

A container stored access policy is a legitimate mechanism for governing service SAS, not a blanket firewall deny rule. The account's network rules determine permitted origins separately, while the signed token is assessed against the referenced policy identifier. Simply having any policy does not cause all service SAS requests to be dropped by the storage network firewall.

The account SAS expiration policy does not edit stored access policies or extend their allowed intervals to match a global setting. The Block action, where supported, denies out-of-policy requests rather than modifying their credentials. For this service-SAS/stored-policy exception, the stored access policy controls the token's actual start, expiry and permissions, and administrators should not assume automatic one-hour rewriting.

A stored policy applies to service SAS tokens signed with the storage account key. User delegation SAS instead relies on a Microsoft Entra-issued delegation key and cannot be bound to a stored access policy. Supplying expiry from a container policy does not convert the token's cryptographic authorization type or give it Entra-based user delegation semantics.

Regenerating both keys without updating clients invalidates every existing connection string that uses them. The service could lose access immediately.

Regenerating an in-use key first immediately invalidates clients presenting that key. They must switch to an alternate valid key before regeneration to avoid service interruption.

SAS expiries can limit token lifetime, but they do not rotate the underlying account keys used by existing legacy connection strings. The key rotation obligation remains unmet.

Account keys grant powerful data authorization; publishing them increases exposure and contradicts the prohibition on key-based access.

The applications need Entra data-plane authorization. Removing their roles would break authorized access without controlling legacy Shared Key calls.

Anonymous blob access bypasses the identity boundary that the policy is trying to establish. It does not disable requests signed with a storage key.