Microsoft AZ-104 Exam Dumps, Practice Test Questions

Versioning and change feed are prerequisites but not the rule mapping. Object replication requires a policy defining the eligible source and destination containers.

Blob lifecycle management transitions or deletes objects by policy; it does not define cross-account object replication mappings. A source-to-destination object replication policy is required.

GRS supplies platform-managed asynchronous durability replicas, not a configured independent object-replication policy between the two named storage accounts and containers.

A rule prefix cannot override the service restriction to supported blob types, even if the page blob matches a prefix.

Change feed is required for supported object replication configurations, but it does not make page blob VHDs eligible for the feature.

Versioning is a prerequisite for supported cases, not an extension of object replication to unsupported page blob types.

The source upload can succeed before the destination copy completes. Assuming same-transaction consistency incorrectly treats asynchronous replication as synchronous storage.

Service endpoints affect network reachability and authorization boundaries, not the schedule for asynchronous replication between storage accounts.

Creating a standard replication policy does not turn source writes into synchronous transactions or guarantee a zero-lag destination view.

Public access settings govern who can read blobs, not object-replication selection. They also introduce unnecessary disclosure.

Lifecycle management rules govern tiering or deletion, not the source/destination object-replication policy's inclusion criteria. A replication policy must carry its own supported container and prefix rules for the selected objects.

A broad object-replication rule cannot use an arbitrary account-level Resource Manager tag as the per-object prefix filter. Use the supported source/destination container rules and object-name prefix selection instead.

A broader prefix match selects names but does not backfill preexisting blobs when the copy scope still excludes old objects. Review the eligible copy scope for the original source inventory.

The scenario already has a functioning rule that copies new objects. Re-enabling a prerequisite does not change the configured eligibility of older blobs; choose the copy scope that includes them.

A new destination container does not alter an unchanged rule that selects only new source objects. The missing operation is a configuration change that makes historical source blobs eligible for copying.

Blob versioning is a prerequisite for object replication and provides historical versions, but it does not authorize direct writes to a destination container while an object replication rule locks it. The 409 is caused by the active policy, not a lack of blob versions. Use another container or remove the rule through approved change control.

Owner increases management privileges but does not make the replication destination accept incompatible direct writes. The service returns a conflict based on policy state.

Soft-delete retention concerns recovery after deletion, not the destination's replication write restriction. Removing protection would not allow the conflicting upload.

Object replication depends on change tracking for eligible blob content and versions, but a destination-side change feed does not transform a source-only Hot-to-Cool tier update into a replicated data version. Access tier is a separate lifecycle choice at the destination and may require its own policy.

Recreating a replication policy does not convert source tier metadata transitions into supported replicated object versions. It may disrupt replication or require fresh initial copying, while tier parity still needs independent destination management.

Replication rules operate at the object level and have defined supported behavior. Account settings and tier policies are not a general bidirectional mirror.

Read access to the storage configuration does not transfer cryptographic key custody. Microsoft-managed keys remain controlled by Microsoft rather than the organization.

TLS protects data while transmitted. The compliance constraint concerns who controls encryption keys for data at rest, which HTTPS-only transport cannot satisfy.

Storage account access keys sign requests; they are not the same as the customer-managed encryption key used by the Azure Storage encryption service. Rotating them does not establish key custody.

Rotating a client authentication credential can change access-key authorization, but encryption of the stored data still depends on an enabled, accessible customer-managed key. As long as the version required by Storage is disabled, changing an unrelated Storage account key cannot unblock the envelope-encryption operation.

Customer-managed keys change who controls the key lifecycle; they do not turn off encryption at rest. The key dependency remains necessary.

Blob data-plane RBAC can authorize a client operation, but the service must still unwrap the account’s encryption key using an enabled Key Vault key. The given outage follows disabling the key version, so increasing client RBAC cannot restore the cryptographic dependency.

Customer-managed encryption requires the authorized storage-account managed identity to access the configured Key Vault key. The operator's deployment identity does not become the ongoing encryption principal; giving permissions to the human alone leaves the storage service unable to use the key.

Key Vault should not expose encryption keys anonymously. Granting public access would destroy the intended controlled key-management boundary.

The encryption operation is performed by Azure Storage on behalf of its configured storage-account identity. Granting permissions to an unrelated VM identity does not let the storage service unwrap its customer-managed key.

Cryptographic permission alone is not sufficient to meet the key lifecycle safeguards for the integrated encryption design.

Rotation can be valuable but does not replace recovery safeguards if a key version or vault is accidentally deleted.

Blob soft delete protects storage objects and cannot recover a deleted Key Vault encryption key needed to decrypt those objects.