Microsoft AZ-104 Exam Dumps, Practice Test Questions

Cryptographic permission alone is not sufficient to meet the key lifecycle safeguards for the integrated encryption design.

Rotation can be valuable but does not replace recovery safeguards if a key version or vault is accidentally deleted.

Blob soft delete protects storage objects and cannot recover a deleted Key Vault encryption key needed to decrypt those objects.

A versioned reference fixes the encryption key material selected and does not satisfy automatic progression to newer versions.

Tags are not a confidential key store, and exposing key material would compromise the security model rather than enable managed rotation.

Shared Key credentials and customer-managed encryption keys serve different purposes; rotating one does not update the other's key URI reference.

A key version change alters the root encryption-key protection transparently, not by requiring operators to upload every object again.

The service does not promise instant propagation of Key Vault rotation. Treating key creation as immediate storage activation can cause an outage.

Versionless references are precisely how automatic version updates are enabled; pinned-version references require deliberate change.

More frequent rotation improves key hygiene but preserves only the original encryption-layer architecture; it does not add an independent infrastructure layer.

Blob versioning preserves previous logical object states; it is not an independent cryptographic at-rest encryption layer. Infrastructure encryption is the separate service-managed layer needed in addition to the configured customer-managed key.

Replacing CMK with one Microsoft-managed key removes the customer control and does not add a separate encryption layer.

Blob Data Reader is a client authorization role for data access, not the Key Vault permission needed by the storage account's managed identity to use its CMK.

Secrets Officer manages Key Vault secrets, whereas the Storage customer-managed encryption flow uses a cryptographic key to wrap and unwrap the account encryption key. The managed identity needs the documented key Get, Wrap Key, and Unwrap Key capabilities or suitable key-operations RBAC, not secret data access.

Metadata visibility does not grant the cryptographic operations used for envelope encryption. The service may still be unable to wrap or unwrap its encryption key.

Supported Azure Storage CMK scenarios allow a storage account and Key Vault in separate regions. Moving or recreating storage resources merely for geographic colocation is unnecessary; confirm key access, identity authorization and other CMK prerequisites.

Applications generally should not need direct access to the CMK. Azure Storage uses its managed identity for envelope encryption, so broad user key permissions would increase risk.

LRS and GRS control data replication, not the identity and Key Vault permissions required for customer-managed encryption. Cross-region key placement can be supported regardless of this proposed replication workaround, subject to documented prerequisites.

Disk encryption concerns VM storage and is not the switch for storage-account blob encryption. Blob data already uses service encryption at rest by default.

Infrastructure encryption adds a second service-side encryption layer for supported configurations. It is not the on/off switch for standard Azure Storage encryption at rest: encryption with Microsoft-managed keys is already enabled by default. Adding another layer may be a separate compliance choice, but is not required to prevent unencrypted blob storage.

Client-side encryption can be additional protection, but Azure Storage itself already provides server-side encryption at rest. It is inaccurate to treat CMK absence as no storage encryption.

A Secrets User role provides access to secrets in a standard Key Vault, which is a different object type and authorization plane from keys in a Managed HSM. Azure Storage must perform key wrap and unwrap using the customer-managed HSM key through its own managed identity. Granting secret-read ability elsewhere does not allow that identity to use the required encryption key.

An Azure Reader role on the Managed HSM's management-plane resource enables inspection of resource metadata, not data-plane cryptographic operations on HSM keys. Storage encryption needs the account's service identity to invoke key wrap and unwrap. The scenario already has an enabled RSA-HSM key; simply reading HSM configuration does not authorize storage to use that key.

Managed HSM Administrator is a powerful administrative authorization and, when assigned to a human operator, does not automatically give the storage account's managed identity permission to perform encryption operations. The account continues to authenticate as its own identity when asking the HSM to wrap the encryption key. Grant the scoped cryptographic service role to that identity instead of broad human management privileges.

Storage Explorer provides a desktop graphical management interface, which conflicts with the requirement for a headless command-line ingestion pipeline. It can copy files but is not the best fit for unattended transfers.

Interactive portal uploads require operator attention and do not provide the designated unattended bulk command-line transfer workflow needed for millions of files.

Lifecycle management can operate on already stored blobs, but cannot copy local file-server contents into the container in the first place. The ingestion operation remains missing.

Copy transfers matching source objects but does not by itself clean up all destination-only objects. The stale items would remain.

Lifecycle management evaluates Azure blob properties, ages and configured predicates, not a comparison with the current local folder. Deleting older blobs on a schedule can delete still-needed exports or leave recently removed source files in the destination. AzCopy sync with an explicitly chosen destination-deletion behavior is the mechanism that compares source and destination.

A deletion lock makes cleanup harder and does not implement source-to-destination synchronization. It works against the requested stale-file removal.

CLI commands support Blob operations but still require a command-driven workflow for each ad hoc operation. Storage Explorer is the purpose-built graphical browser and transfer client for this desktop task.

Data Factory can orchestrate data movement, but building scheduled or orchestrated pipelines for occasional interactive container browsing and single-file transfers adds unnecessary automation. Storage Explorer directly supports the requested workflow.

AzCopy is useful for scripted or bulk object transfer, but it is a command-line copy tool rather than a graphical client for browsing several containers and interactively picking files. Storage Explorer better satisfies the stated workflow.