100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 320
An operations analyst needs to inspect several blob containers, upload a few diagnostic files, and download individual objects interactively from a managed desktop. The team does not want to write transfer automation for this occasional task. Which supported tool best fits?
- Write Azure CLI az storage blob commands for each upload and listing even though the team wants an interactive graphical workflow
- Azure Storage Explorer with appropriately scoped credentials
- Create an Azure Data Factory copy pipeline for each individual diagnostic file and run it from the desktop
- Use AzCopy transfer commands with SAS URLs for each individual operation instead of an interactive container browser
Explanation
Correct Answer
B:Storage Explorer provides an interactive interface to browse containers and transfer selected objects. It suits occasional manual investigation without creating a new script for every transfer.
Incorrect Answers
A:CLI commands support Blob operations but still require a command-driven workflow for each ad hoc operation. Storage Explorer is the purpose-built graphical browser and transfer client for this desktop task.
C:Data Factory can orchestrate data movement, but building scheduled or orchestrated pipelines for occasional interactive container browsing and single-file transfers adds unnecessary automation. Storage Explorer directly supports the requested workflow.
D:AzCopy is useful for scripted or bulk object transfer, but it is a command-line copy tool rather than a graphical client for browsing several containers and interactively picking files. Storage Explorer better satisfies the stated workflow.
Question 321
A scheduled AzCopy transfer of terabytes of blobs is interrupted halfway through by a transient network outage. Operations want to avoid blindly repeating work and want to inspect whether an existing job can continue. Which AzCopy capability is relevant?
- Start a completely new AzCopy copy operation with blanket overwrite and no job-state inspection
- Run AzCopy sync with automatic destination deletion as the first recovery action
- Run `azcopy jobs clean` to discard saved job plan files before investigating whether the interrupted transfer can resume
- Inspect the recorded AzCopy job and resume it using its job identifier where supported
Explanation
Correct Answer
D:AzCopy records job state and offers job management including resume in supported transfer modes. Using the original job avoids treating the interrupted transfer as if nothing was completed.
Incorrect Answers
A:A new copy can redo already completed transfer work, may alter destination data, and ignores the job state explicitly available for targeted recovery from an interruption.
B:Sync can reconcile source and destination and may delete destinations depending on flags, but the case asks first to inspect and resume the interrupted original job without risking unnecessary changes.
C:The AzCopy jobs-clean operation removes stored job plan and log state rather than inspecting the interrupted transfer. Deleting the saved plan can prevent the intended `jobs resume` recovery, so first use job list/show and the existing job identifier instead of cleaning state.
Question 322
An administrator uses AzCopy to upload a local folder containing nested subfolders to Blob Storage. Only the top-level files arrive, although credentials and network access are valid. Which command behavior should be checked?
- Add an AzCopy --include-pattern file filter and assume the filter also scans every nested folder when recursion is disabled
- Include the recursive option when copying the directory tree
- Change the destination Blob prefix to end with a slash while leaving AzCopy directory recursion disabled
- Use AzCopy overwrite mode ifSourceNewer, but keep the recursive directory option disabled
Explanation
Correct Answer
B:AzCopy directory operations can require explicit recursive traversal to include files beneath subfolders. Without traversal, permissions may be fine while nested objects are excluded from the transfer set.
Incorrect Answers
A:An AzCopy include-pattern restricts which already-enumerated paths qualify for transfer; it does not tell AzCopy to descend into nested directories. Files in omitted subfolders remain outside the candidate set. For a folder tree, the copy command must enumerate recursively before file-name filtering can select matching objects below the root.
C:A trailing slash changes how the destination path or prefix is represented; it cannot cause the local source traversal to discover files below the top-level folder. The top-level upload succeeding shows the credentials and destination are usable. The missing operation is recursive enumeration of the local directory tree.
D:The ifSourceNewer overwrite policy decides when an eligible destination file should be replaced; it does not traverse nested local subfolders. With recursion disabled, files below the source directory are not enumerated for upload. The corrective setting is recursive traversal of the directory tree rather than a change to overwrite behavior.
Question 323
A data team must copy tens of terabytes of blobs from one Azure Storage account to another. The requirement is to avoid pulling all blob bytes through a workstation's local disk and Internet connection. Which supported AzCopy pattern should be evaluated?
- Download all source blobs to the workstation and then upload them one by one
- Run AzCopy against both accounts but authorize only the source, assuming its SAS grants write access to the destination
- Change the source account's redundancy SKU to RA-GRS and treat the secondary as an independent destination account
- Use AzCopy for a supported service-to-service copy with appropriate permissions to source and destination
Explanation
Correct Answer
D:AzCopy can orchestrate copy operations between storage endpoints so a local workstation need not stage every byte on disk. The accounts' authorization, network restrictions and supported copy semantics still apply.
Incorrect Answers
A:Local staging makes bandwidth and disk space on a single client a bottleneck. It contradicts the requirement to avoid moving the complete dataset through the workstation.
B:A service-to-service copy still needs the appropriate access at the target endpoint. A SAS authorizing reads on the source does not automatically authorize writing to a different storage account, so a bulk transfer can fail despite being server-side.
C:Geo replication creates a managed secondary copy within the same storage account's redundancy system, not an independent application destination. It does not meet an account-to-account copy requirement.
Question 324
A backup script uses AzCopy to copy data from an account that the script can read to a separate destination account. Authentication succeeds on the source but the destination rejects uploads. Which credential boundary must be checked?
- Provide a supported destination credential or identity permission that permits the required write operations
- Increase the source SAS lifetime without changing destination authorization
- Grant Storage Blob Data Reader on the destination and assume that allows upload
- Disable encryption at rest on the destination account
Explanation
Correct Answer
A:A copy has two authorization sides: reading the source and creating content at the destination. A valid source SAS or source role assignment cannot automatically authorize a write into another account.
Incorrect Answers
B:The source is already readable. Extending its token does not create destination write permission and merely increases the source credential's exposure period.
C:Data Reader supplies download capabilities, not creating or overwriting blobs. The destination requires a suitable data write role or signed permission.
D:Storage encryption does not substitute for access control. The destination rejects the caller because authorization is missing, not because encryption is enabled.
Question 325
A nightly AzCopy V10 job uploads backup files from a datacenter to Azure Blob Storage across a metered 200-Mbps WAN connection. Network operations now require this upload to consume no more than roughly 60 Mb/s, without changing blob permissions or resuming an interrupted job. Which AzCopy setting directly implements the upload rate limit?
- Set AZCOPY_CONCURRENCY_VALUE=60 to guarantee exactly 60 megabits per second of transfer
- Run the AzCopy upload with --cap-mbps 60 to cap its data throughput
- Run azcopy jobs resume on the most recent job ID without specifying a throughput limit
- Set the destination Blob container's access tier to Cool so AzCopy automatically transfers at 60 megabits per second
Explanation
Correct Answer
B:The AzCopy V10 --cap-mbps flag is designed to place a ceiling on transfer throughput, expressed in megabits per second, and is supported for uploading and downloading files. Setting --cap-mbps 60 on this upload aligns with the network team's requested approximate cap; instantaneous throughput can vary slightly. This is not a server-to-server storage-account copy, for which the documented bandwidth cap does not apply.
Incorrect Answers
A:AZCOPY_CONCURRENCY_VALUE controls the number of concurrent requests AzCopy makes, which can affect throughput and resource consumption, but the number 60 is not interpreted as 60 megabits per second. Resulting bandwidth depends on file sizes, available network capacity, storage latency, and retries. It is a tuning control, not the explicit data-rate limit required by the metered WAN.
C:The jobs resume command is useful after a transfer interruption when the job plan still exists and files remain unfinished. Here there is no interrupted job to resume, and resuming without a cap does not impose the required throughput limit. The unrelated job state and transfer rate are separate AzCopy concepts: use --cap-mbps on the actual upload operation.
D:Cool tier changes Blob Storage's pricing and access characteristics for data that is accessed less frequently. It does not establish a network egress or upload bandwidth ceiling for AzCopy and may incur different read or retention charges. The client's transfer rate still depends on AzCopy and network conditions; apply an explicit Mbps cap rather than manipulating storage access tier.
Question 326
An AzCopy transfer repeats each hour from a source Blob container to a destination. The operator wants to avoid replacing newer destination objects with older source versions, while still allowing legitimate newer source changes to be copied. What overwrite behavior should be considered?
- Delete the destination container before every scheduled run
- Switch the destination from Hot to Archive before each run
- Use an AzCopy overwrite policy such as ifSourceNewer where supported and appropriate
- Set overwrite to true for every copy regardless of timestamps
Explanation
Correct Answer
C:Conditional overwrite uses source/destination modification information to avoid needlessly replacing newer target content. It offers more control than unconditional overwrites when incremental sources are expected.
Incorrect Answers
A:Deleting the destination discards all prior data and makes every transfer a full reload. It cannot preserve a target that may be newer than the source.
B:Archive tier affects access latency and may block normal writes, not the comparison logic for source-versus-destination modification times.
D:Unconditional overwrite can replace newer destination contents with stale source objects. That violates the requirement to preserve more recent target data.
Question 327
A help-desk analyst wants to browse the contents of a private Azure Blob container using the Storage Explorer desktop application. The organization does not allow storage account keys. Which supported authentication method should the analyst use if they have the necessary blob data role?
- Turn on anonymous access so Storage Explorer can open the container without credentials
- Grant only Azure subscription Reader and ignore blob data authorization
- Generate a long-lived account SAS from a prohibited account key
- Sign in to Storage Explorer with the analyst's Microsoft Entra identity and use the assigned Blob Data permission
Explanation
Correct Answer
D:Storage Explorer can authenticate interactively with Entra and honor Azure Storage data-plane RBAC. A private container does not require distributing account keys to authorized analysts.
Incorrect Answers
A:Anonymous container access would expose data beyond the analyst and defeat the stated no-shared-secret policy. The existing Entra identity can provide scoped access.
B:Reader can expose account metadata but not necessarily blob contents under Entra data authentication. The appropriate blob data role is still needed.
C:An account-key SAS relies on the very shared credential the organization disallows, with an unnecessarily large bearer-token risk. Interactive Entra sign-in better satisfies the design.
Question 328
Before updating an application that writes to an Azure Files SMB share, an administrator wants a point-in-time read-only view of all files so that individual files can be copied back if the update corrupts them. Which Azure Files feature best fits?
- An Azure Files share snapshot
- Enable Azure Files share soft delete without taking a point-in-time snapshot
- Create a share access signature for the existing live SMB files
- Configure an Azure Files read-only lock at resource group scope instead of a snapshot
Explanation
Correct Answer
A:A share snapshot captures the file share at a specific time and exposes prior file versions for item-level recovery. The snapshot is read-only, so it preserves the pre-deployment view during testing.
Incorrect Answers
B:Share soft delete can help restore an accidentally deleted share but does not capture earlier individual file contents before a code deployment changes them. A snapshot preserves the desired version.
C:A SAS delegates access to files but does not preserve file contents at a particular instant. Later corruption affects the live data, leaving no captured pre-update version.
D:A management lock can block certain management-plane writes, potentially disrupting operations, but does not provide file-level read-only recovery copies of the SMB share at the chosen time.
Question 329
An operator deletes an entire Azure Files share accidentally and discovers that share soft delete was enabled with a still-active retention interval. The team needs the same share contents recovered rather than rebuilding from a new empty share. What feature should it use?
- Open Azure Files share snapshots and assume a snapshot alone undeletes the entire deleted share without a share recovery operation
- Undelete the soft-deleted Azure file share within the configured retention period
- Use blob versioning to restore the deleted SMB share
- Create a new empty share with the same name and assume contents reappear
Explanation
Correct Answer
B:Share soft delete retains a deleted file share for its recovery window. An authorized administrator can restore it while it remains eligible for undelete.
Incorrect Answers
A:Share snapshots preserve point-in-time file contents for supported recovery scenarios but do not themselves replace undeleting a share object that is retained by Azure Files share soft delete. The question explicitly requires recovering the deleted share and its contents within the retention window, so perform the share undelete first.
C:Blob versioning tracks blob object versions and does not itself undelete an Azure Files share. It covers a different storage data model.
D:Creating an empty replacement is not the same as undeleting the protected share. It may also conflict with recovery naming while the deleted share remains retained.
Question 330
A finance team keeps many Azure Files share snapshots for point-in-time file recovery. Its disaster plan proposes permanently deleting the source file share and later restoring the entire share solely from those snapshots, with no separate backup. Which limitation makes that plan unsafe?
- Share snapshots remain associated with their source share and are not an independent vaulted backup against permanent share deletion
- Taking a share snapshot automatically creates a full independent copy in a Recovery Services vault
- Changing the share snapshot schedule to hourly guarantees survival after permanent deletion of the source share
- Giving an administrator Storage File Data SMB Share Reader makes permanently deleted snapshots recoverable
Explanation
Correct Answer
A:Azure Files share snapshots capture historical file states but remain tied to the source share. They do not independently protect against permanent deletion of the share or account; use supported backup or other separate recovery protection for that failure mode.
Incorrect Answers
B:A normal share snapshot does not automatically become a separate recovery-vault copy. Confusing snapshots with independent backups leaves a common deletion boundary.
C:More frequent snapshots improve point-in-time granularity while the share and snapshots remain available; they do not remove the shared deletion dependency.
D:SMB Reader grants authorized data reading, not restoration of content already permanently removed from the storage service. RBAC cannot recreate missing recovery copies.
Microsoft Azure Administrator (AZ-104) Practice Tests