Microsoft AZ-104 Exam Dumps, Practice Test Questions

Azure Storage maintains CORS rules independently for Blob, File, Queue, and Table services. The browser is sending an upload to the Blob endpoint, whose Blob service CORS configuration evaluates its preflight. A rule added only to the Queue service does not apply to a Blob OPTIONS request, even though both services share a storage account. Configure the actual target service instead.

Storage Blob Data Owner grants additional blob data and access-control capabilities but does not configure the origin and allowed HTTP headers returned during a browser preflight. A CORS preflight is evaluated by the service against its CORS policy before the browser sends the authenticated operation. Since the same credentials already upload from a server client, broadening RBAC would increase privilege without addressing the documented preflight failure.

Anonymous public access is unrelated to CORS browser policy and would expand data disclosure if enabled. A browser still applies the cross-origin rules to an authenticated PUT, and a storage service must respond to allowed preflight origins, verbs and headers. The scenario explicitly confirms authorization and network reachability; the missing control is Blob service CORS, not removal of access restrictions.

Blob public access allows anonymous clients to retrieve known blob URLs. That is directly contrary to the confidentiality requirement.

Hot controls storage/retrieval pricing, not whether anonymous HTTP access is allowed. Sensitive documents would remain exposed if public access stays enabled.

Tags are metadata and do not directly enforce blob anonymous access. A security setting on container/account access is required.

Additional identical Reader assignments do not add blob data-plane write actions. The upload would remain unauthorized.

Storage Blob Data Reader allows reading content but not creating or modifying blobs. Uploading requires a suitable write-capable blob data role at a scope covering the container.

Azure RBAC evaluates the authenticated caller and applicable group memberships. Giving a data role to an unrelated principal does not authorize this engineer; assign it to the correct principal and scope.

A container-level public ACL cannot override the account-wide disallow setting; anonymous reads will still be blocked.

A SAS-authorized request includes an access credential; it is not evidence that anonymous public reads are enabled at account level.

Stored access policies establish authorization constraints for signed access; they do not authenticate anonymous HTTP GET requests by themselves. With account-wide anonymous access disabled, requests must supply appropriate authorized credentials or a valid SAS.

A management lock restricts ARM operations but does not provide a WORM legal evidence guarantee against authenticated blob data-plane overwrite or deletion.

Soft delete retains recoverability for a limited configured period, but it does not prevent deletion or modification during a mandatory seven-year WORM interval. Time-based immutable retention is the required control.

Least-privilege investigators can reduce accidental writes but cannot impose non-bypassable retention on all privileged identities. Use a supported immutable storage policy for the protected evidence.

A time-based WORM policy expires after its configured interval, while the requirement demands retention until the hold is explicitly lifted at an unknown future time. An appropriate legal hold tracks that open-ended legal requirement.

Versioning retains historical revisions but does not itself prevent privileged deletion or overwrite of eligible versions. For open-ended litigation protection, apply an immutability legal hold to the protected data.

Soft delete is a limited recovery window and does not prevent authorized users from first deleting or overwriting evidence.

If-Match can detect an intervening change at the conditional request, but an ETag is not an exclusive reservation: another worker can update the blob while this worker performs separate steps. The scenario requires a storage-enforced single-writer lease and can handle lease acquisition failures.

Blob versioning preserves earlier versions after successful writes, but does not serialize or exclude simultaneous writers to the current blob. It can aid recovery from overwrites but cannot supply the requested exclusive coordination primitive.

A data role grants authorization to update blob content; it does not elect one current writer or make competing authorized clients wait. The workers need a lease for exclusive write coordination, separately from their data-plane permissions.

Custom metadata can be stored and retrieved with blobs, but Azure Blob Storage does not natively index that metadata for Find Blobs by Tags. Keeping classification solely as metadata means clients would need to enumerate or use another external search/index solution. To use the specifically requested storage-native query API, the classification value must be present as an indexed blob tag, not just a metadata header.

Content-Type describes a blob’s MIME media type and influences client handling; it is not a general-purpose indexed classification field. Replacing application/octet-stream or application/pdf with a governance label could mislead download clients and still would not create searchable Blob index tags. Use a dedicated classification index tag for predicate matching while retaining accurate content-type information for applications.

Blob Inventory can emit scheduled object listings and properties to report files, which can support offline audit and analysis. It does not make its generated report an immediate, account-wide interactive predicate engine for custom metadata. The requested Find Blobs by Tags behavior requires indexed blob tags and the corresponding storage API, not a batch inventory export and subsequent file scanning.

Storage Blob Data Contributor can create and modify blob data, but does not grant the ownership and ACL-management data actions required for delegated ADLS Gen2 path governance. Storage Blob Data Owner at the appropriately narrow data scope supplies those additional permissions.

Storage Blob Data Reader provides blob-data read capabilities, not data ownership or the ACL write actions required to manage ADLS Gen2 path permissions. Inspecting permissions and modifying them are distinct data operations; scope Storage Blob Data Owner to the governed container instead.

Removing the data-lake namespace model would break application assumptions; it is not a controlled administrative delegation.

Turning off versioning for future writes does not cancel a retention policy already protecting an older blob version. Its immutable period or legal protection still governs deletion.

Immutable storage policies are designed to prevent such premature removal. Container-level operations cannot be used to bypass active legal retention of protected data.

Data Owner provides broad data permissions but does not override immutable retention conditions. A valid role cannot authorize an operation forbidden by the service's WORM policy.

The blob is unavailable because its Archive tier is offline, not because throughput is exhausted. Additional capacity does not complete the required rehydration operation.

Requesting an online tier initiates rehydration, which can take time. The application cannot assume the content is available until the rehydration operation finishes.

Anonymous access is an authorization setting and creates security exposure. Even an authorized caller cannot directly read an offline blob before rehydration.