Microsoft AZ-104: Azure Administrator — Azure Storage - Review Questions

1. Section 1 — Azure Storage Fundamentals

Which Azure Storage service is designed to store application messages for asynchronous processing?

A. Azure Files

B. Azure Queue Storage

C. Azure Blob Storage

D. Azure Table Storage

2. Section 2 — Choosing the Right Storage Solution

An organization needs to store frequently accessed documents and provide full-text search across their contents. Which solution best meets this requirement?

A. Azure Files with share snapshots

B. Blob Storage with versioning

C. Data Lake Storage Gen2 with a hierarchical namespace alone

D. Blob Storage in the Hot tier integrated with Azure AI Search

3. Section 3 — Storage Network Access

A storage account must be accessible through private IP addresses, with access through its public endpoint disabled. What should you configure?

A. Private endpoints, appropriate private DNS, and disabled public network access

B. Virtual network firewall rules and enabled public network access

C. A service endpoint and anonymous blob access

D. A SAS token restricted to HTTPS

4. Section 3 — Shared Access Signatures

Which SAS type is signed using a delegation key obtained through Microsoft Entra credentials?

A. Account SAS

B. Service SAS

C. User delegation SAS

D. Anonymous SAS

5. Section 3 — Stored Access Policies

You need to centrally change permissions or revoke access for several service SAS tokens without rotating the account key. What should you use?

A. A resource lock

B. A stored access policy referenced by the tokens

C. An account-level default access tier

D. A container naming policy

6. Section 3 — Access Key Rotation

All applications currently use key1. Key2 is unused. Which sequence supports rotation while maintaining application access?

A. Regenerate both keys, then update the applications

B. Regenerate key1, then move applications to key2

C. Delete key1 and continue using the existing connection strings

D. Regenerate key2, move applications to key2, verify access, then regenerate key1

7. Section 3 — Azure Files Identity-Based Access

An on-premises AD DS domain synchronizes identities to Microsoft Entra ID. Domain users need to access an Azure SMB share using their existing domain credentials. Which storage configuration must be established before those credentials can be used?

A. On-premises AD DS identity-based authentication for the storage account

B. Anonymous access for the file share

C. A service SAS for each domain user

D. Blob versioning on the storage account

8. Section 4 — Storage Account Selection

Which account type is the appropriate starting point for a new workload that needs standard Blob, Queue, and Table Storage?

A. Premium FileStorage

B. Premium block blob

C. Standard general-purpose v2

D. Premium page blob

9. Section 4 — Storage Redundancy

A supported Blob Storage workload requires synchronous protection across availability zones in the primary region, asynchronous replication to a secondary region, and secondary read access before failover. Which option meets these requirements?

A. ZRS

B. RA-GZRS

C. GRS

D. RA-GRS

10. Section 4 — Object Replication

Which combination of features is required for object replication between two supported storage accounts?

A. Change feed on both accounts and versioning on the source only

B. Soft delete on both accounts and change feed on the destination

C. Point-in-time restore on both accounts

D. Versioning on both accounts and change feed on the source

11. Section 4 — Storage Encryption

An organization needs control over the encryption key used for storage account encryption, including its rotation and revocation. Which configuration should it select?

A. Customer-managed keys stored in Azure Key Vault or Managed HSM

B. Microsoft-managed keys only

C. Storage account access key rotation

D. A SAS token with encryption permissions

12. Section 4 — Data Transfer Tools

An administrator needs a command-line tool for scripted bulk transfers, parallel copying, and resuming interrupted transfer jobs. Which tool is most appropriate?

A. Azure Policy

B. Azure Monitor

C. AzCopy

D. Azure File Sync

13. Section 5 — Azure Files Recovery

A user deletes an individual file from an active Azure file share. A share snapshot contains the file. Which action can recover it?

A. Undelete the active file share

B. Restore or copy the file from the snapshot

C. Change the share’s redundancy to GRS

D. Enable container soft delete

14. Section 5 — Blob Types

An application continually adds log records to the end of a stored object. Which blob type is designed for this pattern?

A. Page blob

B. Snapshot blob

C. Block blob only

D. Append blob

15. Section 5 — Blob Access Tiers

Data is rarely accessed but must remain immediately readable without rehydration. Which is the coolest access tier that meets this requirement?

A. Cold

B. Archive

C. Premium

D. Hot

16. Section 5 — Blob and Container Protection

You need recovery protection for both individually deleted blobs and an accidentally deleted container. Which combination should you enable?

A. Blob soft delete and storage account tagging

B. Container soft delete and ZRS only

C. Blob soft delete and container soft delete

D. Change feed and anonymous access

17. Section 5 — Lifecycle Management

Three containers in one storage account require different retention rules. How should you configure lifecycle management?

A. Create three independent lifecycle policies on the account

B. Create one lifecycle policy containing rules with container-specific prefix filters

C. Assign a separate default account tier to each container

D. Enable versioning and let it determine retention automatically

18. Section 6 — Storage Costs

A blob in a standard GPv2 account is moved from Hot to Cool and deleted 10 days later. Which cost consideration applies?

A. No early deletion charge applies because the blob was originally Hot

B. The blob cannot be deleted until day 30

C. A mandatory 180-day Archive charge applies

D. A prorated Cool-tier early deletion charge can apply

19. Section 7 — Threat Matrix

An attacker modifies a storage firewall rule to preserve access after the initial compromise. Which threat-matrix stage most directly describes that objective?

A. Persistence

B. Reconnaissance

C. Impact

D. Discovery

20. Section 7 — Security Monitoring

Which monitoring approach best covers both storage account configuration changes and supported blob read, write, and delete operations?

A. Azure Activity Log alone

B. Blob inventory reports alone

C. Azure Activity Log combined with Blob service resource logs

D. Storage capacity metrics alone

Answer Key and Explanations

Question	Answer	Explanation
1	B	Queue Storage holds messages that application components retrieve and process asynchronously.
2	D	Blob Storage holds the documents; Azure AI Search provides content indexing and search.
3	A	Private endpoints provide private connectivity. Disabling public network access closes access through the public endpoint.
4	C	A user delegation SAS uses a delegation key obtained through Microsoft Entra authorization.
5	B	A stored access policy centrally manages supported constraints for associated service SAS tokens.
6	D	Move applications to a verified replacement key before regenerating the key they previously used.
7	A	AD DS authentication requires storage account identity configuration and domain registration. Synchronization alone is insufficient.
8	C	Standard GPv2 supports Blob, Queue, Table, and supported Azure Files workloads.
9	B	RA-GZRS combines primary-region zone redundancy, geo-replication, and supported secondary read access.
10	D	Object replication requires versioning on both accounts and change feed on the source.
11	A	Customer-managed keys give the organization control over the encryption key’s lifecycle. Access keys serve a different purpose.
12	C	AzCopy supports scripted transfers, parallel operations, and job-based resumption.
13	B	A snapshot preserves an earlier file state. Share soft delete protects deletion of the share itself.
14	D	Append blobs are optimized for adding data to the end of an object.
15	A	Cold is an online tier. Archive requires rehydration before content can be read.
16	C	Blob soft delete and container soft delete protect different deletion levels.
17	B	An account has one lifecycle policy with multiple rules; prefix filters can target different containers.
18	D	Cool has a 30-day minimum billing duration for this configuration. Earlier deletion can incur a prorated charge.
19	A	Maintaining access after compromise is persistence. The same change could also support defense evasion.
20	C	Activity Log covers management activity; configured Blob resource logs cover supported data operations.