Implement and manage storage
Domain 2 of AZ-104 accounts for 15-20% of the exam. EarnYourCert has 104 original questions for this domain, all with explanations: 67 multiple choice, 21 yes/no and 16 completion or ordering items, like the real exam.
What this domain covers
- 2.1Configure access to storage34 questions
- 2.2Configure and manage storage accounts35 questions
- 2.3Configure Azure Files and Azure Blob Storage35 questions
Domain 2 sample questions
8 questions from our 104-question bank for this domain. Try to answer before revealing the solution.
1. An administrator regenerates (rotates) the primary access key of a storage account. What effect does this have on previously generated 'Service SAS' tokens that used that key?
- The SAS tokens are automatically regenerated with the new key without service interruption
- It has no effect on existing SAS tokens, which remain valid indefinitely
- All service SAS tokens signed with that key become invalid immediately
- It only affects user delegation SAS tokens, not those signed with account keys
Show answer
Correct answer: C. Account and service SAS tokens are signed with a storage account access key; if that key is regenerated, all SAS tokens signed with the old key become invalid immediately, which is useful for revoking compromised access.
2. Your company wants users to access Azure Files shares using their on-premises Active Directory credentials, preserving NTFS-level file and folder permissions. Which Azure Files feature enables this?
- Server-side encryption with customer-managed keys, stored in Azure Key Vault
- Identity-based authentication for SMB via Active Directory Domain Services (AD DS) or Microsoft Entra Kerberos
- Zone-redundant storage (ZRS) replication, which distributes copies across availability zones
- Shared access signatures (SAS) generated individually for each user of the share
Show answer
Correct answer: B. Azure Files supports identity-based authentication via on-premises AD DS (or Microsoft Entra Kerberos), allowing users to authenticate with their domain credentials and enforce NTFS-level directory and file permissions.
3. Which built-in RBAC role should be assigned to an application that needs to read and write data in blob containers via Microsoft Entra ID, but should not be able to manage the storage account's configuration?
- Storage Blob Data Contributor
- Owner
- Reader
- Contributor at the storage account level
Show answer
Correct answer: A. The 'Storage Blob Data *' roles (Reader, Contributor, Owner) control access to data within blobs via Microsoft Entra ID, separate from management-plane roles (like Contributor), which control the account's configuration but not necessarily data access.
4. A blob container has its public access level set to 'Private (no anonymous access)'. A user tries to download a blob using only the public URL, without a SAS token or authentication. What happens?
- The request is rejected with an authorization error
- The download works because blob URLs are always accessible
- It works only if the blob is in the Hot tier
- It works only during the first 30 days after the blob is created
Show answer
Correct answer: A. When a container's public access level is 'Private', any anonymous request without valid credentials (key, SAS, or Microsoft Entra ID token) is rejected.
5. What is the maximum validity period for a user delegation SAS in Azure Blob Storage?
- 7 days
- 30 days
- 1 year
- 10 years
Show answer
Correct answer: A. A user delegation SAS has a maximum validity period of 7 days. It is signed with Azure AD credentials (not with the account key), making it more secure than an account SAS or service SAS. It requires the principal to have the 'Storage Blob Data Contributor' role or higher on the appropriate scope.
6. A company needs the lowest possible cost for data that is accessed very frequently and requires low latency. Which combination of redundancy type and access tier is most appropriate?
- ZRS with the Archive access tier
- GZRS with the Archive access tier
- RA-GRS with the Cool access tier
- LRS with the Hot access tier
Show answer
Correct answer: D. For frequently accessed data, the Hot tier offers the lowest access cost (though higher per-GB storage cost); combining it with LRS also minimizes redundancy cost compared to geo-redundant options, if regional failure protection isn't required.
7. A company must ensure that no blob in a specific container can be deleted or modified during a 5-year audit period. What configuration should they apply?
- Enable blob versioning with 5-year retention
- Apply a locked time-based retention policy with 5 years on the container
- Configure a lifecycle policy that moves blobs to the archive tier after 5 years
- Enable blob soft delete with a 5-year retention period
Show answer
Correct answer: B. To ensure blobs cannot be deleted or modified for a specific period, a locked WORM (Write Once, Read Many) time-based retention policy must be applied. Once locked, the policy is immutable and cannot be shortened. Versioning and soft delete allow recovering deleted data, but do not prevent deletion. Lifecycle policies manage tier movement, not immutability.
8. What is the difference between blob soft delete and container soft delete in Azure Storage?
- Only container soft delete can restore deleted blobs and snapshots; blob soft delete does not retain orphaned snapshots
- Blob soft delete protects individual blobs and snapshots; container soft delete protects the entire container and all blobs in it
- Container soft delete requires a Premium account with LRS, while blob soft delete works on GPv2 accounts with any replication
- Both features are technically equivalent but billed at different prices per GiB of data retained in the deleted state
Show answer
Correct answer: B. Blob soft delete protects individual block blobs, page blobs, and snapshots from accidental deletion. Container soft delete protects the entire container along with all the blobs it contains. Both features can be enabled simultaneously and have independently configurable retention periods. They are complementary, not mutually exclusive.