DNS must map the storage host to the private endpoint within the client network. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “Private DNS zone linkage and the blob endpoint A record” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.

A file endpoint does not automatically make the blob endpoint private. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “Separate private endpoints and DNS mappings can be required per storage subresource” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.

Built-in Blob Data Contributor can include delete; least privilege may need a custom role or limited SAS. In this case, a SAS for a blob returns unauthorized when used to list an entire container. “A scoped custom data role or narrowly constrained supported delegation” would not satisfy that requirement; the supported action is “Blob-scoped SAS does not provide container listing authority”. The SAS resource and permission scope must include the actual intended operation.

Cross-region synchronous acknowledgement is not a property of ZRS, which stays within one region. The competing choice “Every write waits until a geographically paired secondary region confirms the transaction” does not meet the specific requirement: An Azure storage account already uses ZRS and a single primary-region availability zone becomes unavailable. Which property explains why data can remain available without moving to a paired region. The supported action is “Synchronous replication across supported availability zones within the primary Azure region”.

ZRS does not use only one disk or rely on a nightly backup to withstand an individual zone failure. The competing choice “ZRS stores all copies on one physical disk and relies on a daily backup” does not meet the specific requirement: An Azure storage account already uses ZRS and a single primary-region availability zone becomes unavailable. Which property explains why data can remain available without moving to a paired region. The supported action is “Synchronous replication across supported availability zones within the primary Azure region”.

ZRS is already designed for zone resilience; changing redundancy to GRS is not a prerequisite for healthy-zone availability. The competing choice “The administrator must manually change the account to GRS before any healthy-zone read can succeed” does not meet the specific requirement: An Azure storage account already uses ZRS and a single primary-region availability zone becomes unavailable. Which property explains why data can remain available without moving to a paired region. The supported action is “Synchronous replication across supported availability zones within the primary Azure region”.

Regional replication cannot guarantee zero RPO for asynchronous updates. In this case, a team selects LRS but expects resilience to a complete availability-zone outage. “Geo-replication is asynchronous and can have a recovery point lag” would not satisfy that requirement; the supported action is “Move to a supported ZRS configuration where required”. LRS replication stays within a single datacenter scale unit rather than spanning zones.

GRS replicates to a secondary region asynchronously in addition to primary-region redundancy. In this case, a team selects LRS but expects resilience to a complete availability-zone outage. “Geo-redundant storage (GRS)” would not satisfy that requirement; the supported action is “Move to a supported ZRS configuration where required”. LRS replication stays within a single datacenter scale unit rather than spanning zones.

Read-access capability is distinct from merely replicating a secondary copy. In this case, a team selects LRS but expects resilience to a complete availability-zone outage. “Choose a read-access supported geo-redundancy option” would not satisfy that requirement; the supported action is “Move to a supported ZRS configuration where required”. LRS replication stays within a single datacenter scale unit rather than spanning zones.

Geo replication is asynchronous, not a synchronous two-region commit for each request. Assuming immediate dual-region durability ignores documented replication lag. In this case, a finance team has already selected geo-redundant Azure Blob Storage for its storage account. It assumes every write is immediately present in the secondary region. “Assume each primary write is synchronously committed in both Azure regions before success is returned” would not satisfy that requirement; the supported action is “Account for asynchronous secondary replication lag when defining recovery point objectives and testing regional recovery”.

RPO is a measurable maximum acceptable data loss. GRS does not guarantee a zero-loss RPO after abrupt regional failure. In this case, a finance team has already selected geo-redundant Azure Blob Storage for its storage account. It assumes every write is immediately present in the secondary region. “Replace recovery objectives with a claim that geo-redundancy provides zero possible data loss” would not satisfy that requirement; the supported action is “Account for asynchronous secondary replication lag when defining recovery point objectives and testing regional recovery”.

Availability-zone redundancy is a primary-region placement detail and cannot establish the freshness of the separately replicated paired-region copy. In this case, a finance team has already selected geo-redundant Azure Blob Storage for its storage account. It assumes every write is immediately present in the secondary region. “Treat local availability-zone protection as proof that every geo-secondary write is current” would not satisfy that requirement; the supported action is “Account for asynchronous secondary replication lag when defining recovery point objectives and testing regional recovery”.

RA-GRS exposes supported read access to the secondary endpoint. In this case, a disaster team expects synchronous zero-data-loss replication across Azure regions from GRS. “Read-access geo-redundant storage (RA-GRS)” would not satisfy that requirement; the supported action is “Geo-replication is asynchronous and can have a recovery point lag”. Regional replication cannot guarantee zero RPO for asynchronous updates.

LRS replication stays within a single datacenter scale unit rather than spanning zones. In this case, a disaster team expects synchronous zero-data-loss replication across Azure regions from GRS. “Move to a supported ZRS configuration where required” would not satisfy that requirement; the supported action is “Geo-replication is asynchronous and can have a recovery point lag”. Regional replication cannot guarantee zero RPO for asynchronous updates.

Read-access capability is distinct from merely replicating a secondary copy. In this case, a disaster team expects synchronous zero-data-loss replication across Azure regions from GRS. “Choose a read-access supported geo-redundancy option” would not satisfy that requirement; the supported action is “Geo-replication is asynchronous and can have a recovery point lag”. Regional replication cannot guarantee zero RPO for asynchronous updates.

Changing application write behavior on the primary endpoint does not redirect requests to the separately exposed secondary service endpoint. In this case, an account already uses RA-GRS and the reporting client must query a replica while the primary region is healthy. “The primary endpoint with writes disabled by application code” would not satisfy that requirement; the supported action is “The account-specific read-access secondary endpoint for the supported service”.

A different locally redundant account is not the replica of the intended geo-redundant storage account. It has unrelated contents and no paired read guarantee. In this case, an account already uses RA-GRS and the reporting client must query a replica while the primary region is healthy. “The ordinary LRS endpoint of a different storage account” would not satisfy that requirement; the supported action is “The account-specific read-access secondary endpoint for the supported service”.

A custom header on the primary URL is not a substitute for the documented read-access secondary service endpoint. In this case, an account already uses RA-GRS and the reporting client must query a replica while the primary region is healthy. “Use the primary endpoint with a custom request header asking Azure Storage to serve the secondary copy” would not satisfy that requirement; the supported action is “The account-specific read-access secondary endpoint for the supported service”.

The read-access variant supports eligible secondary reads without completing failover. In this case, an application uses GRS and assumes ordinary secondary reads are enabled. “Read-access GZRS (RA-GZRS)” would not satisfy that requirement; the supported action is “Choose a read-access supported geo-redundancy option”. Read-access capability is distinct from merely replicating a secondary copy.

GRS replicates to a secondary region asynchronously in addition to primary-region redundancy. In this case, an application uses GRS and assumes ordinary secondary reads are enabled. “Geo-redundant storage (GRS)” would not satisfy that requirement; the supported action is “Choose a read-access supported geo-redundancy option”. Read-access capability is distinct from merely replicating a secondary copy.

GZRS combines primary-region zone redundancy with asynchronous geo-replication. In this case, an application uses GRS and assumes ordinary secondary reads are enabled. “Geo-zone-redundant storage (GZRS)” would not satisfy that requirement; the supported action is “Choose a read-access supported geo-redundancy option”. Read-access capability is distinct from merely replicating a secondary copy.

The inter-region copy is asynchronous, so treating it as part of every synchronous primary write acknowledgement is inaccurate. In this case, an Azure storage account uses GZRS for regional resiliency. An operator assumes that a zone outage and a primary-region loss have the same recovery behavior. “Every write is acknowledged synchronously by the paired region before being committed to the primary region” would not satisfy that requirement; the supported action is “Primary-zone replicas are synchronously maintained across zones, while the paired-region replication remains asynchronous and may lag”.

Zonal synchronous durability does not eliminate asynchronous replication delay to the paired region. In this case, an Azure storage account uses GZRS for regional resiliency. An operator assumes that a zone outage and a primary-region loss have the same recovery behavior. “Treat primary-zone redundancy as proof that every paired-region write has been synchronously committed” would not satisfy that requirement; the supported action is “Primary-zone replicas are synchronously maintained across zones, while the paired-region replication remains asynchronous and may lag”.

Recovery should be planned and exercised, and replication lag can affect secondary freshness. Redundancy does not eliminate the need for RPO planning. In this case, an Azure storage account uses GZRS for regional resiliency. An operator assumes that a zone outage and a primary-region loss have the same recovery behavior. “Cross-region failover requires no separate validation, recovery planning, or consideration of RPO” would not satisfy that requirement; the supported action is “Primary-zone replicas are synchronously maintained across zones, while the paired-region replication remains asynchronous and may lag”.

RA-GRS exposes supported read access to the secondary endpoint. In this case, a team needs read access to its GZRS secondary copy. “Read-access geo-redundant storage (RA-GRS)” would not satisfy that requirement; the supported action is “Read-access GZRS (RA-GZRS)”. The read-access variant supports eligible secondary reads without completing failover.

Read-access capability is distinct from merely replicating a secondary copy. In this case, a team needs read access to its GZRS secondary copy. “Choose a read-access supported geo-redundancy option” would not satisfy that requirement; the supported action is “Read-access GZRS (RA-GZRS)”. The read-access variant supports eligible secondary reads without completing failover.

Disabling or removing key authorization can disrupt storage encryption operations. In this case, a team needs read access to its GZRS secondary copy. “The service requires access to the configured active customer-managed key” would not satisfy that requirement; the supported action is “Read-access GZRS (RA-GZRS)”. The read-access variant supports eligible secondary reads without completing failover.

Key rotation has access and version lifecycle implications for encrypted storage. In this case, a security audit demands customer-managed encryption keys rather than default service-managed keys. “Use versioned key management and supported storage account CMK rotation behavior” would not satisfy that requirement; the supported action is “Configure a customer-managed key with supported Key Vault or managed HSM integration”. Customer-managed keys allow customer control of the encryption key lifecycle for supported storage services.

Customer-managed encryption depends on authorized access to the external key. In this case, a security audit demands customer-managed encryption keys rather than default service-managed keys. “Grant the storage identity required key unwrap/wrap/get permissions per the chosen model” would not satisfy that requirement; the supported action is “Configure a customer-managed key with supported Key Vault or managed HSM integration”. Customer-managed keys allow customer control of the encryption key lifecycle for supported storage services.

GZRS combines primary-region zone redundancy with asynchronous geo-replication. In this case, a security audit demands customer-managed encryption keys rather than default service-managed keys. “Geo-zone-redundant storage (GZRS)” would not satisfy that requirement; the supported action is “Configure a customer-managed key with supported Key Vault or managed HSM integration”. Customer-managed keys allow customer control of the encryption key lifecycle for supported storage services.

Key rotation has access and version lifecycle implications for encrypted storage. In this case, a storage account using CMK stops working after the key is disabled. “Use versioned key management and supported storage account CMK rotation behavior” would not satisfy that requirement; the supported action is “The service requires access to the configured active customer-managed key”. Disabling or removing key authorization can disrupt storage encryption operations.

Customer-managed encryption depends on authorized access to the external key. In this case, a storage account using CMK stops working after the key is disabled. “Grant the storage identity required key unwrap/wrap/get permissions per the chosen model” would not satisfy that requirement; the supported action is “The service requires access to the configured active customer-managed key”. Disabling or removing key authorization can disrupt storage encryption operations.

The read-access variant supports eligible secondary reads without completing failover. In this case, a storage account using CMK stops working after the key is disabled. “Read-access GZRS (RA-GZRS)” would not satisfy that requirement; the supported action is “The service requires access to the configured active customer-managed key”. Disabling or removing key authorization can disrupt storage encryption operations.