Topic 04 Practice Test 2 covers Azure Storage Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure access to storage. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Wingtip gives a vendor temporary upload access by SAS. Which practice most directly limits the damage if the token is exposed? Choose ONE.
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Create an account SAS with only the required services, resource types, and permissions
- Associate a service SAS with a stored access policy
Correct Answer: A
Correct Answer
Answer A is correct because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. For the wingtip gives a vendor case, that directly satisfies the requirement that a bearer SAS should minimize exposure if copied or leaked.
Incorrect Answers
Answer B is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. Applied to the wingtip gives a vendor case, this does not provide the required behavior because a bearer SAS should minimize exposure if copied or leaked.
Answer C is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. The the wingtip gives a vendor case scenario instead requires that a bearer SAS should minimize exposure if copied or leaked, so this option would leave the key requirement unresolved.
Answer D is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. In the wingtip gives a vendor case, this is not sufficient because a bearer SAS should minimize exposure if copied or leaked; the capability addresses a neighboring use case.
Question 2
- Datum must distribute a SAS to an external process and wants to reduce credential exposure. Which design choice is best? Choose ONE.
- Associate a service SAS with a stored access policy
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Create an account SAS with only the required services, resource types, and permissions
Correct Answer: B
Correct Answer
Answer B is correct because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. In A. Datum, this is the best fit because a bearer SAS should minimize exposure if copied or leaked.
Incorrect Answers
Answer A is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. For A. Datum, that does not satisfy the requirement that a bearer SAS should minimize exposure if copied or leaked; it solves a different administrative need.
Answer C is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. The A. Datum scenario instead requires that a bearer SAS should minimize exposure if copied or leaked, so this option would leave the key requirement unresolved.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. Applied to A. Datum, this does not provide the required behavior because a bearer SAS should minimize exposure if copied or leaked.
Question 3
Contoso is distributing a SAS URI to an application. Which transport requirement should it enforce to protect the bearer credential in transit? Choose ONE.
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Require HTTPS when distributing and using the SAS
- Add a storage firewall IP network rule for the client public IP range
Correct Answer: C
Correct Answer
Answer C is correct because Using HTTPS protects the SAS bearer token from disclosure in transit; sending a SAS over cleartext HTTP can expose the credential to interception. The Contoso scenario specifically requires that the SAS token must be protected from interception while transmitted and used over the network, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. In Contoso, this is not sufficient because the SAS token must be protected from interception while transmitted and used over the network; the capability addresses a neighboring use case.
Answer B is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. Applied to Contoso, this does not provide the required behavior because the SAS token must be protected from interception while transmitted and used over the network.
Answer D is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For Contoso, that does not satisfy the requirement that the SAS token must be protected from interception while transmitted and used over the network; it solves a different administrative need.
Question 4
Fabrikam finds a client using a SAS over plain HTTP. Which change should be made immediately? Choose ONE.
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Add a storage firewall IP network rule for the client public IP range
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Require HTTPS when distributing and using the SAS
Correct Answer: D
Correct Answer
Answer D is correct because Using HTTPS protects the SAS bearer token from disclosure in transit; sending a SAS over cleartext HTTP can expose the credential to interception. Applied to Fabrikam, the capability meets the requirement that the SAS token must be protected from interception while transmitted and used over the network without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. The Fabrikam scenario instead requires that the SAS token must be protected from interception while transmitted and used over the network, so this option would leave the key requirement unresolved.
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. In Fabrikam, this is not sufficient because the SAS token must be protected from interception while transmitted and used over the network; the capability addresses a neighboring use case.
Answer C is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. For Fabrikam, that does not satisfy the requirement that the SAS token must be protected from interception while transmitted and used over the network; it solves a different administrative need.
Question 5
Northwind must rotate storage account keys while keeping an application online. What rotation method should it use? Choose ONE.
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Associate a service SAS with a stored access policy
- Regenerate the compromised storage account key and update dependent clients
- Disallow Shared Key authorization when workloads can use Microsoft Entra authorization
Correct Answer: A
Correct Answer
Answer A is correct because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. For the northwind must rotate storage case, that directly satisfies the requirement that applications using Shared Key must be rotated without planned downtime by alternating the two account keys.
Incorrect Answers
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. Applied to the northwind must rotate storage case, this does not provide the required behavior because applications using Shared Key must be rotated without planned downtime by alternating the two account keys.
Answer C is incorrect because Regenerating an account key invalidates credentials derived from that key, including SAS tokens signed with it, so dependencies must be updated deliberately. In the northwind must rotate storage case, this is not sufficient because applications using Shared Key must be rotated without planned downtime by alternating the two account keys; the capability addresses a neighboring use case.
Answer D is incorrect because Disabling Shared Key reduces exposure to account-key based access and forces supported workloads toward identity-based authorization and least privilege. The the northwind must rotate storage case scenario instead requires that applications using Shared Key must be rotated without planned downtime by alternating the two account keys, so this option would leave the key requirement unresolved.
Question 6
Adventure Works wants a routine account-key rotation process that avoids switching all clients at the exact regeneration moment. Which approach is best? Choose ONE.
- Associate a service SAS with a stored access policy
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Disallow Shared Key authorization when workloads can use Microsoft Entra authorization
- Regenerate the compromised storage account key and update dependent clients
Correct Answer: B
Correct Answer
Answer B is correct because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. In Adventure Works, this is the best fit because applications using Shared Key must be rotated without planned downtime by alternating the two account keys.
Incorrect Answers
Answer A is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. The Adventure Works scenario instead requires that applications using Shared Key must be rotated without planned downtime by alternating the two account keys, so this option would leave the key requirement unresolved.
Answer C is incorrect because Disabling Shared Key reduces exposure to account-key based access and forces supported workloads toward identity-based authorization and least privilege. Applied to Adventure Works, this does not provide the required behavior because applications using Shared Key must be rotated without planned downtime by alternating the two account keys.
Answer D is incorrect because Regenerating an account key invalidates credentials derived from that key, including SAS tokens signed with it, so dependencies must be updated deliberately. For Adventure Works, that does not satisfy the requirement that applications using Shared Key must be rotated without planned downtime by alternating the two account keys; it solves a different administrative need.
Question 7
Tailspin has migrated all supported workloads to Microsoft Entra authorization and wants to reduce risk from leaked storage keys. Which account setting should it consider? Choose ONE.
- Create an account SAS with only the required services, resource types, and permissions
- Create a service SAS for the required storage service resource
- Disallow Shared Key authorization when workloads can use Microsoft Entra authorization
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
Correct Answer: C
Correct Answer
Answer C is correct because Disabling Shared Key reduces exposure to account-key based access and forces supported workloads toward identity-based authorization and least privilege. The the tailspin has migrated all case scenario specifically requires that supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. In the tailspin has migrated all case, this is not sufficient because supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization; the capability addresses a neighboring use case.
Answer B is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. For the tailspin has migrated all case, that does not satisfy the requirement that supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization; it solves a different administrative need.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. Applied to the tailspin has migrated all case, this does not provide the required behavior because supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization.
Question 8
Woodgrove wants Conditional Access to govern supported storage data access and no application requires Shared Key. What security change best supports that design? Choose ONE.
- Create an account SAS with only the required services, resource types, and permissions
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Create a service SAS for the required storage service resource
- Disallow Shared Key authorization when workloads can use Microsoft Entra authorization
Correct Answer: D
Correct Answer
Answer D is correct because Disabling Shared Key reduces exposure to account-key based access and forces supported workloads toward identity-based authorization and least privilege. Applied to the woodgrove wants conditional access case, the capability meets the requirement that supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. For the woodgrove wants conditional access case, that does not satisfy the requirement that supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization; it solves a different administrative need.
Answer B is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. The the woodgrove wants conditional access case scenario instead requires that supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization, so this option would leave the key requirement unresolved.
Answer C is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. In the woodgrove wants conditional access case, this is not sufficient because supported workloads should be forced away from account-key authorization toward Microsoft Entra authorization; the capability addresses a neighboring use case.
Question 9
Proseware discovers that storage account key1 has been exposed. After clients are moved to key2, what should the administrator do to invalidate key1-based credentials? Choose ONE.
- Regenerate the compromised storage account key and update dependent clients
- Associate a service SAS with a stored access policy
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
Correct Answer: A
Correct Answer
Answer A is correct because Regenerating an account key invalidates credentials derived from that key, including SAS tokens signed with it, so dependencies must be updated deliberately. For Proseware, that directly satisfies the requirement that a specific account key is compromised and credentials signed with that key must be invalidated.
Incorrect Answers
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. Applied to Proseware, this does not provide the required behavior because a specific account key is compromised and credentials signed with that key must be invalidated.
Answer C is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. The Proseware scenario instead requires that a specific account key is compromised and credentials signed with that key must be invalidated, so this option would leave the key requirement unresolved.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. In Proseware, this is not sufficient because a specific account key is compromised and credentials signed with that key must be invalidated; the capability addresses a neighboring use case.
Question 10
A company is hardening Azure Files SMB access. Which TWO controls belong to identity-based authorization? Choose TWO.
- Add a storage firewall IP network rule for the client public IP range
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Create an account SAS with only the required services, resource types, and permissions
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
Correct Answers: B, E
Correct Answers
Answer B is correct because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. In the a company is hardening case, this is the best fit because a supported identity source must provide Kerberos authentication and share/file permissions must authorize the user.
Answer E is correct because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. The the a company is hardening case scenario specifically requires that a supported identity source must provide Kerberos authentication and share/file permissions must authorize the user, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. In the a company is hardening case, this is not sufficient because a supported identity source must provide Kerberos authentication and share/file permissions must authorize the user; the capability addresses a neighboring use case.
Answer C is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. For the a company is hardening case, that does not satisfy the requirement that a supported identity source must provide Kerberos authentication and share/file permissions must authorize the user; it solves a different administrative need.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. Applied to the a company is hardening case, this does not provide the required behavior because a supported identity source must provide Kerberos authentication and share/file permissions must authorize the user.
Question 11
Litware suspects a service SAS signed with a leaked account key is in unauthorized hands. Which action invalidates credentials derived from that key? Choose ONE.
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Associate a service SAS with a stored access policy
- Regenerate the compromised storage account key and update dependent clients
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
Correct Answer: C
Correct Answer
Answer C is correct because Regenerating an account key invalidates credentials derived from that key, including SAS tokens signed with it, so dependencies must be updated deliberately. The Litware scenario specifically requires that a specific account key is compromised and credentials signed with that key must be invalidated, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. For Litware, that does not satisfy the requirement that a specific account key is compromised and credentials signed with that key must be invalidated; it solves a different administrative need.
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. Applied to Litware, this does not provide the required behavior because a specific account key is compromised and credentials signed with that key must be invalidated.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. In Litware, this is not sufficient because a specific account key is compromised and credentials signed with that key must be invalidated; the capability addresses a neighboring use case.
Question 12
Wingtip wants employees to access an SMB Azure file share with their identities rather than a storage account key. What should it enable? Choose ONE.
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
- Configure only one supported identity source for SMB Azure Files on the storage account
- Create an account SAS with only the required services, resource types, and permissions
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
Correct Answer: D
Correct Answer
Answer D is correct because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. Applied to the wingtip wants employees to case, the capability meets the requirement that SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. For the wingtip wants employees to case, that does not satisfy the requirement that SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key; it solves a different administrative need.
Answer B is incorrect because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. In the wingtip wants employees to case, this is not sufficient because SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key; the capability addresses a neighboring use case.
Answer C is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. The the wingtip wants employees to case scenario instead requires that SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key, so this option would leave the key requirement unresolved.
Question 13
- Datum is migrating a Windows file share and wants Kerberos-based identity authentication to Azure Files. Which capability should it configure? Choose ONE.
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Create an account SAS with only the required services, resource types, and permissions
- Configure only one supported identity source for SMB Azure Files on the storage account
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
Correct Answer: A
Correct Answer
Answer A is correct because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. For A. Datum, that directly satisfies the requirement that SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key.
Incorrect Answers
Answer B is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. In A. Datum, this is not sufficient because SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key; the capability addresses a neighboring use case.
Answer C is incorrect because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. The A. Datum scenario instead requires that SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key, so this option would leave the key requirement unresolved.
Answer D is incorrect because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. Applied to A. Datum, this does not provide the required behavior because SMB users should authenticate to Azure Files with identity credentials and Kerberos instead of mounting with an account key.
Question 14
Contoso already uses Microsoft Entra Kerberos for SMB Azure Files and considers enabling Microsoft Entra Domain Services on the same storage account. What constraint applies? Choose ONE.
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
- Configure only one supported identity source for SMB Azure Files on the storage account
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
Correct Answer: B
Correct Answer
Answer B is correct because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. In Contoso, this is the best fit because the storage account must use a single supported identity source for SMB Azure Files authentication.
Incorrect Answers
Answer A is incorrect because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. Applied to Contoso, this does not provide the required behavior because the storage account must use a single supported identity source for SMB Azure Files authentication.
Answer C is incorrect because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. The Contoso scenario instead requires that the storage account must use a single supported identity source for SMB Azure Files authentication, so this option would leave the key requirement unresolved.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. For Contoso, that does not satisfy the requirement that the storage account must use a single supported identity source for SMB Azure Files authentication; it solves a different administrative need.
Question 15
Fabrikam is designing Azure Files identity authentication and wants two simultaneous directory identity sources on one storage account. What should it know? Choose ONE.
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Configure only one supported identity source for SMB Azure Files on the storage account
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
Correct Answer: C
Correct Answer
Answer C is correct because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. The Fabrikam scenario specifically requires that the storage account must use a single supported identity source for SMB Azure Files authentication, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. For Fabrikam, that does not satisfy the requirement that the storage account must use a single supported identity source for SMB Azure Files authentication; it solves a different administrative need.
Answer B is incorrect because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. In Fabrikam, this is not sufficient because the storage account must use a single supported identity source for SMB Azure Files authentication; the capability addresses a neighboring use case.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. Applied to Fabrikam, this does not provide the required behavior because the storage account must use a single supported identity source for SMB Azure Files authentication.
Question 16
Northwind enables identity-based Azure Files authentication, but users still need controlled access to specific folders. What authorization layers should it configure? Choose ONE.
- Configure only one supported identity source for SMB Azure Files on the storage account
- Keep the network rule and also grant the caller valid storage authorization
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
Correct Answer: D
Correct Answer
Answer D is correct because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. Applied to the northwind enables identity-based azure case, the capability meets the requirement that an authenticated SMB user must be authorized both at the share level and at the directory or file level without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. In the northwind enables identity-based azure case, this is not sufficient because an authenticated SMB user must be authorized both at the share level and at the directory or file level; the capability addresses a neighboring use case.
Answer B is incorrect because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. The the northwind enables identity-based azure case scenario instead requires that an authenticated SMB user must be authorized both at the share level and at the directory or file level, so this option would leave the key requirement unresolved.
Answer C is incorrect because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. For the northwind enables identity-based azure case, that does not satisfy the requirement that an authenticated SMB user must be authorized both at the share level and at the directory or file level; it solves a different administrative need.
Question 17
Adventure Works wants one group to access an SMB share but only selected directories inside it. Which permission model should be implemented? Choose ONE.
- Assign the appropriate Azure Files share-level data role and configure directory/file ACLs
- Enable an Azure Files SMB identity source and use Kerberos-based identity authentication
- Keep the network rule and also grant the caller valid storage authorization
- Configure only one supported identity source for SMB Azure Files on the storage account
Correct Answer: A
Correct Answer
Answer A is correct because Identity-based Azure Files access uses share-level authorization plus directory and file permissions, so both layers must permit the requested SMB access. For Adventure Works, that directly satisfies the requirement that an authenticated SMB user must be authorized both at the share level and at the directory or file level.
Incorrect Answers
Answer B is incorrect because Azure Files supports identity-based authentication for SMB shares using supported identity sources such as Microsoft Entra Kerberos, Microsoft Entra Domain Services, or AD DS. Applied to Adventure Works, this does not provide the required behavior because an authenticated SMB user must be authorized both at the share level and at the directory or file level.
Answer C is incorrect because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. In Adventure Works, this is not sufficient because an authenticated SMB user must be authorized both at the share level and at the directory or file level; the capability addresses a neighboring use case.
Answer D is incorrect because Azure Files supports one identity source per storage account for identity-based SMB authentication, and that source applies to the account’s file shares. The Adventure Works scenario instead requires that an authenticated SMB user must be authorized both at the share level and at the directory or file level, so this option would leave the key requirement unresolved.
Question 18
Tailspin adds a subnet to the storage firewall and assumes VMs in that subnet can now read private blobs anonymously. What additional requirement remains? Choose ONE.
- Enable the required trusted Azure service exception
- Keep the network rule and also grant the caller valid storage authorization
- Add a storage firewall IP network rule for the client public IP range
- Set public network access to selected networks or otherwise use a default-deny network configuration
Correct Answer: B
Correct Answer
Answer B is correct because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. In the tailspin adds a subnet case, this is the best fit because network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request.
Incorrect Answers
Answer A is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. For the tailspin adds a subnet case, that does not satisfy the requirement that network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request; it solves a different administrative need.
Answer C is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. Applied to the tailspin adds a subnet case, this does not provide the required behavior because network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request.
Answer D is incorrect because Storage network rules restrict the public endpoint only when the account is configured to deny traffic that is not matched by an allowed rule. The the tailspin adds a subnet case scenario instead requires that network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request, so this option would leave the key requirement unresolved.
Question 19
Woodgrove correctly allows an IP range through the storage firewall, but requests receive authorization failures. What should the administrator verify next? Choose ONE.
- Enable the required trusted Azure service exception
- Add a storage firewall IP network rule for the client public IP range
- Keep the network rule and also grant the caller valid storage authorization
- Set public network access to selected networks or otherwise use a default-deny network configuration
Correct Answer: C
Correct Answer
Answer C is correct because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. The the woodgrove correctly allows an case scenario specifically requires that network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. Applied to the woodgrove correctly allows an case, this does not provide the required behavior because network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request.
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For the woodgrove correctly allows an case, that does not satisfy the requirement that network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request; it solves a different administrative need.
Answer D is incorrect because Storage network rules restrict the public endpoint only when the account is configured to deny traffic that is not matched by an allowed rule. In the woodgrove correctly allows an case, this is not sufficient because network reachability is already permitted, but the caller still needs a valid identity, key, or SAS authorization for the data request; the capability addresses a neighboring use case.
Question 20
A storage account key is suspected compromised. Which TWO actions support safe recovery with minimal downtime? Choose TWO.
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Enable the required trusted Azure service exception
- Create a user delegation SAS using Microsoft Entra credentials
- Regenerate the compromised storage account key and update dependent clients
Correct Answers: B, E
Correct Answers
Answer B is correct because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. Applied to the a storage account key case, the capability meets the requirement that clients can be moved to the alternate account key before regenerating the compromised key without adding unrelated scope.
Answer E is correct because Regenerating an account key invalidates credentials derived from that key, including SAS tokens signed with it, so dependencies must be updated deliberately. For the a storage account key case, that directly satisfies the requirement that clients can be moved to the alternate account key before regenerating the compromised key.
Incorrect Answers
Answer A is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. In the a storage account key case, this is not sufficient because clients can be moved to the alternate account key before regenerating the compromised key; the capability addresses a neighboring use case.
Answer C is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. The the a storage account key case scenario instead requires that clients can be moved to the alternate account key before regenerating the compromised key, so this option would leave the key requirement unresolved.
Answer D is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. Applied to the a storage account key case, this does not provide the required behavior because clients can be moved to the alternate account key before regenerating the compromised key.
