Topic 04 Practice Test 1 covers Azure Storage Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure access to storage. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Contoso restricts a storage account to selected networks and needs VMs in Subnet-App to reach the public storage endpoint. Which configuration is required? Choose ONE.
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a storage firewall IP network rule for the client public IP range
- Enable the required trusted Azure service exception
- Add a resource-instance network rule for the specific Azure resource
Correct Answer: A
Correct Answer
Answer A is correct because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. Applied to Contoso, the capability meets the requirement that access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For Contoso, that does not satisfy the requirement that access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked; it solves a different administrative need.
Answer C is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. In Contoso, this is not sufficient because access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked; the capability addresses a neighboring use case.
Answer D is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. The Contoso scenario instead requires that access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked, so this option would leave the key requirement unresolved.
Question 2
Fabrikam has a locked-down storage account and wants to authorize one virtual-network subnet. Which two-part network configuration best fits? Choose ONE.
- Add a storage firewall IP network rule for the client public IP range
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a resource-instance network rule for the specific Azure resource
- Enable the required trusted Azure service exception
Correct Answer: B
Correct Answer
Answer B is correct because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. For Fabrikam, that directly satisfies the requirement that access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked.
Incorrect Answers
Answer A is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. Applied to Fabrikam, this does not provide the required behavior because access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked.
Answer C is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. In Fabrikam, this is not sufficient because access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked; the capability addresses a neighboring use case.
Answer D is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. The Fabrikam scenario instead requires that access should be allowed from one Azure subnet through the storage public endpoint while other networks remain blocked, so this option would leave the key requirement unresolved.
Question 3
Northwind’s on-premises backup server uses a fixed public IP address and must access a storage account restricted to selected networks. What should be added? Choose ONE.
- Add a resource-instance network rule for the specific Azure resource
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a storage firewall IP network rule for the client public IP range
- Enable the required trusted Azure service exception
Correct Answer: C
Correct Answer
Answer C is correct because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. In the northwind s on-premises backup case, this is the best fit because a known on-premises client public IPv4 range should be allowed through the storage public endpoint.
Incorrect Answers
Answer A is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. For the northwind s on-premises backup case, that does not satisfy the requirement that a known on-premises client public IPv4 range should be allowed through the storage public endpoint; it solves a different administrative need.
Answer B is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. The the northwind s on-premises backup case scenario instead requires that a known on-premises client public IPv4 range should be allowed through the storage public endpoint, so this option would leave the key requirement unresolved.
Answer D is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. Applied to the northwind s on-premises backup case, this does not provide the required behavior because a known on-premises client public IPv4 range should be allowed through the storage public endpoint.
Question 4
Adventure Works needs to permit a partner gateway with a known public IP range to reach a storage public endpoint. Which firewall rule is appropriate? Choose ONE.
- Add a resource-instance network rule for the specific Azure resource
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Enable the required trusted Azure service exception
- Add a storage firewall IP network rule for the client public IP range
Correct Answer: D
Correct Answer
Answer D is correct because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. The Adventure Works scenario specifically requires that a known on-premises client public IPv4 range should be allowed through the storage public endpoint, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. Applied to Adventure Works, this does not provide the required behavior because a known on-premises client public IPv4 range should be allowed through the storage public endpoint.
Answer B is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. In Adventure Works, this is not sufficient because a known on-premises client public IPv4 range should be allowed through the storage public endpoint; the capability addresses a neighboring use case.
Answer C is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. For Adventure Works, that does not satisfy the requirement that a known on-premises client public IPv4 range should be allowed through the storage public endpoint; it solves a different administrative need.
Question 5
Tailspin enables storage firewall restrictions, then a supported Azure platform service can no longer write required logs. Which network exception should it consider? Choose ONE.
- Enable the required trusted Azure service exception
- Add a resource-instance network rule for the specific Azure resource
- Add a storage firewall IP network rule for the client public IP range
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
Correct Answer: A
Correct Answer
Answer A is correct because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. Applied to the tailspin enables storage firewall case, the capability meets the requirement that a supported Azure service outside the network boundary needs access using its trusted-service exception behavior without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. The the tailspin enables storage firewall case scenario instead requires that a supported Azure service outside the network boundary needs access using its trusted-service exception behavior, so this option would leave the key requirement unresolved.
Answer C is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For the tailspin enables storage firewall case, that does not satisfy the requirement that a supported Azure service outside the network boundary needs access using its trusted-service exception behavior; it solves a different administrative need.
Answer D is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. In the tailspin enables storage firewall case, this is not sufficient because a supported Azure service outside the network boundary needs access using its trusted-service exception behavior; the capability addresses a neighboring use case.
Question 6
Woodgrove needs an eligible Azure service operating outside its VNet to reach a restricted storage account using strong authentication. What should it enable? Choose ONE.
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Enable the required trusted Azure service exception
- Add a resource-instance network rule for the specific Azure resource
- Add a storage firewall IP network rule for the client public IP range
Correct Answer: B
Correct Answer
Answer B is correct because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. For the woodgrove needs an eligible case, that directly satisfies the requirement that a supported Azure service outside the network boundary needs access using its trusted-service exception behavior.
Incorrect Answers
Answer A is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. The the woodgrove needs an eligible case scenario instead requires that a supported Azure service outside the network boundary needs access using its trusted-service exception behavior, so this option would leave the key requirement unresolved.
Answer C is incorrect because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. In the woodgrove needs an eligible case, this is not sufficient because a supported Azure service outside the network boundary needs access using its trusted-service exception behavior; the capability addresses a neighboring use case.
Answer D is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. Applied to the woodgrove needs an eligible case, this does not provide the required behavior because a supported Azure service outside the network boundary needs access using its trusted-service exception behavior.
Question 7
Proseware wants a particular Azure resource instance to access a restricted storage account without opening an entire subnet. Which rule type should it evaluate? Choose ONE.
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a storage firewall IP network rule for the client public IP range
- Add a resource-instance network rule for the specific Azure resource
- Enable the required trusted Azure service exception
Correct Answer: C
Correct Answer
Answer C is correct because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. In Proseware, this is the best fit because one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable.
Incorrect Answers
Answer A is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. For Proseware, that does not satisfy the requirement that one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable; it solves a different administrative need.
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. Applied to Proseware, this does not provide the required behavior because one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable.
Answer D is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. The Proseware scenario instead requires that one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable, so this option would leave the key requirement unresolved.
Question 8
Litware cannot isolate a required Azure resource through a VNet or stable public IP, but wants to authorize that resource instance specifically. What should it configure? Choose ONE.
- Enable the required trusted Azure service exception
- Add a storage firewall IP network rule for the client public IP range
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a resource-instance network rule for the specific Azure resource
Correct Answer: D
Correct Answer
Answer D is correct because A resource-instance rule can allow a particular Azure resource instance to access the storage account when virtual-network or IP rules are not suitable. The Litware scenario specifically requires that one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. In Litware, this is not sufficient because one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable; the capability addresses a neighboring use case.
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For Litware, that does not satisfy the requirement that one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable; it solves a different administrative need.
Answer C is incorrect because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. Applied to Litware, this does not provide the required behavior because one specific Azure resource instance should be allowed when IP or virtual-network rules are not suitable.
Question 9
Wingtip adds several storage network rules but discovers that unrelated public clients can still connect. Which account-level network posture should it verify? Choose ONE.
- Set public network access to selected networks or otherwise use a default-deny network configuration
- Keep the network rule and also grant the caller valid storage authorization
- Add a storage firewall IP network rule for the client public IP range
- Enable the required trusted Azure service exception
Correct Answer: A
Correct Answer
Answer A is correct because Storage network rules restrict the public endpoint only when the account is configured to deny traffic that is not matched by an allowed rule. Applied to the wingtip adds several storage case, the capability meets the requirement that network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. The the wingtip adds several storage case scenario instead requires that network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed, so this option would leave the key requirement unresolved.
Answer C is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For the wingtip adds several storage case, that does not satisfy the requirement that network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed; it solves a different administrative need.
Answer D is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. In the wingtip adds several storage case, this is not sufficient because network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed; the capability addresses a neighboring use case.
Question 10
A storage account is restricted to selected networks. Which TWO requirements are needed for a VM subnet to use the storage public endpoint securely? Choose TWO.
- Enable the required trusted Azure service exception
- Enable the Azure Storage service endpoint on the subnet and add a virtual-network rule for that subnet
- Add a storage firewall IP network rule for the client public IP range
- Create an account SAS with only the required services, resource types, and permissions
- Keep the network rule and also grant the caller valid storage authorization
Correct Answers: B, E
Correct Answers
Answer B is correct because A storage virtual-network rule authorizes the selected subnet through the storage public endpoint, and the subnet must have the appropriate Azure Storage service endpoint enabled. For the a storage account is case, that directly satisfies the requirement that the subnet must be allowed by the storage network configuration and requests still require valid storage authorization.
Answer E is correct because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. In the a storage account is case, this is the best fit because the subnet must be allowed by the storage network configuration and requests still require valid storage authorization.
Incorrect Answers
Answer A is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. Applied to the a storage account is case, this does not provide the required behavior because the subnet must be allowed by the storage network configuration and requests still require valid storage authorization.
Answer C is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. The the a storage account is case scenario instead requires that the subnet must be allowed by the storage network configuration and requests still require valid storage authorization, so this option would leave the key requirement unresolved.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. For the a storage account is case, that does not satisfy the requirement that the subnet must be allowed by the storage network configuration and requests still require valid storage authorization; it solves a different administrative need.
Question 11
- Datum wants only explicitly allowed network sources to use the storage public endpoint. Which baseline firewall behavior is required? Choose ONE.
- Enable the required trusted Azure service exception
- Add a storage firewall IP network rule for the client public IP range
- Set public network access to selected networks or otherwise use a default-deny network configuration
- Keep the network rule and also grant the caller valid storage authorization
Correct Answer: C
Correct Answer
Answer C is correct because Storage network rules restrict the public endpoint only when the account is configured to deny traffic that is not matched by an allowed rule. In A. Datum, this is the best fit because network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed.
Incorrect Answers
Answer A is incorrect because A trusted-service exception allows supported Azure services outside the configured network boundary to reach the storage account using strong authentication. Applied to A. Datum, this does not provide the required behavior because network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed.
Answer B is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. For A. Datum, that does not satisfy the requirement that network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed; it solves a different administrative need.
Answer D is incorrect because Storage firewall rules determine whether network traffic can reach the public endpoint; they do not replace authentication and authorization for the data request. The A. Datum scenario instead requires that network allow rules should actually restrict the public endpoint instead of leaving unmatched traffic allowed, so this option would leave the key requirement unresolved.
Question 12
Contoso must issue temporary delegated access to blobs and wants the SAS secured by Microsoft Entra credentials. Which SAS type should it prefer? Choose ONE.
- Create a service SAS for the required storage service resource
- Associate a service SAS with a stored access policy
- Create an account SAS with only the required services, resource types, and permissions
- Create a user delegation SAS using Microsoft Entra credentials
Correct Answer: D
Correct Answer
Answer D is correct because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. The Contoso scenario specifically requires that delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. Applied to Contoso, this does not provide the required behavior because delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible.
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. In Contoso, this is not sufficient because delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible; the capability addresses a neighboring use case.
Answer C is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. For Contoso, that does not satisfy the requirement that delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible; it solves a different administrative need.
Question 13
Fabrikam wants the strongest recommended SAS approach for a user-authorized blob workflow without signing with the storage account key. Which SAS should it create? Choose ONE.
- Create a user delegation SAS using Microsoft Entra credentials
- Associate a service SAS with a stored access policy
- Create a service SAS for the required storage service resource
- Create an account SAS with only the required services, resource types, and permissions
Correct Answer: A
Correct Answer
Answer A is correct because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. Applied to Fabrikam, the capability meets the requirement that delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. For Fabrikam, that does not satisfy the requirement that delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible; it solves a different administrative need.
Answer C is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. The Fabrikam scenario instead requires that delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible, so this option would leave the key requirement unresolved.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. In Fabrikam, this is not sufficient because delegated blob access should use Microsoft Entra credentials rather than exposing an account key when possible; the capability addresses a neighboring use case.
Question 14
Northwind needs a SAS for one blob container and wants the option to bind it to a stored access policy. Which SAS type is appropriate? Choose ONE.
- Create a user delegation SAS using Microsoft Entra credentials
- Create a service SAS for the required storage service resource
- Associate a service SAS with a stored access policy
- Create an account SAS with only the required services, resource types, and permissions
Correct Answer: B
Correct Answer
Answer B is correct because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. For the northwind needs a sas case, that directly satisfies the requirement that delegated access is limited to resources in one storage service and may need linkage to a stored access policy.
Incorrect Answers
Answer A is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. The the northwind needs a sas case scenario instead requires that delegated access is limited to resources in one storage service and may need linkage to a stored access policy, so this option would leave the key requirement unresolved.
Answer C is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. Applied to the northwind needs a sas case, this does not provide the required behavior because delegated access is limited to resources in one storage service and may need linkage to a stored access policy.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. In the northwind needs a sas case, this is not sufficient because delegated access is limited to resources in one storage service and may need linkage to a stored access policy; the capability addresses a neighboring use case.
Question 15
Adventure Works delegates access only to one Azure Files share and plans to manage constraints with a stored policy. Which SAS type should it use? Choose ONE.
- Create an account SAS with only the required services, resource types, and permissions
- Associate a service SAS with a stored access policy
- Create a service SAS for the required storage service resource
- Create a user delegation SAS using Microsoft Entra credentials
Correct Answer: C
Correct Answer
Answer C is correct because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. In Adventure Works, this is the best fit because delegated access is limited to resources in one storage service and may need linkage to a stored access policy.
Incorrect Answers
Answer A is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. For Adventure Works, that does not satisfy the requirement that delegated access is limited to resources in one storage service and may need linkage to a stored access policy; it solves a different administrative need.
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. The Adventure Works scenario instead requires that delegated access is limited to resources in one storage service and may need linkage to a stored access policy, so this option would leave the key requirement unresolved.
Answer D is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. Applied to Adventure Works, this does not provide the required behavior because delegated access is limited to resources in one storage service and may need linkage to a stored access policy.
Question 16
Tailspin needs a single SAS that can access both Blob Storage and Azure Files in the same account. Which SAS type supports that scope? Choose ONE.
- Create a user delegation SAS using Microsoft Entra credentials
- Associate a service SAS with a stored access policy
- Create a service SAS for the required storage service resource
- Create an account SAS with only the required services, resource types, and permissions
Correct Answer: D
Correct Answer
Answer D is correct because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. The the tailspin needs a single case scenario specifically requires that one SAS must cover operations across multiple Azure Storage services or service-level operations, so this choice matches the intended behavior.
Incorrect Answers
Answer A is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. For the tailspin needs a single case, that does not satisfy the requirement that one SAS must cover operations across multiple Azure Storage services or service-level operations; it solves a different administrative need.
Answer B is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. In the tailspin needs a single case, this is not sufficient because one SAS must cover operations across multiple Azure Storage services or service-level operations; the capability addresses a neighboring use case.
Answer C is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. Applied to the tailspin needs a single case, this does not provide the required behavior because one SAS must cover operations across multiple Azure Storage services or service-level operations.
Question 17
Woodgrove needs delegated access to a storage service-level operation in addition to data operations across services. Which SAS type should it use? Choose ONE.
- Create an account SAS with only the required services, resource types, and permissions
- Create a service SAS for the required storage service resource
- Associate a service SAS with a stored access policy
- Create a user delegation SAS using Microsoft Entra credentials
Correct Answer: A
Correct Answer
Answer A is correct because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. Applied to the woodgrove needs delegated access case, the capability meets the requirement that one SAS must cover operations across multiple Azure Storage services or service-level operations without adding unrelated scope.
Incorrect Answers
Answer B is incorrect because A service SAS delegates access within one Azure Storage service and is signed with a storage account key; it can be associated with a stored access policy. The the woodgrove needs delegated access case scenario instead requires that one SAS must cover operations across multiple Azure Storage services or service-level operations, so this option would leave the key requirement unresolved.
Answer C is incorrect because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. For the woodgrove needs delegated access case, that does not satisfy the requirement that one SAS must cover operations across multiple Azure Storage services or service-level operations; it solves a different administrative need.
Answer D is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. In the woodgrove needs delegated access case, this is not sufficient because one SAS must cover operations across multiple Azure Storage services or service-level operations; the capability addresses a neighboring use case.
Question 18
Proseware has multiple service SAS tokens for a container and wants to revoke or change their shared expiry without regenerating the account key. What should it configure? Choose ONE.
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
- Associate a service SAS with a stored access policy
- Create a user delegation SAS using Microsoft Entra credentials
- Create an account SAS with only the required services, resource types, and permissions
Correct Answer: B
Correct Answer
Answer B is correct because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. For Proseware, that directly satisfies the requirement that the organization needs centrally changeable constraints and revocation for one or more service SAS tokens.
Incorrect Answers
Answer A is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. Applied to Proseware, this does not provide the required behavior because the organization needs centrally changeable constraints and revocation for one or more service SAS tokens.
Answer C is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. In Proseware, this is not sufficient because the organization needs centrally changeable constraints and revocation for one or more service SAS tokens; the capability addresses a neighboring use case.
Answer D is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. The Proseware scenario instead requires that the organization needs centrally changeable constraints and revocation for one or more service SAS tokens, so this option would leave the key requirement unresolved.
Question 19
Litware wants several service SAS tokens to inherit permissions and expiry from one centrally managed definition. Which feature should it use? Choose ONE.
- Create an account SAS with only the required services, resource types, and permissions
- Create a user delegation SAS using Microsoft Entra credentials
- Associate a service SAS with a stored access policy
- Issue a narrowly scoped SAS with a short expiration and a revocation plan
Correct Answer: C
Correct Answer
Answer C is correct because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. In Litware, this is the best fit because the organization needs centrally changeable constraints and revocation for one or more service SAS tokens.
Incorrect Answers
Answer A is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. Applied to Litware, this does not provide the required behavior because the organization needs centrally changeable constraints and revocation for one or more service SAS tokens.
Answer B is incorrect because Microsoft recommends user delegation SAS when possible because it is authorized with Microsoft Entra credentials instead of a storage account key. For Litware, that does not satisfy the requirement that the organization needs centrally changeable constraints and revocation for one or more service SAS tokens; it solves a different administrative need.
Answer D is incorrect because A SAS is a bearer credential, so minimizing permissions and validity reduces exposure if it is leaked and makes emergency response more manageable. The Litware scenario instead requires that the organization needs centrally changeable constraints and revocation for one or more service SAS tokens, so this option would leave the key requirement unresolved.
Question 20
An organization uses service SAS tokens for a blob container and wants centralized expiry control plus encrypted transport. Which TWO practices should it use? Choose TWO.
- Create an account SAS with only the required services, resource types, and permissions
- Associate a service SAS with a stored access policy
- Add a storage firewall IP network rule for the client public IP range
- Use the two storage account keys to rotate one key at a time and update clients before regenerating the other
- Require HTTPS when distributing and using the SAS
Correct Answers: B, E
Correct Answers
Answer B is correct because Stored access policies can centrally control start time, expiry, and permissions for service SAS tokens and provide a revocation mechanism; they do not apply to account or user delegation SAS. The the an organization uses service case scenario specifically requires that a stored access policy can control service SAS constraints and HTTPS protects the bearer token in transit, so this choice matches the intended behavior.
Answer E is correct because Using HTTPS protects the SAS bearer token from disclosure in transit; sending a SAS over cleartext HTTP can expose the credential to interception. Applied to the an organization uses service case, the capability meets the requirement that a stored access policy can control service SAS constraints and HTTPS protects the bearer token in transit without adding unrelated scope.
Incorrect Answers
Answer A is incorrect because An account SAS can delegate access across multiple storage services and service-level operations, and it is signed with a storage account key. For the an organization uses service case, that does not satisfy the requirement that a stored access policy can control service SAS constraints and HTTPS protects the bearer token in transit; it solves a different administrative need.
Answer C is incorrect because An IP network rule permits requests to the storage public endpoint from the specified public IPv4 range while other disallowed sources remain blocked. The the an organization uses service case scenario instead requires that a stored access policy can control service SAS constraints and HTTPS protects the bearer token in transit, so this option would leave the key requirement unresolved.
Answer D is incorrect because Two account keys support rotation without planned downtime when applications are switched to the alternate key before the old key is regenerated. In the an organization uses service case, this is not sufficient because a stored access policy can control service SAS constraints and HTTPS protects the bearer token in transit; the capability addresses a neighboring use case.
