Topic 05 Practice Test 2 covers Storage Accounts and Data Movement for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure and manage storage accounts. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Wingtip Toys needs storage copies spread across availability zones in the primary region and also replicated to a secondary region for regional disaster protection. Which redundancy option should it choose? Choose ONE.
- Use geo-zone-redundant storage (GZRS)
- Use zone-redundant storage (ZRS)
- Use geo-redundant storage (GRS)
- Use locally redundant storage (LRS)
Correct Answer: A
Correct Answer
Answer A is correct because GZRS combines synchronous zone redundancy in the primary region with asynchronous replication to a secondary region, protecting against both zone and regional failures. The capability is relevant to Wingtip Toys because the required outcome is: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Incorrect Answers
Answer B is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. For Wingtip Toys, however, that does not meet the stated requirement: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Answer C is incorrect because GRS keeps redundant copies in the primary region and asynchronously replicates data to a paired secondary region, but the secondary endpoint is not readable during normal operation. It misses the key condition in the Wingtip Toys case: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Answer D is incorrect because Wingtip Toys must satisfy this condition: the account needs zone resiliency in the primary region and asynchronous replication to a second region. LRS keeps multiple synchronous copies within one physical datacenter in the primary region, providing the lowest-cost redundancy but not protection from a datacenter-wide outage. This option is aimed at another design goal.
Question 2
- Datum requires both intra-region zone fault tolerance and geo-replication for the same storage account, but secondary reads are not required. Which setting fits? Choose ONE.
- Use zone-redundant storage (ZRS)
- Use geo-zone-redundant storage (GZRS)
- Use geo-redundant storage (GRS)
- Use locally redundant storage (LRS)
Correct Answer: B
Correct Answer
Answer B is correct because The scenario for A. Datum requires this result: the account needs zone resiliency in the primary region and asynchronous replication to a second region. GZRS combines synchronous zone redundancy in the primary region with asynchronous replication to a secondary region, protecting against both zone and regional failures. This directly addresses it.
Incorrect Answers
Answer A is incorrect because The required outcome for A. Datum is: the account needs zone resiliency in the primary region and asynchronous replication to a second region. ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. This capability does not satisfy that condition.
Answer C is incorrect because The requirement for A. Datum is: the account needs zone resiliency in the primary region and asynchronous replication to a second region. GRS keeps redundant copies in the primary region and asynchronously replicates data to a paired secondary region, but the secondary endpoint is not readable during normal operation. The option therefore targets a different Azure capability.
Answer D is incorrect because LRS keeps multiple synchronous copies within one physical datacenter in the primary region, providing the lowest-cost redundancy but not protection from a datacenter-wide outage. The mismatch for A. Datum is the stated requirement: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Question 3
Fourth Coffee wants synchronous replication across primary-region zones combined with asynchronous replication to a paired region. What should be configured? Choose ONE.
- Use zone-redundant storage (ZRS)
- Use geo-redundant storage (GRS)
- Use geo-zone-redundant storage (GZRS)
- Use locally redundant storage (LRS)
Correct Answer: C
Correct Answer
Answer C is correct because GZRS combines synchronous zone redundancy in the primary region with asynchronous replication to a secondary region, protecting against both zone and regional failures. It is the suitable choice for Fourth Coffee; the deciding requirement is: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Incorrect Answers
Answer A is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. The Fourth Coffee scenario instead calls for this outcome: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Answer B is incorrect because GRS keeps redundant copies in the primary region and asynchronously replicates data to a paired secondary region, but the secondary endpoint is not readable during normal operation. This would not resolve the stated requirement for Fourth Coffee: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Answer D is incorrect because In the Fourth Coffee case, the required result is: the account needs zone resiliency in the primary region and asynchronous replication to a second region. LRS keeps multiple synchronous copies within one physical datacenter in the primary region, providing the lowest-cost redundancy but not protection from a datacenter-wide outage. Selecting this would solve a neighboring problem instead.
Question 4
Lucerne Publishing is designing for both a primary-zone outage and a full regional outage. Which Azure Storage redundancy option combines those protections? Choose ONE.
- Use zone-redundant storage (ZRS)
- Use geo-redundant storage (GRS)
- Use locally redundant storage (LRS)
- Use geo-zone-redundant storage (GZRS)
Correct Answer: D
Correct Answer
Answer D is correct because For Lucerne Publishing, the required behavior is: the account needs zone resiliency in the primary region and asynchronous replication to a second region. GZRS combines synchronous zone redundancy in the primary region with asynchronous replication to a secondary region, protecting against both zone and regional failures. That is why this option fits.
Incorrect Answers
Answer A is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. That feature is valid Azure functionality, but The requirement for Lucerne Publishing is: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Answer B is incorrect because For Lucerne Publishing, the required behavior is: the account needs zone resiliency in the primary region and asynchronous replication to a second region. GRS keeps redundant copies in the primary region and asynchronously replicates data to a paired secondary region, but the secondary endpoint is not readable during normal operation. That is not the behavior this scenario calls for.
Answer C is incorrect because LRS keeps multiple synchronous copies within one physical datacenter in the primary region, providing the lowest-cost redundancy but not protection from a datacenter-wide outage. That does not line up with the stated constraint for Lucerne Publishing: the account needs zone resiliency in the primary region and asynchronous replication to a second region.
Question 5
Contoso cannot create an object replication policy between two blob accounts because required data-protection features are missing. What prerequisite configuration should it apply? Choose ONE.
- Enable change feed on the source and blob versioning on both accounts
- Configure Azure Blob object replication
- Use zone-redundant storage (ZRS)
- Configure a customer-managed key in Azure Key Vault or Managed HSM
Correct Answer: A
Correct Answer
Answer A is correct because Object replication requires the source account change feed and blob versioning on both the source and destination accounts before replication policies can operate. The technical fit for Contoso is direct because the requirement is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Incorrect Answers
Answer B is incorrect because For Contoso, the deciding constraint is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This solves a different operational need.
Answer C is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. Even though the feature can be useful, it does not provide The required outcome for Contoso: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Answer D is incorrect because The Contoso scenario is testing this requirement: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. This option does not provide that result.
Question 6
Fabrikam plans to replicate block blobs asynchronously between two storage accounts. Before adding replication rules, which feature combination must be enabled? Choose ONE.
- Configure Azure Blob object replication
- Enable change feed on the source and blob versioning on both accounts
- Use zone-redundant storage (ZRS)
- Configure a customer-managed key in Azure Key Vault or Managed HSM
Correct Answer: B
Correct Answer
Answer B is correct because Object replication requires the source account change feed and blob versioning on both the source and destination accounts before replication policies can operate. For Fabrikam, that directly matches the stated requirement: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Incorrect Answers
Answer A is incorrect because Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. It misses the key condition in the Fabrikam case: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Answer C is incorrect because Fabrikam must satisfy this condition: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. This option is aimed at another design goal.
Answer D is incorrect because Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. Fabrikam needs a different capability; the required result is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Question 7
Northwind Traders is preparing source and destination accounts for Blob object replication. Which prerequisite change is required by the service? Choose ONE.
- Configure Azure Blob object replication
- Use zone-redundant storage (ZRS)
- Enable change feed on the source and blob versioning on both accounts
- Configure a customer-managed key in Azure Key Vault or Managed HSM
Correct Answer: C
Correct Answer
Answer C is correct because The required outcome for Northwind Traders is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. Object replication requires the source account change feed and blob versioning on both the source and destination accounts before replication policies can operate. This option provides that capability.
Incorrect Answers
Answer A is incorrect because The requirement for Northwind Traders is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. The option therefore targets a different Azure capability.
Answer B is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. The mismatch for Northwind Traders is the stated requirement: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Answer D is incorrect because The Northwind Traders design calls for this outcome: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. This choice addresses another concern.
Question 8
Adventure Works has blob versioning enabled only on the source account and no change feed. What must it configure before object replication can work? Choose ONE.
- Configure Azure Blob object replication
- Use zone-redundant storage (ZRS)
- Configure a customer-managed key in Azure Key Vault or Managed HSM
- Enable change feed on the source and blob versioning on both accounts
Correct Answer: D
Correct Answer
Answer D is correct because Object replication requires the source account change feed and blob versioning on both the source and destination accounts before replication policies can operate. The deciding condition in The Adventure Works scenario is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. This option fits that condition.
Incorrect Answers
Answer A is incorrect because Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This would not resolve the stated requirement for Adventure Works: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Answer B is incorrect because In the Adventure Works case, the required result is: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication. ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. Selecting this would solve a neighboring problem instead.
Answer C is incorrect because Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. It is not the appropriate selection for Adventure Works; the scenario requires: the storage accounts must satisfy the mandatory prerequisites for Azure Blob object replication.
Question 9
Tailspin Toys has a compliance requirement to own and rotate the key that protects an Azure Storage account. The key must reside in an Azure-managed key store. What should be configured? Choose ONE.
- Configure a customer-managed key in Azure Key Vault or Managed HSM
- Keep the default Microsoft-managed encryption keys
- Enable infrastructure encryption on the storage account
- Use zone-redundant storage (ZRS)
Correct Answer: A
Correct Answer
Answer A is correct because The key requirement for Tailspin Toys is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity.
Incorrect Answers
Answer B is incorrect because For Tailspin Toys, the required behavior is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. That is not the behavior this scenario calls for.
Answer C is incorrect because Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers. That does not line up with the stated constraint for Tailspin Toys: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Answer D is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. For Tailspin Toys, however, that does not meet the stated requirement: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Question 10
Woodgrove Bank requires the storage encryption root protection to depend on a key it controls in Key Vault instead of only Microsoft-managed keys. Which configuration meets the requirement? Choose ONE.
- Keep the default Microsoft-managed encryption keys
- Configure a customer-managed key in Azure Key Vault or Managed HSM
- Enable infrastructure encryption on the storage account
- Use zone-redundant storage (ZRS)
Correct Answer: B
Correct Answer
Answer B is correct because Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. This aligns with The Woodgrove Bank scenario, whose requirement is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Incorrect Answers
Answer A is incorrect because Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. Even though the feature can be useful, it does not provide The required outcome for Woodgrove Bank: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Answer C is incorrect because The Woodgrove Bank scenario is testing this requirement: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers. This option does not provide that result.
Answer D is incorrect because The required outcome for Woodgrove Bank is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. This capability does not satisfy that condition.
Question 11
Proseware must be able to revoke Azure Storage access to its encryption key through its own key-management process. What encryption choice should it implement? Choose ONE.
- Keep the default Microsoft-managed encryption keys
- Enable infrastructure encryption on the storage account
- Configure a customer-managed key in Azure Key Vault or Managed HSM
- Use zone-redundant storage (ZRS)
Correct Answer: C
Correct Answer
Answer C is correct because For Proseware, the technical constraint is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity.
Incorrect Answers
Answer A is incorrect because Proseware must satisfy this condition: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. This option is aimed at another design goal.
Answer B is incorrect because Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers. Proseware needs a different capability; the required result is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Answer D is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. The Proseware scenario instead calls for this outcome: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Question 12
Litware wants Azure Storage to use a managed identity to access an organization-controlled RSA key for account encryption. Which feature should be configured? Choose ONE.
- Keep the default Microsoft-managed encryption keys
- Enable infrastructure encryption on the storage account
- Use zone-redundant storage (ZRS)
- Configure a customer-managed key in Azure Key Vault or Managed HSM
Correct Answer: D
Correct Answer
Answer D is correct because The Litware scenario turns on this requirement: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. That makes this the appropriate choice.
Incorrect Answers
Answer A is incorrect because Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. The mismatch for Litware is the stated requirement: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Answer B is incorrect because The Litware design calls for this outcome: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store. Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers. This choice addresses another concern.
Answer C is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. That feature is valid Azure functionality, but The requirement for Litware is: the organization must control the key that protects the storage account encryption key and be able to govern that key in its own key store.
Question 13
Wingtip Toys must script a one-time transfer of several million blobs from one storage account to another. Which tool and operation is the best fit? Choose ONE.
- Use azcopy copy
- Use Microsoft Azure Storage Explorer
- Use azcopy sync
- Configure Azure Blob object replication
Correct Answer: A
Correct Answer
Answer A is correct because The AzCopy copy command performs high-performance transfers to, from, or between supported Azure Storage locations and is appropriate for one-time or scripted bulk copy operations. The capability is relevant to Wingtip Toys because the required outcome is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Incorrect Answers
Answer B is incorrect because In the Wingtip Toys case, the required result is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. Selecting this would solve a neighboring problem instead.
Answer C is incorrect because The AzCopy sync command compares source and destination state and replicates changes so a destination reflects a source, making it appropriate for supported synchronization scenarios. It is not the appropriate selection for Wingtip Toys; the scenario requires: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Answer D is incorrect because For Wingtip Toys, the deciding constraint is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This solves a different operational need.
Question 14
- Datum needs a command-line utility in an automation job to upload a large directory tree into Azure Blob Storage. Which option should the administrator use? Choose ONE.
- Use Microsoft Azure Storage Explorer
- Use azcopy copy
- Use azcopy sync
- Configure Azure Blob object replication
Correct Answer: B
Correct Answer
Answer B is correct because The scenario for A. Datum requires this result: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. The AzCopy copy command performs high-performance transfers to, from, or between supported Azure Storage locations and is appropriate for one-time or scripted bulk copy operations. This directly addresses it.
Incorrect Answers
Answer A is incorrect because Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. That does not line up with the stated constraint for A. Datum: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Answer C is incorrect because The AzCopy sync command compares source and destination state and replicates changes so a destination reflects a source, making it appropriate for supported synchronization scenarios. For A. Datum, however, that does not meet the stated requirement: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Answer D is incorrect because Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. It misses the key condition in the A. Datum case: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Question 15
Fourth Coffee wants to bulk copy Azure Storage data between accounts without building a custom application. Which supported command-line approach is appropriate? Choose ONE.
- Use Microsoft Azure Storage Explorer
- Use azcopy sync
- Use azcopy copy
- Configure Azure Blob object replication
Correct Answer: C
Correct Answer
Answer C is correct because The AzCopy copy command performs high-performance transfers to, from, or between supported Azure Storage locations and is appropriate for one-time or scripted bulk copy operations. It is the suitable choice for Fourth Coffee; the deciding requirement is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Incorrect Answers
Answer A is incorrect because The Fourth Coffee scenario is testing this requirement: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. This option does not provide that result.
Answer B is incorrect because The required outcome for Fourth Coffee is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. The AzCopy sync command compares source and destination state and replicates changes so a destination reflects a source, making it appropriate for supported synchronization scenarios. This capability does not satisfy that condition.
Answer D is incorrect because The requirement for Fourth Coffee is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. The option therefore targets a different Azure capability.
Question 16
Lucerne Publishing needs a repeatable CLI command to copy a large dataset from on-premises storage into an Azure storage account. What should it use? Choose ONE.
- Use Microsoft Azure Storage Explorer
- Use azcopy sync
- Configure Azure Blob object replication
- Use azcopy copy
Correct Answer: D
Correct Answer
Answer D is correct because For Lucerne Publishing, the required behavior is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations. The AzCopy copy command performs high-performance transfers to, from, or between supported Azure Storage locations and is appropriate for one-time or scripted bulk copy operations. That is why this option fits.
Incorrect Answers
Answer A is incorrect because Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. Lucerne Publishing needs a different capability; the required result is: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Answer B is incorrect because The AzCopy sync command compares source and destination state and replicates changes so a destination reflects a source, making it appropriate for supported synchronization scenarios. The Lucerne Publishing scenario instead calls for this outcome: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Answer C is incorrect because Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This would not resolve the stated requirement for Lucerne Publishing: a scripted high-performance one-time transfer must copy data between supported Azure Storage locations.
Question 17
Contoso is configuring object replication for block blobs. Which TWO data-protection features are mandatory prerequisites? Choose TWO.
- Enable change feed on the source storage account
- Use zone-redundant storage (ZRS)
- Enable blob versioning on both source and destination accounts
- Enable infrastructure encryption on the storage account
- Use Microsoft Azure Storage Explorer
Correct Answers: A, C
Correct Answers
Answer A is correct because Blob object replication depends on the source account change feed to discover ordered blob changes that must be replicated to the destination. The technical fit for Contoso is direct because the requirement is: change feed must be enabled on the source and blob versioning must be enabled on both source and destination.
Answer C is correct because Blob object replication requires blob versioning on both participating accounts so changes and prior versions can be tracked consistently during replication. This aligns with The Contoso scenario, whose requirement is: change feed must be enabled on the source and blob versioning must be enabled on both source and destination.
Incorrect Answers
Answer B is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. That feature is valid Azure functionality, but The requirement for Contoso is: change feed must be enabled on the source and blob versioning must be enabled on both source and destination.
Answer D is incorrect because For Contoso, the required behavior is: change feed must be enabled on the source and blob versioning must be enabled on both source and destination. Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers. That is not the behavior this scenario calls for.
Answer E is incorrect because Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. That does not line up with the stated constraint for Contoso: change feed must be enabled on the source and blob versioning must be enabled on both source and destination.
Question 18
Fabrikam wants an encryption design with organization-controlled key ownership and an additional independent encryption layer. Which TWO settings should it enable? Choose TWO.
- Keep the default Microsoft-managed encryption keys
- Configure a customer-managed key in Azure Key Vault or Managed HSM
- Use zone-redundant storage (ZRS)
- Enable infrastructure encryption on the storage account
- Configure Azure Blob object replication
Correct Answers: B, D
Correct Answers
Answer B is correct because Customer-managed keys let the organization control the key that protects the storage account encryption key; Azure Storage accesses the key through an authorized managed identity. For Fabrikam, that directly matches the stated requirement: the account must use a customer-managed key and infrastructure encryption.
Answer D is correct because For Fabrikam, the technical constraint is: the account must use a customer-managed key and infrastructure encryption. Infrastructure encryption adds a second encryption layer at the infrastructure level so data is encrypted twice with separate keys and encryption layers.
Incorrect Answers
Answer A is incorrect because For Fabrikam, the deciding constraint is: the account must use a customer-managed key and infrastructure encryption. Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. This solves a different operational need.
Answer C is incorrect because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. Even though the feature can be useful, it does not provide The required outcome for Fabrikam: the account must use a customer-managed key and infrastructure encryption.
Answer E is incorrect because The Fabrikam scenario is testing this requirement: the account must use a customer-managed key and infrastructure encryption. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This option does not provide that result.
Question 19
Northwind Traders is automating data transfer with AzCopy and does not want to place a reusable account key in the script. Which TWO authorization approaches are supported choices? Choose TWO.
- Authorize AzCopy by using Microsoft Entra ID
- Keep the default Microsoft-managed encryption keys
- Configure Azure Blob object replication
- Authorize AzCopy by appending a narrowly scoped SAS token
- Use Microsoft Azure Storage Explorer
Correct Answers: A, D
Correct Answers
Answer A is correct because The required outcome for Northwind Traders is: AzCopy can authenticate through Microsoft Entra ID or use a scoped SAS credential. AzCopy supports Microsoft Entra authorization for supported storage data operations, avoiding the need to append a reusable SAS token to every command. This option provides that capability.
Answer D is correct because The Northwind Traders scenario turns on this requirement: AzCopy can authenticate through Microsoft Entra ID or use a scoped SAS credential. AzCopy can use a SAS token on the source or destination URL; the SAS should grant only the permissions and lifetime required for the transfer. That makes this the appropriate choice.
Incorrect Answers
Answer B is incorrect because Azure Storage encrypts data at rest automatically, and Microsoft-managed keys are the default when the organization does not need direct ownership of key lifecycle and access controls. It misses the key condition in the Northwind Traders case: AzCopy can authenticate through Microsoft Entra ID or use a scoped SAS credential.
Answer C is incorrect because Northwind Traders must satisfy this condition: AzCopy can authenticate through Microsoft Entra ID or use a scoped SAS credential. Object replication asynchronously copies block blobs between a source and destination storage account according to replication rules and is intended for object-level replication scenarios. This option is aimed at another design goal.
Answer E is incorrect because Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. Northwind Traders needs a different capability; the required result is: AzCopy can authenticate through Microsoft Entra ID or use a scoped SAS credential.
Question 20
Adventure Works needs a storage design that survives an availability-zone failure and separately needs a graphical desktop tool for administrators to browse and upload storage data. Which TWO choices satisfy these requirements? Choose TWO.
- Use locally redundant storage (LRS)
- Use zone-redundant storage (ZRS)
- Use azcopy sync
- Use read-access geo-redundant storage (RA-GRS)
- Use Microsoft Azure Storage Explorer
Correct Answers: B, E
Correct Answers
Answer B is correct because ZRS synchronously copies data across three or more availability zones in the primary region, protecting the account from a zone or datacenter failure within that region. The deciding condition in The Adventure Works scenario is: ZRS supplies primary-region zone resiliency and Storage Explorer supplies the interactive graphical management experience. This option fits that condition.
Answer E is correct because Storage Explorer provides a graphical cross-platform management experience for storage accounts and data, making it suitable for interactive browsing, uploads, downloads, and storage administration. The capability is relevant to Adventure Works because the required outcome is: ZRS supplies primary-region zone resiliency and Storage Explorer supplies the interactive graphical management experience.
Incorrect Answers
Answer A is incorrect because The requirement for Adventure Works is: ZRS supplies primary-region zone resiliency and Storage Explorer supplies the interactive graphical management experience. LRS keeps multiple synchronous copies within one physical datacenter in the primary region, providing the lowest-cost redundancy but not protection from a datacenter-wide outage. The option therefore targets a different Azure capability.
Answer C is incorrect because The AzCopy sync command compares source and destination state and replicates changes so a destination reflects a source, making it appropriate for supported synchronization scenarios. The mismatch for Adventure Works is the stated requirement: ZRS supplies primary-region zone resiliency and Storage Explorer supplies the interactive graphical management experience.
Answer D is incorrect because The Adventure Works design calls for this outcome: ZRS supplies primary-region zone resiliency and Storage Explorer supplies the interactive graphical management experience. RA-GRS adds a readable secondary endpoint to geo-redundant replication, allowing applications to read from the secondary region without waiting for a failover. This choice addresses another concern.
