AZ-104 Implement and Manage Storage Practice Questions

Free AZ-104 Implement and Manage Storage practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main AZ-104 page. Sign up free to practice the full set.

1. Question 1Implement and Manage Storage

   You need to grant a third-party application time-limited read access to a specific blob container without sharing account keys. What is the most secure approach?

   • ACreate a service SAS signed with the account key
   • BEnable anonymous public read access on the container
   • CCreate a user delegation SASCorrect
   • DShare the storage account access key
   ✓ Correct answer: C

   A user delegation SAS is the most secure type of shared access signature available in Azure Storage. Unlike a service SAS or account SAS that is signed with the storage account access key, a user delegation SAS is signed using Microsoft Entra ID (formerly Azure AD) credentials. This eliminates the risk of exposing the storage account key and provides better security because it can be scoped to specific containers or blobs, given time-limited access, and revoked by invalidating the user delegation key. Microsoft recommends using user delegation SAS whenever possible for Blob storage access scenarios.

   Why the other options are wrong

   • ACreating a service SAS signed with the account key is less secure because compromising the SAS could lead to exposure or misuse of the account key.
   • BEnabling anonymous public read access removes all authentication requirements and exposes the container data to anyone on the internet.
   • DSharing the storage account access key provides full unrestricted access to the entire storage account and cannot be time-limited or scoped.
2. Question 2Implement and Manage Storage

   Trey Research has a storage account named treyresearch1 in the West US region. They need to copy 500 GB of blob data from treyresearch1 to a new storage account named treyresearch2 in the East US region. The copy should be performed server-side without downloading data locally. You need to select the appropriate tool. What should you use?

   • APowerShell with the Get-AzStorageBlob and Set-AzStorageBlobContent cmdlets
   • BAzure Data Factory with a copy pipeline
   • CAzCopy with the azcopy copy command using a SAS token for both storage accountsCorrect
   • DAzure Storage Explorer's download and re-upload feature
   ✓ Correct answer: C

   AzCopy is the recommended tool for performing server-side copy operations between Azure storage accounts. When you use the azcopy copy command with SAS tokens for both the source and destination storage accounts, the data is transferred directly between the storage services on the Azure backbone network without being downloaded to the local machine. This is highly efficient for large datasets like 500 GB and works across regions. AzCopy supports parallel transfers, automatic retries, and resumable operations, making it ideal for cross-region blob data migration.

   Why the other options are wrong

   • APowerShell with Get-AzStorageBlob and Set-AzStorageBlobContent would download blobs to the local machine and re-upload them, which is not a server-side transfer.
   • BAzure Data Factory with a copy pipeline can perform server-side copies but introduces unnecessary complexity for a straightforward blob-to-blob copy scenario where AzCopy is the most direct tool.
   • DAzure Storage Explorer's download and re-upload feature explicitly routes data through the local machine, which does not meet the server-side transfer requirement.
3. Question 3Implement and Manage Storage

   You can use AzCopy to copy data between two Azure storage accounts directly without downloading the data to a local machine first.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   AzCopy supports server-side copy operations between Azure Storage accounts, meaning the data is transferred directly between the Azure storage servers without being downloaded to and re-uploaded from the local machine. When you use AzCopy to copy data from one storage account to another, the operation leverages the Azure backbone network for the transfer, which is significantly faster and more efficient than routing data through a local machine. This server-to-server copy is particularly beneficial for large data transfers between storage accounts, as it avoids consuming local bandwidth and eliminates the local machine as a bottleneck. AzCopy uses the Put Block From URL and Put Blob From URL APIs to facilitate these direct server-side transfers. This is confirmed by Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: AzCopy supports server-side copy operations between Azure Storage accounts, meaning the data is transferred directly between the Azure storage servers without being downloaded to and re-uploaded from the local machine.
4. Question 4Implement and Manage Storage

   Relecloud is using Azure Blob Storage with soft delete enabled for blobs with a retention period of 14 days. A developer accidentally overwrites an important blob. How can they recover the previous version?

   • ASubmit a support ticket to Microsoft support to recover the overwritten blob
   • BRestore the blob from its soft-deleted snapshot within the retention windowCorrect
   • CUse the Change Feed log to try to replay the original blob data
   • DRecover the overwritten blob from an Azure Backup vault
   ✓ Correct answer: B

   When soft delete is enabled for blobs, Azure Storage retains the previous version of a blob as a soft-deleted snapshot when it is overwritten. Within the configured retention period of 14 days, you can view and restore these soft-deleted snapshots to recover the previous blob content. The restore operation can be performed through the Azure portal, Azure CLI, PowerShell, or the REST API by undeleting the soft-deleted snapshot and promoting it.

   Why the other options are wrong

   • ASubmitting a support ticket to Microsoft to recover the blob is unnecessary because soft delete provides self-service recovery capabilities directly to the storage account owner.
   • CUsing the Change Feed to replay the original blob data is incorrect because the Change Feed records a log of changes to blobs but does not store the actual blob content needed for recovery.
   • DRecovering the blob from Azure Backup vault would require Azure Backup for blobs to be separately configured and is not the same feature as blob soft delete.
5. Question 5Implement and Manage StorageSelect all that apply

   You need to configure Azure Backup for a set of Azure VMs. The backup policy must retain daily backups for 30 days and monthly backups for 12 months. Which two components must you configure? (Choose two.)

   • AA backup policy with daily and monthly retention settingsCorrect
   • BA storage account for storing backup data
   • CAzure Site Recovery for each VM
   • DA Recovery Services vault in the same region as the VMsCorrect
   ✓ Correct answer: A, D

   Azure Backup for virtual machines requires two primary components: a Recovery Services vault to store and manage backup data, and a backup policy that defines the schedule and retention rules. The Recovery Services vault must be in the same region as the VMs being backed up. The backup policy is configured within the vault and specifies how often backups occur (daily) and how long they are retained (30 days for daily, 12 months for monthly in this scenario).

   Why the other options are wrong

   • BA separate storage account is not needed because the Recovery Services vault manages its own internal storage for backup data.
   • CAzure Site Recovery is a disaster recovery service for replicating VMs to a secondary region and is not used for backup retention policies.
6. Question 6Implement and Manage Storage

   You need to ensure all production VMs meet the following requirements: Premium SSD OS disk, backup enabled, and at least one data disk. Which VMs meet ALL the requirements?

   • AVM-File
   • BVM-SQLCorrect
   • CVM-Test
   • DVM-App
   ✓ Correct answer: B

   To meet all three production requirements, a VM must have a Premium SSD OS disk, backup enabled, and at least one data disk attached. Only VM-SQL satisfies every requirement: it uses a Premium SSD for its OS disk, has Azure Backup configured, and has one or more data disks attached. All other VMs fail to meet at least one of these criteria.

   Why the other options are wrong

   • AVM-File uses a Standard SSD for its OS disk rather than Premium SSD and does not have backup enabled, failing two of the three requirements.
   • CVM-Test uses a Standard HDD for its OS disk and does not have backup enabled, failing two of the three requirements.
   • DVM-App has a Premium SSD OS disk and backup enabled but does not have any data disks attached, failing one of the three requirements.
7. Question 7Implement and Manage Storage

   You have the blob lifecycle management rules shown in the table. A blob named logs/app-2024-01.log was last modified 100 days ago. What is the current tier of this blob?

   • AHot
   • BCool
   • CArchiveCorrect
   • DThe blob has been deleted
   ✓ Correct answer: C

   Lifecycle rules transition a blob through tiers based on days since last modification, and the rules apply cumulatively as the blob ages. With the blob last modified 100 days ago, it has passed every transition threshold up to and including the move to the Archive tier (for example, to Cool after a number of days, then to Archive after a later threshold under 100 days) but has not yet reached any deletion threshold. The blob therefore currently resides in the Archive tier. Evaluating each rule's day count against the 100-day age yields Archive as the result.

   Why the other options are wrong

   • AHot is the starting tier, but after 100 days the cooling transitions have already moved the blob beyond Hot.
   • BCool is an intermediate tier the blob passed through; by 100 days it has transitioned further to Archive.
   • DThe blob has not been deleted because 100 days has not reached the deletion threshold defined in the rules.
8. Question 8Implement and Manage Storage

   You attempt to configure Azure Backup for share-hr. What issue will you encounter?

   • ANo issue - the backup will be configured successfully
   • BThe vault must be in the same region as the storage accountCorrect
   • CAzure Files backup does not support daily schedules
   • DOnly one file share per storage account can ever be backed up
   ✓ Correct answer: B

   Azure Backup for Azure Files requires the Recovery Services vault and the storage account hosting the file share to reside in the same Azure region, because the backups are share snapshots managed by the co-located vault. In this table, share-hr lives in storageB (West US) while Vault-East is in East US, so this region mismatch causes the backup configuration to fail; you would need a vault in West US to protect share-hr.

   Why the other options are wrong

   • ANo issue - the backup will be configured successfully is wrong because the region mismatch between storageB (West US) and Vault-East (East US) prevents the backup from being configured for share-hr.
   • CAzure Files backup does not support daily schedules is wrong because Azure Files backup fully supports daily schedules, as shown by share-finance using a Daily 2 AM schedule successfully.
   • DOnly one file share per storage account can be backed up is wrong because Azure Backup can protect multiple file shares within the same storage account, so this is not a limitation that would block share-hr.

How Implement and Manage Storage is tested

This domain holds 195 of the 956 questions in the AZ-104 bank, about 20%. The mix is 108 single-answer multiple choice, 21 multiple-response, 21 yes/no scenario, 19 true/false, 16 hotspot and 10 ordering, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Implement and Manage Storage on its own rather than re-running full-length mocks.

Other AZ-104 exam domains

• Manage Azure Identities and Governance225 questions
• Deploy and Manage Azure Compute Resources200 questions
• Implement and Manage Virtual Networking194 questions
• Monitor and Maintain Azure Resources142 questions
• All AZ-104 practice questions956 total
• Implement and Manage Storage study notesKey concepts
• Microsoft practice examsAll Microsoft

AZ-104 Implement and Manage Storage FAQ