Your company has an Azure Storage account that stores sensitive documents. You need to ensure that only virtual machines in a specific virtual network can access the storage account over the private IP address space. You have already configured a service endpoint for Microsoft.Storage on the subnet. What should you do next?

Add a rule to the storage account firewall to allow traffic from the virtual network and subnet.

Create a private endpoint for the storage account in the virtual network.

Assign the Storage Blob Data Reader role to the virtual network's managed identity.

Set the storage account's network access to 'Disabled' for all networks.

You have a stored access policy on a container. What is the effect of revoking the stored access policy?

Only the SAS tokens that have not yet been used become invalid.

All SAS tokens that reference the policy become invalid.

The storage account key is rotated.

Which Azure RBAC role can you assign to a user to grant them read access to an Azure Files share using identity-based access?

Storage File Data SMB Share Reader

A client application has a SAS token for a blob. What does the SAS token allow the client to do?

Access the blob only when the storage account firewall is disabled.

Access the blob for the permissions and duration specified in the token.

Access all blobs in the storage account indefinitely.

Access the blob only if the client has an Azure AD role assignment.

You have an Azure storage account that must be accessible only from a specific virtual network. You have already configured the storage firewall to deny all traffic. You now need to allow traffic from a subnet in that virtual network. What should you do?

Add the subnet's address range to the IP address rules in the storage account's networking blade.

Add the subnet to the virtual network rules in the storage account's networking blade.

Enable 'Allow trusted Microsoft services' to bypass the firewall for the subnet.

Create a private endpoint for the storage account and connect it to the subnet.

Microsoft Certified:Azure Administrator Associate

Domain 2Objective 1

Configure Access to Storage AZ-104 Practice Questions (Page 1)

Part of the Implement and manage storage domain, which accounts for 15–20% of the AZ-104 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 2–4 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

7concepts

15–20%of the exam

Questions 1–5

1application · medium
Your company has an Azure Storage account that stores sensitive documents. You need to ensure that only virtual machines in a specific virtual network can access the storage account over the private IP address space. You have already configured a service endpoint for Microsoft.Storage on the subnet. What should you do next?
Select an answer first
2foundation · easy
You have a stored access policy on a container. What is the effect of revoking the stored access policy?
Select an answer first
3foundation · easy
Which Azure RBAC role can you assign to a user to grant them read access to an Azure Files share using identity-based access?
Select an answer first
4foundation · easy
A client application has a SAS token for a blob. What does the SAS token allow the client to do?
Select an answer first
5application · medium
You have an Azure storage account that must be accessible only from a specific virtual network. You have already configured the storage firewall to deny all traffic. You now need to allow traffic from a subnet in that virtual network. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-104

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-104” is a trademark of its owner, used for identification only.