Configure Access to Storage AZ-104 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   You enable the Azure Storage firewall on a storage account and set the default action to 'Deny'. What is the effect of this configuration?

   • AAll requests from the internet are blocked unless they match an allow rule.
   • BAll requests are allowed except those from the specified IP ranges.
   • CRequests from the internet are allowed but require a SAS token.
   • DOnly requests from Azure services are allowed.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are a storage administrator for a large enterprise. You need to provide a SAS token to a partner application that will run for 6 months and needs to write to a specific container. You must be able to revoke the SAS token at any time without affecting other SAS tokens issued for the same container. What should you do?

   • AGenerate an account SAS with write permission and a 6-month expiry.
   • BGenerate a service SAS with write permission and a 6-month expiry directly on the container.
   • CGenerate a user delegation SAS with write permission and a 6-month expiry.
   • DCreate a stored access policy on the container with write permission and a 6-month expiry, then generate a SAS token that references the policy.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Your organization stores sensitive data in an Azure Storage account. A security audit requires that storage account keys be rotated every 90 days. You need to ensure that applications using the storage account continue to work during key rotation. What should you do?

   • AUpdate all applications to use the secondary key, then rotate the primary key, then update applications to use the new primary key.
   • BUse the secondary key in all applications, then rotate the primary key and update applications to use the new primary key.
   • CRegenerate the primary key, then update all applications to use the new key, then regenerate the secondary key.
   • DCreate a shared access signature with a long expiry and use it in all applications instead of keys.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   You have a SAS token that was generated for a blob with read and write permissions and an expiry time of 24 hours. What is the primary benefit of using this SAS token instead of sharing the storage account key?

   • AIt eliminates the need for authentication.
   • BIt limits access to the specific blob and time period.
   • CIt allows access to all storage services in the account.
   • DIt provides permanent access to the blob.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You need to provide a third-party vendor with temporary access to a specific blob in an Azure Storage account. The vendor must be able to read and write the blob for exactly 24 hours. You want to avoid sharing the storage account key. What should you do?

   • AGenerate a service SAS with read and write permissions, set the expiry to 24 hours from now, and share the SAS URL with the vendor.
   • BGenerate an account SAS with read and write permissions, set the expiry to 24 hours, and share the SAS URL with the vendor.
   • CShare the storage account key with the vendor and instruct them to use it to access the blob.
   • DCreate a stored access policy on the blob container, then generate a service SAS that references the policy, and share the SAS URL.
   Reveal Solution Discussion Select an answer first