Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

SSPR manages user password recovery and does not determine which authorization mechanism Blob Storage accepts. Disabling it would add risk without meeting the goal.

Annual key rotation reduces stale secret exposure but continues to permit requests signed with shared keys. It does not prohibit that authentication method.

Redundancy controls replication and durability. Geographic copies do not determine whether Shared Key requests are authorized.

LRS maintains local replicas in a single physical location within the primary region and is not designed to survive a full availability-zone failure.

GRS copies data to a paired secondary region in addition to primary-region local replication. Geographic replication exceeds the stated single-region requirement.

RA-GRS adds read access to the secondary geographic replica. It still involves a second region and is not the zone-only arrangement requested.

LRS has no geographically replicated secondary region to read. Switching from GRS to LRS would remove rather than enable secondary read capability.

Availability sets distribute VM failures within the compute infrastructure. They do not expose geo-replicated blob endpoints.

NSGs apply to eligible network interfaces/subnets rather than changing the storage replication mode. A network rule cannot create a secondary storage read endpoint.

A deletion lock protects management resources but is not the encryption key material or an at-rest encryption control. It cannot meet key-ownership requirements.

Removing network restrictions may expose data more broadly and does not change encryption key ownership. Network and encryption protections serve different purposes.

Owner is a broad control-plane role that does not establish customer-managed encryption. Granting it to all apps would undermine least privilege.

Advisor gives operational recommendations for resources and costs. It is not the file-transfer client for a large bulk data migration.

Bastion provides secure remote access to VMs and does not orchestrate direct bulk blob transfers. It would add an unnecessary compute hop.

Guest configuration evaluates machine compliance rather than transferring large file collections. It cannot replace a data migration utility.

Deployment slots manage staged web application versions, not copying blob objects to a secondary storage account. They do not define object replication.

Moving a resource group relocates its management grouping rather than maintaining an independently replicated object collection. It is not continuous object replication.

Cost alerts notify stakeholders about expenditure thresholds and do not copy storage data between accounts.

Republishing the compromised key extends the incident and increases the chance of unauthorized storage access. Rotation must remove exposed credentials from use.

Deleting the tenant would disrupt unrelated identity services and is not a proportionate secret-response procedure. The exposed credential is a storage account key.

Disabling encryption would reduce data protection and does not revoke a leaked access key. Key rotation is an authorization remediation, separate from encryption at rest.

VM scale sets manage compute instance capacity and do not retain earlier blob contents. They cannot roll back a storage object revision.

DNS alias records resolve names, not object history. Changing name resolution does not recover an overwritten blob.

A CanNotDelete management lock is not blob versioning or a record of prior blob bytes. It cannot reconstruct overwritten content by itself.

VM images restore compute machines and do not represent the blob's soft-deleted data. This action targets the wrong resource type.

Reusing a deleted object's name does not automatically reconstruct prior bytes. Recovery requires the actual retained deleted blob or version.

Disabling lifecycle rules is not the recovery operation and does not make deleted objects immortal. Retention windows still matter and must be respected.

Entra user objects control identity and are unrelated to automatic data-tier transitions. Creating one per blob would be unmanageable and would not lower storage tier cost.

NSGs apply to network interfaces and subnets, not individual blob data lifecycle decisions. A packet rule cannot change a blob's access tier.

VM backup policies protect compute workloads and disks. They do not directly configure Azure Blob Storage lifecycle tier transitions.

Blob index tags help categorize and query blob metadata. They do not expose a conventional SMB-mounted shared filesystem to Windows servers.

Container Registry stores and distributes OCI container images rather than presenting an SMB file share. It cannot satisfy the file path requirement.

A private DNS zone provides name resolution but does not host file content or implement SMB file operations. Name resolution complements a storage endpoint.