Pass Microsoft AZ-104 Exam in First Attempt Guaranteed!

Stored access policies can control supported service SAS permissions and timing and can be modified or removed to revoke linked SAS authorization. This matters here because a security audit finds a principal can list storage account keys despite having no blob data role.

Azure storage-account key listing is a management-plane action. A principal with listKeys rights can gain broad data access by acquiring the account key even without a Blob Data role; reduce that permission at the proper scope.

A shared access signature can constrain the resource, operations, and expiry. Distributing an account key would grant broader authority than the upload requires. This matters here because a security audit finds a principal can list storage account keys despite having no blob data role.

Static website hosting uses the storage account's static website setting and `$web` container. More replication alone does not configure a web endpoint or default index document.

ACR image artifact cleanup follows registry-specific policies and permissions, while Blob lifecycle rules target storage objects. This matters here because a development workload wants to serve a simple static HTML site directly from a storage account. Which service….

Inventory output follows the configured inclusion rules. Filters or version flags may exclude otherwise existing objects. This matters here because a development workload wants to serve a simple static HTML site directly from a storage account. Which service….

TLS protects network transport, while storage encryption protects persisted bytes. Each addresses a different exposure path. This matters here because a static website renders the landing page but refreshes of nested routes return not found.

Object replication requires supported account settings and correctly linked source and destination policies. A destination URL alone is insufficient. This matters here because a static website renders the landing page but refreshes of nested routes return not found.

Azure Storage encrypts data at rest automatically. Customer-managed keys are an additional key-governance option, not the base requirement for encryption. This matters here because a static website renders the landing page but refreshes of nested routes return not found.

A managed identity can access key-wrap or unwrap operations under a key vault RBAC or access policy model. Hard-coded secrets are unnecessary. This matters here because a storage account must retain its server-side encryption even when no customer-managed key is supplied. What is the….

Static hosting serves named objects rather than dynamically resolving every application route. Single-page applications often need suitable fallback behavior. This matters here because a storage account must retain its server-side encryption even when no customer-managed key is supplied. What is the….

Azure Storage uses server-side encryption with Microsoft-managed keys by default. CMK is optional key custody; removing it does not disable encryption at rest.

Key custody at rest and protocol encryption in transit are distinct. Keep an appropriate minimum TLS setting independent of whether data uses customer-managed or Microsoft-managed keys.

Storage redundancy governs replica placement and durability. The minimum TLS version and encryption at rest are different security controls that must be inspected separately.

A managed identity can access key-wrap or unwrap operations under a key vault RBAC or access policy model. Hard-coded secrets are unnecessary. This matters here because a reviewer confuses minimum TLS 1.2 with encryption at rest.

ARM resource visibility and blob content authorization can differ. An authenticated GUI still needs the correct data access. This matters here because a team wants to avoid accidental data exposure through anonymous public access but still permit authorized Entra….

Premium and standard storage account types expose different performance and tier options. A tier assumption from StorageV2 may not apply. This matters here because a team wants to avoid accidental data exposure through anonymous public access but still permit authorized Entra….

Anonymous access is controlled by account/container policy and authorization. Redundancy says nothing about public-read eligibility; disable anonymous public access and retain appropriate Entra data-role grants.

Page blobs expose range-based operations and are suited to certain virtual-disk-like workloads. Block blobs emphasize staged object uploads. This matters here because a blob dataset should preserve prior versions but delete old versions after 120 days to control storage growth. What….

Versioning keeps earlier committed versions when supported changes occur. It serves different recovery needs from simple soft delete. This matters here because a blob dataset should preserve prior versions but delete old versions after 120 days to control storage growth. What….

Blob versioning preserves previous versions; a lifecycle management rule can expire old versions after the required period. Soft-delete retention is a separate deletion recovery feature.

The Archive tier stores offline data at lower capacity cost with rehydration requirements. It is unsuitable for immediate reads. This matters here because the compliance team cannot find last quarter's blob version after lifecycle cleanup. What configuration should it check.

Blob versions have distinct identifiers. Ordinary reads without a version selector target the current committed blob. This matters here because the compliance team cannot find last quarter's blob version after lifecycle cleanup. What configuration should it check.

Lifecycle rules evaluate selected blob types and conditions asynchronously. Matching rules and supported tier transitions determine which objects move. This matters here because the compliance team cannot find last quarter's blob version after lifecycle cleanup. What configuration should it check.

A new share has a different quota and does not increase the quota on the full, actively used share. Adjust that share's limit within its account/tier constraints after confirming the requested capacity is supported.

Share snapshots preserve point-in-time share state for compatible recovery operations. They are not a full cross-region disaster recovery plan. This matters here because a file share has reached its configured capacity quota, though the storage account has free space.

Versioning keeps earlier committed versions when supported changes occur. It serves different recovery needs from simple soft delete. This matters here because a file share has reached its configured capacity quota, though the storage account has free space.

SMB traffic depends on TCP 445 reachability unless supported alternate network connectivity is used. Share permission changes cannot correct a network port block. This matters here because an SMB write fails with insufficient share space while account metrics show available capacity.

Creating a second share may leave clients writing to the original quota-limited share. Check the failing share's quota consumption and provisioned or performance tier limits before changing the storage configuration.

A Blob deletion safety setting does not alter an SMB share quota. Inspect that share's capacity limit and its supported provisioning/tier configuration.

Azure Files share quota does not enable a hierarchical namespace or POSIX-like directory ACLs for blobs. Those capabilities belong to an appropriately configured Azure Data Lake Storage Gen2 account.

An Azure Files SMB share does not provide the hierarchical namespace and POSIX-like ACL model expected by a data lake workload. Enable compatible Azure Data Lake Storage Gen2 hierarchical namespace for the Blob account instead.

A share may reach its own size ceiling before the containing account is full. Quota and tier limits govern available writes. This matters here because an analytics workspace needs directory-aware Blob Storage and POSIX-like ACLs without an SMB share. What feature….