Use these AZ-104 practice questions to review the Implement and manage storage objective domain for the Microsoft Azure Administrator exam. This set covers storage account redundancy, secure access, SAS tokens, blob tiers, lifecycle management, Azure Files, object replication, and data movement decisions.
These are original certification-style questions based on public Microsoft exam objectives and official Azure documentation. They are designed to feel realistic and exam-like without copying, paraphrasing, or reconstructing real exam-dump content.
AZ-104 Questions 11-20: Azure storage practice
For each question, choose the best answer, then review the explanation and distractor analysis. AZ-104 storage questions often hide the key requirement in one phrase: regional disaster, read access during failover, temporary delegated access, private endpoint, or archive retrieval latency.
Question 11: Choosing redundancy for zone resiliency
Scenario: A company stores production application logs in a general-purpose v2 storage account. The data must remain available if a single Azure availability zone in the primary region is unavailable. The company does not require replication to another Azure region.
Choose one answer.
- Locally redundant storage (LRS)
- Zone-redundant storage (ZRS)
- Geo-redundant storage (GRS)
- Read-access geo-redundant storage (RA-GRS)
Correct answer: B — Zone-redundant storage (ZRS)
Explanation: ZRS synchronously replicates data across three Azure availability zones in the primary region. That matches the requirement to tolerate a zone outage without adding cross-region replication.
Why the other options are wrong
- A. LRS keeps multiple copies in a single datacenter in the primary region, so it does not provide availability-zone resilience.
- C. GRS adds asynchronous replication to a secondary region, which is more than the stated requirement.
- D. RA-GRS provides read access to the secondary region, but the scenario specifically says cross-region replication is not required.
Official reference: Azure Storage redundancy
Question 12: Read access during a regional outage
Scenario: A reporting application reads monthly export files from Azure Blob Storage. The business requires the files to be readable from a secondary Azure region if the primary region becomes unavailable, even before Microsoft initiates account failover.
Choose one answer.
- Convert the account to LRS
- Use premium locally redundant block blobs
- Configure RA-GRS or RA-GZRS
- Enable blob soft delete
Correct answer: C — Configure RA-GRS or RA-GZRS
Explanation: Read-access geo-redundant options expose a secondary endpoint that can be used for read operations when the primary region is unavailable. RA-GRS provides read access to geo-replicated data; RA-GZRS combines zone redundancy in the primary region with read-access geo-replication.
Why the other options are wrong
- A. LRS has no secondary region.
- B. Premium locally redundant storage optimizes performance, not cross-region read availability.
- D. Soft delete helps recover deleted blobs; it does not provide a readable secondary region.
Official reference: Read access to data in the secondary region
Question 13: Temporary delegated access to a single container
Scenario: A vendor must upload files to one blob container for the next 48 hours. The vendor should not receive the storage account key, and access must expire automatically. The vendor does not have a Microsoft Entra account in the tenant.
Choose one answer.
- Create a shared access signature (SAS) for the container with write permissions and an expiry time
- Give the vendor the storage account access key and rotate it after 48 hours
- Assign the vendor the Owner role on the resource group
- Enable blob versioning on the container
Correct answer: A — Create a SAS for the container with write permissions and an expiry time
Explanation: A SAS grants delegated access to Azure Storage resources with specified permissions, scope, and expiration. It is appropriate when a temporary external party needs limited access without receiving account keys.
Why the other options are wrong
- B. Account keys grant broad access and are a poor fit for limited delegated access.
- C. Owner on the resource group is far too permissive and controls Azure management-plane access, not just data upload to one container.
- D. Blob versioning preserves previous blob versions; it does not grant upload access.
Official reference: Shared access signatures overview
Question 14: Restricting storage access to a virtual network
Scenario: An administrator must ensure that a storage account can be accessed only from workloads in a specific Azure virtual network subnet. Public internet access should not be used for application traffic to the storage account.
Choose one answer.
- Create an Azure DNS private zone only
- Configure a private endpoint for the storage account and use private DNS
- Enable anonymous blob access at the account level
- Create a stored access policy for the container
Correct answer: B — Configure a private endpoint for the storage account and use private DNS
Explanation: A private endpoint exposes the storage service through a private IP address in the virtual network. Private DNS helps clients resolve the storage account name to that private endpoint instead of the public endpoint.
Why the other options are wrong
- A. DNS alone does not create a private network path to the storage account.
- C. Anonymous access weakens security and does not restrict access to the virtual network.
- D. Stored access policies help manage SAS constraints; they do not provide private network connectivity.
Official reference: Connect privately to a storage account using Azure Private Endpoint
Question 15: Replicating blobs between storage accounts
Scenario: A company needs newly created block blobs in a source storage account to be copied automatically to a destination storage account in another region. The solution should support a policy-based replication configuration for selected containers.
Choose one answer.
- Configure Azure Blob Storage object replication
- Enable blob soft delete only
- Enable infrastructure encryption
- Use Azure Files sync groups
Correct answer: A — Configure Azure Blob Storage object replication
Explanation: Object replication asynchronously copies block blobs from a source storage account to a destination account based on replication rules. It is designed for scenarios that need blob copies across accounts or regions.
Why the other options are wrong
- B. Soft delete protects against accidental deletion; it does not copy blobs to another account.
- C. Infrastructure encryption adds another layer of encryption, not replication.
- D. Azure File Sync synchronizes Azure file shares with Windows Server locations, not blob containers between storage accounts.
Official reference: Object replication for block blobs
Question 16: Selecting a tier for rarely accessed data with immediate retrieval
Scenario: Audit files are rarely read after the first month, but auditors may request them without advance notice. The company wants lower storage cost than hot tier, but retrieval should remain online and immediate.
Choose one answer.
- Hot tier
- Cool or cold tier
- Archive tier
- Premium page blob storage
Correct answer: B — Cool or cold tier
Explanation: Cool and cold tiers are online tiers for infrequently accessed data. They reduce storage cost compared with hot tier while keeping data immediately available. The exact choice depends on expected retention and access patterns.
Why the other options are wrong
- A. Hot tier is optimized for frequently accessed data and has higher storage costs.
- C. Archive tier is offline and requires rehydration before data can be read, so it does not meet immediate retrieval.
- D. Premium page blobs are for high-performance page blob workloads, not cost-optimized audit archives.
Official reference: Access tiers for blob data
Question 17: Automatically moving older blobs to cooler storage
Scenario: A storage account contains diagnostic logs. Logs should remain in the hot tier for 30 days, move to a cooler tier after that, and be deleted after 365 days. The process should run automatically without a scheduled script.
Choose one answer.
- Create an Azure Blob Storage lifecycle management policy
- Create an Azure Monitor action group
- Enable Microsoft Defender for Storage
- Use a read-access geo-redundant storage account
Correct answer: A — Create an Azure Blob Storage lifecycle management policy
Explanation: Lifecycle management policies can automatically transition blobs to cooler tiers or delete blobs based on conditions such as age, last modified time, and filters. This matches the requirement without custom automation.
Why the other options are wrong
- B. Action groups notify or trigger actions from alerts; they do not manage blob tier transitions and expiration by themselves.
- C. Defender for Storage provides threat protection, not lifecycle tiering.
- D. RA-GRS provides secondary-region read access; it does not implement age-based deletion or tier movement.
Official reference: Azure Blob Storage lifecycle management
Question 18: Using existing AD DS identities for Azure file shares
Scenario: A company is migrating departmental file shares to Azure Files. Users sign in to domain-joined Windows devices with existing on-premises Active Directory Domain Services accounts. The company wants identity-based SMB access using those existing AD DS identities.
Choose one answer.
- Enable identity-based authentication for Azure Files with AD DS
- Enable anonymous access on the storage account
- Create one account-level SAS and distribute it to all users
- Use Azure Blob lifecycle management
Correct answer: A — Enable identity-based authentication for Azure Files with AD DS
Explanation: Azure Files supports identity-based authentication for SMB file shares using Active Directory Domain Services, Microsoft Entra Kerberos for hybrid identities, and Microsoft Entra Domain Services scenarios. For existing AD DS users, AD DS authentication is the exam-relevant fit.
Why the other options are wrong
- B. Anonymous access is not appropriate for SMB file-share identity control.
- C. A shared SAS does not provide per-user identity-based authorization and is difficult to govern for many users.
- D. Lifecycle management applies to blob data management, not SMB identity authentication.
Official reference: Azure Files identity-based authentication options
Question 19: Copying a large directory tree to Blob Storage from a command line
Scenario: An administrator needs to upload a large folder hierarchy from an on-premises server to a blob container. The transfer must preserve the folder structure and be repeatable from a command-line script.
Choose one answer.
- Use AzCopy with a recursive copy command
- Use Azure Resource Manager tags
- Create a management group
- Enable immutable blob storage
Correct answer: A — Use AzCopy with a recursive copy command
Explanation: AzCopy is Microsoft’s command-line utility for copying blobs or files to and from Azure Storage. Recursive copy is appropriate for uploading a folder hierarchy to a blob container in a repeatable script.
Why the other options are wrong
- B. Tags help organize and govern Azure resources; they do not transfer files.
- C. Management groups organize subscriptions for governance.
- D. Immutable storage helps protect data from modification or deletion; it is not a transfer tool.
Official reference: Get started with AzCopy
Question 20: Recovering from accidental blob deletion
Scenario: A team occasionally deletes blobs by mistake. Administrators need the ability to recover deleted blobs for a defined retention period. The solution should not require restoring the entire storage account.
Choose one answer.
- Enable blob soft delete and configure the retention period
- Change the redundancy option to LRS
- Disable secure transfer required
- Create a new storage account access key
Correct answer: A — Enable blob soft delete and configure the retention period
Explanation: Blob soft delete protects individual blobs from accidental deletion by retaining deleted data for a configured period. Administrators can restore deleted blobs during that retention window.
Why the other options are wrong
- B. Redundancy protects against infrastructure failures, not user deletion by itself.
- C. Disabling secure transfer weakens transport security and does not recover deleted data.
- D. Rotating or creating account keys changes authentication material; it does not provide deletion recovery.
Official reference: Soft delete for blobs
Answer key: AZ-104 Questions 11-20
| Question | Correct answer | Objective cue |
|---|---|---|
| 11 | B — ZRS | Zone resiliency in the primary region |
| 12 | C — RA-GRS or RA-GZRS | Read access from a secondary region |
| 13 | A — Container SAS | Temporary delegated upload without account keys |
| 14 | B — Private endpoint and private DNS | Private VNet path to Azure Storage |
| 15 | A — Object replication | Policy-based blob replication between accounts |
| 16 | B — Cool or cold tier | Infrequent access with online retrieval |
| 17 | A — Lifecycle management policy | Automated tiering and deletion by age |
| 18 | A — AD DS identity-based authentication for Azure Files | SMB access using existing domain identities |
| 19 | A — AzCopy recursive copy | Scripted bulk transfer to Blob Storage |
| 20 | A — Blob soft delete | Recover accidentally deleted blobs |
Sources
- Microsoft AZ-104 study guide: Microsoft Azure Administrator
- Azure storage account overview
- Azure Storage redundancy
- Shared access signatures overview
- Private endpoints for Azure Storage
- Object replication for block blobs
- Access tiers for blob data
- Azure Blob Storage lifecycle management
- Azure Files identity-based authentication options
- Get started with AzCopy
- Soft delete for blobs