Implement and manage storage practice questions

Answer: A) Customer-managed keys

• ACustomer-managed keys in Key Vault give control over storage encryption keys.
• BMicrosoft-managed keys don't give the customer key control.
• CNSGs don't affect encryption.
• DAccess level doesn't control encryption keys.

Answer: A) A user delegation SAS with write permission on that blob and a short expiry

When Shared Key authorization is disabled, service SAS and account SAS requests are denied. A user delegation SAS, signed with Microsoft Entra credentials, still works and can grant narrowly scoped, time-limited access.

• ACorrect. A user delegation SAS is secured with Microsoft Entra credentials rather than the account key. It's supported for Blob Storage, and requests that use it are still permitted when Shared Key access is disallowed. It can be limited to one blob, write permission, and a short lifetime.
• BIncorrect. A service SAS is signed with the account key (Shared Key). When AllowSharedKeyAccess is false, requests that use a service SAS are denied, even if the SAS references a stored access policy.
• CIncorrect. An account SAS is also authorized with Shared Key, so requests that use it are denied when key access is disabled. It's also broader in scope than a single blob.
• DIncorrect. An Azure RBAC role assignment needs a security principal in the tenant, and the partner has none. It also doesn't produce a time-limited URL.

Answer: A) A service SAS for the container that references a stored access policy

A service SAS linked to a stored access policy can be limited to one container with write-only permissions and a fixed expiry. Changing or deleting the policy revokes just that grant, with no key regeneration.

• AA service SAS can be scoped to one container with only create/write permissions. If it's linked to a stored access policy, it takes its constraints from that policy, and you can revoke it by changing or deleting the policy, without regenerating account keys and without affecting other SAS tokens.
• BAn account SAS can't use a stored access policy, so the only way to revoke it early is to regenerate the account key that signed it. That also invalidates every other SAS signed with that key. An account SAS is also scoped to the account rather than to one container.
• CStorage Blob Data Contributor also grants read and delete permissions, which breaks the requirement that the partner can only upload.
• DAn account key grants full access to the whole storage account. The requirements explicitly forbid giving it to the partner, and revoking it early would affect every client that uses it.

Answer: A) A time-based retention policy set on each of the specific blob versions

Version-level immutability lets retention policies apply to individual blob versions, so only those versions are protected. A container-level policy would lock everything in the container.

• ACorrect. With version-level WORM enabled on the account or container, each blob version can have its own time-based retention policy (and legal hold), so only the chosen versions are protected.
• BIncorrect. A container-level WORM policy applies to every blob in the container, so the other blobs and versions would no longer be deletable.
• CIncorrect. Soft delete keeps deleted data recoverable for a period, but it doesn't stop deletes or overwrites, and the maximum retention is far below seven years.
• DIncorrect. Lifecycle rules change access tiers or delete data on a schedule. Archived blobs can still be deleted, so this gives no WORM protection.

Answer: A) Storage firewall: allow selected networks, add a virtual network rule and an IP network rule

The storage account firewall controls which networks can reach the public endpoint. Virtual network rules (for service-endpoint subnets) and IP network rules allow chosen sources, and all other traffic is denied.

• ACorrect. With network rules configured, only explicitly allowed sources can reach the public endpoint and all other traffic is denied. A virtual network rule allows the subnet, which needs a Microsoft.Storage service endpoint (the portal adds it automatically). An IP network rule allows the office's public IP range.
• BIncorrect. Network security groups filter traffic for subnets and network interfaces inside a virtual network. A storage account's public endpoint isn't something you associate an NSG with, so storage access is restricted with the storage firewall's network rules.
• CIncorrect. An IP restriction on a SAS token only limits that token. It doesn't block other networks from reaching the account with other credentials such as account keys or Microsoft Entra ID, and it doesn't change the account's network rules.
• DIncorrect. Locks only affect control-plane operations, and key rotation only limits how long a credential stays valid. Neither controls which networks can reach the storage endpoint.

Answer: A) A lifecycle management rule that deletes previous versions 90 days after creation

Lifecycle management can delete previous blob versions automatically once they reach a set age. Soft delete, disabling versioning, and immutability policies don't remove existing versions.

• ALifecycle management policies can delete previous versions of a blob at the end of their lifecycle based on age. Microsoft recommends this to control versioning costs.
• BSoft delete keeps deleted data recoverable for the retention period. It doesn't delete previous versions on its own, and versions you delete are kept until the retention period ends.
• CDisabling versioning doesn't delete existing versions; they stay in the account. It also breaks the requirement to keep versioning on.
• DImmutability policies stop objects from being modified or deleted. They don't remove anything, and the lifecycle delete action doesn't work on blobs in an immutable container.

Answer: A) Object replication, configured with replication rules from the source account/container to a destination account/container in the other region

• AObject replication asynchronously copies block blobs (and their versions) from a source to a destination account, giving lower read latency in the destination region and distributing load.
• BRA-GRS gives read access to Microsoft's chosen paired region only, not an arbitrary destination account/region you select, and it's account-wide rather than per-container.
• CLifecycle policies tier and delete blobs within an account; they don't replicate to another account.
• DFront Door is an application delivery/CDN service; it doesn't replicate stored blobs between accounts.

Answer: A) Azure Data Box

• AData Box is a rugged physical appliance shipped to your site to copy large datasets locally and then returned to Azure for import.
• BThe scenario states the online path would take months, which is the problem to avoid.
• CBackup is for recovery of existing Azure or on-premises workloads, not bulk initial data import.
• DTraffic Manager is DNS-based load balancing, unrelated to data transfer.

Answer: A) A time-based immutability (WORM) policy on the container, then lock the policy

• AA locked time-based retention policy enforces write-once-read-many: for the retention period the blobs can't be changed or deleted, even by an owner.
• BResource locks stop control-plane delete of the account, not modification or deletion of individual blobs' data.
• CSoft delete lets you recover deleted blobs; it doesn't prevent deletion or modification in the first place.
• DRA-GRS is about durability and read availability, not immutability.

Answer: A) Zone-redundant storage (ZRS)

• AZRS synchronously replicates across three availability zones in the primary region, so a single-zone failure doesn't interrupt read or write access.
• BLRS keeps all three copies in one datacenter, so a zone/datacenter failure takes the data offline.
• CGRS does protect against regional loss but the secondary is read-only unless you fail over, and within the primary region it's still LRS — a single-zone failure can disrupt it. It's also more than required.
• DSame primary-region limitation as GRS plus extra cross-region capability that isn't needed here.