You have an Azure subscription that contains the resources shown in the following table.You need to perform the tasks shown in the following table.Which tasks can you perform by using Azure Storage Explorer?
Answer(s): D
Task2Upload blobs to the containerBlob storage supports block blobs, append blobs, and page blobs. VHD files used to back IaaS VMs are page blobs. Append blobs are used for logging, such as when you want to write to a file and then keep adding moreinformation. Most files stored in Blob storage are block blobs.On the container ribbon, select Upload. This operation gives you the option to upload a folder or a file.Choose the files or folder to upload. Select the blob type. Acceptable choices are Append, Page, or Block blob. Etc.* Task3The following steps illustrate how to create a file share within Storage Explorer.1. Open Storage Explorer.2. In the left pane, expand the storage account within which you wish to create the file share.Right-click File Shares, and - from the context menu - select Create File Share.Incorrect:* Task1You can create a storage account using the Azure portal, Azure PowerShell, Azure CLI, or an Azure Resource Manager template. You cannot create a storage account in Azure Storage Explorer.
https://learn.microsoft.com/en-us/azure/storage/blobs/quickstart-storage-explorer https://learn.microsoft.com/en-us/azure/vs-azure-tools-storage-explorer-files
You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:You plan to use the Azure Import/Export service to export data from Subscription1. You need to identify which storage account can be used to export the data.What should you identify?
Azure Import/Export service supports the following of storage accounts:Standard General Purpose v2 storage accounts (recommended for most scenarios) Blob Storage accountsGeneral Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),Azure Import/Export service supports the following storage types: Import supports Azure Blob storage and Azure File storage Export supports Azure Blob storage
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements
HOTSPOT (Drag and Drop is not supported)You have Azure Storage accounts as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: storageaccount1 and storageaccount2 only Box 2: All the storage accountsNote: The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose v1 (GPv1) accounts, and Blob storage accounts.General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs, files, queues, and tables.Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only block blobs.General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the latest features or the lowest per gigabyte pricing.
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options
You have Azure subscription that includes data in following locations:You plan to export data by using Azure import/export job named Export1. You need to identify the data that can be exported by using Export1.Which data should you identify?
Answer(s): B
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra user named User1 and a read-access geo-redundant storage (RA-GRS) account named contoso2023.You need to meet the following requirements:User1 must be able to write blob data to contoso2023.The contoso2023 account must fail over to its secondary endpoint.Which two settings should you configure? To answer, select the appropriate settings in the answer area.NOTE: Each correct selection is worth one point.Hot Area:03CDC095F9FEFF732D90886CB388BC30
03CDC095F9FEFF732D90886CB388BC3003CDC095F9FEFF732D90886CB388BC30Box 1: Access control (IAM)User1 must be able to write blob data to contoso2023.Assign an Azure role for access to blob data (see step 4 below)MaySign in to the Azure portal.In the Search box at the top, search for the scope you want to grant access to. For example, search for Management groups, Subscriptions, Resource groups, or a specific resource.Click the specific resource for that scope. (Steps 1-3 already done)Click Access control (IAM).The following shows an example of the Access control (IAM) page for a resource group.Click the Role assignments tab to view the role assignments at this scope.Click Add > Add role assignment.7. Select the appropriate RoleNote: Azure Storage supports using Microsoft Entra ID to authorize requests to blob data. With Microsoft Entra ID, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, group, or application service principal. The security principal is authenticated by Microsoft Entra ID to return an OAuth 2.0 token. The token can then be used to authorize a request against the Blob service.Box 2: Geo-replicationThe contoso2023 account must fail over to its secondary endpoint.To initiate an account failover from the Azure portal, follow these steps (See step 3 below):4. Navigate to your storage account.Under Settings, select Geo-replication. The following image shows the geo-replication and failover status of a storage account.6. Verify that your storage account is configured for geo-redundant storage (GRS) or read-access geo- redundant storage (RA-GRS). If it's not, then select Configuration under Settings to update your account to be geo-redundant.7. Etc.
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal https://learn.microsoft.com/en-us/azure/storage/common/storage-initiate-account-failover
You have an Azure subscription that contains a storage account named storage1. You plan to create a blob container named container1.You need to use customer-managed key encryption for container1. Which key should you use?
Answer(s): E
Enable customer-managed keys for a storage accountThe key vault that stores the key must have both soft delete and purge protection enabled. Azure storage encryption supports RSA and RSA-HSM keys of sizes 2048, 3072 and 4096.
https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.User1 is assigned the following roles for storage1: Storage Blob Data ReaderStorage Table Data ContributorStorage File Data SMB Share ContributorFor storage1, you create a shared access signature (SAS) named SAS1 that has the settings shown in the following exhibit. (Click the Exhibit tab.)To which resources can User1 write by using SAS1 and key1? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: folder1 and Table1 only With key1.User1 is assigned the following roles for storage1: Storage Blob Data ReaderStorage Table Data ContributorStorage File Data SMB Share ContributorStorage Table Data ContributorAllows for read, write and delete access to Azure Storage tables and entities Can write to Table1Storage File Data SMB Share ContributorAllows for read, write, and delete access on files and directories in Azure file shares. Can write to folder1Box 2: Table1 and container1 only With SAS1.For key1 we see:Allowed services: Table only. Not File, so not folder1. Allowed resource types: Service, Container, Object. Allowed permissions: Read, write, etc.Note: How a shared access signature worksA shared access signature is a signed URI that points to one or more storage resources. The URI includes a token that contains a special set of query parameters. The token indicates how the resources may be accessed by the client. One of the query parameters, the signature, is constructed from the SAS parameters and signed with the key that was used to create the SAS. This signature is used by Azure Storage to authorize access to the storage resource.
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains the storage account shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphicNOTE: Each correct selection is worth one point.Hot Area:
Box 1: 3You can set a maximum of five access policies on a container, table, queue, or share at a time. Each SignedIdentifier field, with its unique Id field, corresponds to one access policy. Trying to set more than five access policies at one time causes the service to return status code 400 (Bad Request).Box 2: 1We see one unlocked Time-based retention container scoped immutable blob storage policy.Container-level scopeWhen support for version-level immutability policies has not been enabled for a storage account or a container, then any immutability policies are scoped to the container. A container supports one immutability policy and one legal hold. Policies apply to all objects within the container.
https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview
Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-104 content, but please register or login to continue.