You have an Azure subscription that contains a storage account named storage1.You plan to use conditions when assigning role-based access control (RBAC) roles to storage1. Which storage1 services support conditions when assigning roles?
Answer(s): E
HOTSPOT (Drag and Drop is not supported)You have an Azure Storage account named storage1.You have an Azure App Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:Minimize the number of secrets used.Ensure that App2 can only read from storage1 for the next 30 days.What should you configure in storage1 for each app? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
App1: Access keysApp2: Shared access signature (SAS)A shared access signature (SAS) provides secure delegated access to resources in your storage account without compromising the security of your data. With a SAS, you have granular control over how a client can access your data. You can control what resources the client may access, what permissions they have on those resources, and how long the SAS is valid, among other parameters.
https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that has offices in the East US and West US Azure regions. You plan to create the storage account shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: PerformanceSelect Standard performance for general-purpose v2 storage accounts (default). This type of account is recommended by Microsoft for most scenarios.Select Premium for scenarios requiring low latency. Note: From Exhibit:Performance: Premium Endpoint type: Standard Location: eastusDefault routing tier: Microsoft network routing Network connectivity: Public endpoint (all networks)Incorrect:* Endpoint typeAzure Storage supports two types of endpoints: standard endpoints (the default) and Azure DNS zone endpoints (preview).Box 2: Enable customer-managed keysEnable customer-managed keys for a storage accountYou can switch between customer-managed keys and Microsoft-managed keys at any time.Note: When you configure customer-managed keys for a storage account, Azure Storage wraps the root data encryption key for the account with the customer-managed key in the associated key vault or managed HSM. The protection of the root encryption key changes, but the data in your Azure Storage account remains encrypted at all times. There is no additional action required on your part to ensure that your data remains encrypted. Protection by customer-managed keys takes effect immediately.Incorrect:Infrastructure encryptionThe infrastructure encryption setting for an encryption scope cannot be changed after the scope is created.Encryption type Reference:https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription.You plan to deploy a new storage account.You need to configure encryption for the account. The solution must meet the following requirements: Use a customer-managed key stored in a key vault.Use the maximum supported bit length.Which type of key and which bit length should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: RSABring your own key specificationKey Exchange Key: An HSM-backed key that customer generates in the key vault where the BYOK key will be imported. This KEK must have following properties:It’s an RSA-HSM key (4096-bit or 3072-bit or 2048-bit)It will have fixed key_ops (ONLY ‘import’), that will allow it to be used ONLY during BYOK Must be in the same vault where the Target Key will be importedNote: Bring Your Own Key (BYOK) Options: To utilize BYOK, the key being used on the cloud must first be imported the Cloud Service Provider, and to import the key, it must first be wrapped. Microsoft Azure takes an RSA key that is wrapped by AES and RSA-OAEP.Incorrect:* 3DESTriple DES with three independent keys (keying option 1) has a key length of 168 bits (three 56-bit DES keys), Box 2: 4096Note: Terminology
https://learn.microsoft.com/en-us/azure/key-vault/keys/byok-specification
You have an Azure Storage account that contains 5,000 blobs accessed by multiple users. You need to ensure that the users can view only specific blobs based on blob index tags. What should you include in the solution?
You have an Azure Storage account named storage1.For storage1, you create an encryption scope named Scope1. Which storage types can you encrypt by using Scope?
Answer(s): B
How encryption scopes work:By default, a storage account is encrypted with a key that is scoped to the entire storage account. When you define an encryption scope, you specify a key that may be scoped to a container or an individual blob. When the encryption scope is applied to a blob, the blob is encrypted with that key. When the encryption scope is applied to a container, it serves as the default scope for blobs in that container, so that all blobs that are uploaded to that container may be encrypted with the same key. The container can be configured to enforce the default encryption scope for all blobs in the container, or to permit an individual blob to be uploaded to the container with an encryption scope other than the default.
https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription.You plan to create a role definition to meet the following requirements:Users must be able to view the configuration data of a storage account. Users must be able to perform all actions on a virtual network.The solution must use the principle of least privilege.What should you include in the role definition for each requirement? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: "Microsoft.Network/virtualNetworks/*"Users must be able to perform all actions on a virtual network. All actions would imply use of *.Box 2: "Microsoft.Storage/StorageAcounts/read"Users must be able to view the configuration data of a storage account.Action: Microsoft.Storage/storageAccounts/readReturns the list of storage accounts or gets the properties for the specified storage account.
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
You have an Azure subscription named Subscription1.You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job.What can you use as the destination of the imported data?
Answer(s): C
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter.The maximum size of an Azure Files Resource of a file share is 5 TB. Note:There are several versions of this question in the exam. The question has two correct answers: Azure File StorageAzure Blob StorageThe question can have other incorrect answer options, including the following: Azure Data Lake StoreAzure SQL Database Azure Data Factory
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service
Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-104 content, but please register or login to continue.