Unit 4 - Practice Quiz

1 What is the primary function of an Azure Storage Account?

2 Azure Blob Storage is primarily designed to store what kind of data?

3 What does LRS stand for in the context of Azure Storage redundancy?

4 What is Azure Storage Explorer?

5 What is the primary purpose of a Shared Access Signature (SAS) in Azure Storage?

6 What are the two primary credentials provided with every Azure Storage Account for programmatic access?

7 Which redundancy option copies your data to a secondary region, hundreds of miles away from the primary region, to protect against regional outages?

8 In Azure Blob Storage, what is the name for a directory-like structure that is used to group a set of blobs?

9 What is the main role of a Recovery Services vault in Azure?

10 Which of the following must be globally unique across all of Azure?

11 Which redundancy option protects against a datacenter-level failure by synchronously replicating data across three different datacenters (Availability Zones) within a single region?

12 A SAS token is appended to a URI. What does it consist of?

13 If a storage account's access key is compromised, what is the recommended immediate security action?

14 Which of the following is a valid type of blob in Azure Blob Storage?

15 Which of the following tasks can be performed using Azure Storage Explorer?

16 What are the two main performance tiers available for Azure Storage Accounts?

17 When creating a SAS, which of the following can you specify to limit its use?

18 Which Azure Storage redundancy option is generally the lowest-cost?

19 A single file, such as a JPEG image, that is uploaded to a container in Azure Blob Storage is referred to as a what?

20 What modern authorization method is recommended by Microsoft over using shared account keys for securing Azure Storage?

21 A company is planning to store virtual machine disks (VHDs) for their IaaS VMs and also host a static website with high transaction rates. They want to use a single storage account for both workloads to simplify management. Which storage account kind and performance tier combination would be most appropriate?

22 An organization is deploying a critical application in the East US Azure region. They require a storage solution that can withstand a complete datacenter failure within that region without any data loss and with automatic failover of the storage endpoint. Cost is a secondary concern to regional availability. Which redundancy option should be selected?

23 A media company uploads large video files (50-100 GB each) for a video processing workflow. The workflow application needs to read and write to specific byte ranges within these files without rewriting the entire file. Which type of blob is specifically designed for this 'random access' read/write workload?

24 A developer needs to provide a third-party application with temporary, delegated access to upload new blobs into a specific container named uploads. The access should be valid for only 48 hours and should not grant permissions to read, delete, or list any blobs. Which type of Shared Access Signature (SAS) is the most secure and appropriate for this requirement?

25 A company has a storage account containing sensitive financial data. The security policy mandates that all data must be encrypted at rest using keys that are managed and rotated by the company's internal security team, not by Microsoft. Which Azure Storage encryption feature must be configured to meet this requirement?

26 Your company stores monthly transaction logs in Azure Blob Storage. These logs are frequently accessed for reporting during the first 30 days. After 30 days, they are rarely accessed but must be retained for one year for compliance. After one year, they can be deleted. What is the most cost-effective way to automate this data lifecycle?

27 A company has a storage account configured with Geo-Redundant Storage (GRS). The primary region experiences a major outage. The company needs to access their data from the secondary region for read-only operations while waiting for the primary region to recover. What must they have configured to enable this capability?

28 A data analyst needs to manage files in an Azure Data Lake Storage Gen2 account and blobs in a standard storage account from their desktop computer. They need a graphical tool that allows them to upload/download data, manage access control lists (ACLs) on the ADLS Gen2 directories, and connect using different Azure AD accounts for different subscriptions. Which tool is best suited for this?

29 An administrator configures a storage account firewall to only allow connections from a specific VNet subnet. A virtual machine in that subnet attempts to connect to the storage account's public endpoint but fails. What is a likely reason for this connection failure?

30 A user is trying to use a SAS token to access a blob, but receives an authentication error. The administrator has verified the SAS signature, expiry time, and permissions are all correct. The storage account requires that all connections use HTTPS. What parameter in the SAS token string is most likely missing or misconfigured?

31 A company uses a Recovery Services vault to back up blob data from a geo-redundant storage (GRS) account. The Recovery Services vault itself is configured with locally-redundant storage (LRS). If the primary Azure region fails, what is the state of the backup data?

32 A company wants to enable Azure Data Lake Storage Gen2 (ADLS Gen2) capabilities, such as hierarchical namespace and POSIX-like access controls, for their big data analytics workloads. When creating a new storage account, what specific setting must they enable?

33 A company hosts a public-facing static website directly from Azure Storage. They have uploaded their index.html, CSS, and JavaScript files to a specific container. When users navigate to the storage account's static website endpoint, they receive a 404 error. What is the most likely misconfiguration?

34 A developer is using Azure Storage Explorer to manage a storage account but does not have access to the subscription through Azure AD. The administrator provides them with a connection string for the storage account. What information is contained within this connection string that allows Storage Explorer to authenticate?

35 A compliance policy requires that all backups of an Azure Storage account's blob data be immutable and protected from accidental or malicious deletion for a minimum of 30 days. Which Recovery Services vault feature should be configured to enforce this policy?

36 A team has an existing general-purpose v2 storage account configured with Locally-Redundant Storage (LRS). Due to new high-availability requirements, they need to change the redundancy to Zone-Redundant Storage (ZRS). What is the process for this change?

37 An administrator creates a stored access policy on a blob container with read permissions. They then generate two SAS tokens that reference this policy. Later, they need to immediately revoke access for both SAS tokens simultaneously without having to track the individual tokens. What is the most effective action?

38 A developer is using the Azure CLI to create a new storage account. They want to ensure that unencrypted, HTTP requests to the storage account are automatically rejected. Which command-line flag should they include in their az storage account create command?

39 A security audit reveals that several storage accounts allow anonymous public read access to some blob containers. The company wants to implement a preventative policy at the subscription level to block the creation of any new storage accounts that permit public access and flag existing ones. Which Azure service is best suited for this?

40 You are using Azure Storage Explorer to troubleshoot an application that writes to an Azure Queue. You need to view the contents of messages in the queue without removing them, as the application needs to process them later. Which Storage Explorer operation allows you to do this?

41 A company deploys a critical application using an Azure Storage Account in the "East US" region. The requirements are:
1. Withstand a complete zonal failure within "East US".
2. Maintain a disaster recovery copy in "West US".
3. Allow read access to the secondary location for performance reasons without initiating a failover.

What is the most cost-effective storage redundancy option that meets all these requirements?

42 A storage account has a VNet service endpoint enabled for SubnetA. It also has a firewall rule allowing traffic from a specific public IP address. A private endpoint for the same storage account is created in SubnetB within the same VNet. A VM in SubnetB (the subnet with the private endpoint) attempts to access the storage account using its public endpoint FQDN (mystorage.blob.core.windows.net). What is the expected outcome?

43 A stored access policy named read-policy is created for a blob container, granting read permissions with a 24-hour expiry. A developer generates a Service SAS token for a specific blob in that container, referencing read-policy. Two hours later, an administrator deletes read-policy from the container. What happens when the developer tries to use the original SAS token to read the blob?

44 A legal department requires that certain financial documents in a blob container cannot be deleted or modified for 7 years. New documents must be continuously added. During the 7-year period, a specific document is part of a lawsuit and its retention must be extended indefinitely, without affecting other documents. Which combination of features achieves this with the most administrative efficiency?

45 A company is migrating an HPC workload to Azure that requires extremely low-latency, high-throughput access to millions of small files. The data must be accessible via both the NFS v3 protocol and the native Blob REST API. Which storage account configuration is required to meet all these conditions?

46 A storage account is configured with Geo-Redundant Storage (GRS). A regional outage occurs in the primary region. An administrator successfully initiates a customer-managed failover to the secondary region. After the failover completes, what is the redundancy level of the storage account in the new primary region (the old secondary)?

47 A developer needs to provide a client application with temporary access to upload blobs to a container. For maximum security, the SAS must be tied to an Azure AD identity, be revokable through Azure AD permissions, and must not rely on storage account keys. The client application will use the Azure Identity library to authenticate. Which type of SAS must be used?

48 A storage account is configured with a default network access rule of "Deny". A VNet service endpoint for Microsoft.Storage is enabled on SubnetA. A private endpoint for the storage account is created in SubnetB. A firewall rule allows access from the on-premises corporate IP range. A user is on-premises, connected via an ExpressRoute circuit with private peering to the VNet. From a VM in SubnetB, what is the primary mechanism through which the storage account will be accessed?

49 A lifecycle management policy is configured with two rules on a container with versioning enabled:
Rule 1: If blob index tag "status" = "archive_ready", move the current version to Archive after 30 days of creation.
Rule 2: Delete previous versions 90 days after they become a previous version.

A blob is created with the tag status = "archive_ready". 45 days later, the blob is modified, creating a new current version. 100 days after the modification (145 days total), what is the state of the original (first) version of the blob?

50 A storage account has operational backup configured via a Backup Vault with a 30-day retention policy. The storage account also has blob soft delete enabled for 14 days and versioning enabled. An attacker on Day 1 deletes a critical blob, report.docx. On Day 10, the attacker deletes the entire container. On Day 20, the security team discovers the breach. What is the most effective method to recover report.docx?

51 You have a General-purpose v2 (GPv2) storage account with LRS redundancy containing 100 TB of data. You need to change the account's redundancy to GZRS to meet new compliance requirements. What is the most accurate description of the process?

52 A developer is using Azure Storage Explorer to manage a storage account that is secured with a private endpoint and has public network access disabled. The developer's machine is in an on-premises network connected to the Azure VNet via a Site-to-Site VPN. They can ping the private IP of the storage endpoint successfully but cannot browse it in Storage Explorer, receiving an authentication error. What is the most likely misconfiguration?

53 An Account SAS is generated with the following parameters:
Allowed Services: Blob, File
Allowed Resource Types: Service, Container
Allowed Permissions: Read, List
Expiry: 24 hours

A user attempts to use this SAS to: 1) List all blobs in a specific container, and 2) Get the properties of the File service. Which statement is correct?

54 A financial services company needs to deploy a solution on Azure using Premium File Shares (FileStorage account type). Their primary goal is the highest possible availability within a single region, capable of surviving a datacenter-level failure. Cost is a secondary concern. Which redundancy option must they choose for their FileStorage account?

55 A storage account is configured for encryption using a Customer-Managed Key (CMK) from an Azure Key Vault. The Key Vault is protected by a VNet service endpoint and has a default 'Deny' network rule. The storage account's system-assigned managed identity has been given Get, Wrap Key, and Unwrap Key permissions on the Key Vault. However, the storage account itself is not in the Key Vault's VNet. What additional configuration is required for the storage account to access the key for encryption/decryption?

56 A company uses an Azure Storage Account with the hierarchical namespace enabled (ADLS Gen2). They have a directory structure /raw/YYYY/MM/DD/. An analyst needs to process all data for June 2023. They are using an application that leverages the Blob REST API (blob.core.windows.net), not the ADLS Gen2 DFS endpoint (dfs.core.windows.net). What is the most significant performance challenge they will face when trying to list the necessary files?

57 A Backup Vault is configured to protect a storage account. The backup policy has a 30-day retention. A legal hold (a type of immutability policy) is applied to a container within the storage account. An administrator attempts to perform a point-in-time restore from the Backup Vault to a time before the legal hold was applied, choosing the "overwrite existing blobs" option. What will be the outcome?

58 A workload requires writing large amounts of telemetry data as a continuous stream from thousands of devices. Data must be added to existing blobs without modifying previous writes. The primary access pattern is appending new data blocks; full-blob reads are secondary. Which Storage Account type and Blob type combination provides the most optimized performance and API support for this specific workload?

59 A security audit requires that all SAS tokens used to access a storage account must be logged with the principal's Azure AD Object ID (OID). An application running on an Azure VM with a system-assigned managed identity needs to generate such a SAS to grant a client read access to a blob for one hour. Which sequence of actions must the application perform?

60 A container has blob versioning and a lifecycle management rule to transition previous versions to the Archive tier 30 days after they become a previous version. A blob named config.json is in the Hot tier.
Day 1: config.json (Version A) is created.
Day 10: config.json is updated, creating a new current version (Version B) and making Version A a previous version.

On which day will Version A complete its transition to the Archive tier?