Question 4 of 10Implement and Manage Storage
CramHQ stores airline booking manifests in an Azure storage account. An analytics subnet in the same region is already permitted through the account's restricted network settings. Analysts at a branch office connected to the hub virtual network by site-to-site VPN must run AzCopy from their laptops without opening the account to all public networks; their traffic is required to stay on the VPN path. Which recommendation is best?
- AA. Add an IP network rule for the branch office public NAT address, allow the storage account public endpoint, and force AzCopy traffic to bypass the VPN.
- BB. Create a private endpoint for the required storage subresource in the hub virtual network, configure private DNS for branch clients, and keep public network access restricted.
- CC. Add an IP network rule for the branch office private address range, route AzCopy traffic over the site-to-site VPN, and keep the storage account set to selected networks.
- DD. Enable the Microsoft.Storage service endpoint on the GatewaySubnet, add a virtual network rule for that subnet, and keep the storage account set to selected networks.
Show answer and explanation
Answer: B
This aligns the client path with documented behavior: branch clients resolve the storage name to a private address reachable through the VPN, and the storage firewall does not need a public rule for that traffic.
If you picked AWhy it is tempting: Storage accounts can allow specific public IP ranges, so a branch public NAT address sounds like a narrow exception.
Why it is wrong: A public IP network rule still uses the storage account public endpoint. Private-path requirements call for private endpoint connectivity and matching DNS resolution.
If you picked CWhy it is tempting: The option keeps traffic on the VPN and uses selected networks, so it appears to preserve the required path.
Why it is wrong: Storage IP network rules for the public endpoint use public IPv4 source ranges. A private branch range over VPN does not authorize those requests.
If you picked DWhy it is tempting: The branch connects through the hub virtual network, and service endpoints plus virtual network rules are valid for Azure subnets.
Why it is wrong: A storage virtual network rule applies to traffic from the authorized subnet using the service endpoint. Remote VPN clients do not become requests from the GatewaySubnet merely by traversing it.
Question 5 of 10Implement and Manage Storage
CramHQ ingests satellite telemetry into blob containers and Azure queues in a region where all listed choices are available. A failure of one availability zone in that region must not stop normal writes. If the whole region is unavailable, operators must still be able to review whatever telemetry has already been copied elsewhere before deciding whether to make the account writable in another region. Which new account configuration should you deploy?
- AA. Standard general-purpose v2 account with geo-zone-redundant storage (GZRS).
- BB. Standard general-purpose v2 account with read-access geo-zone-redundant storage (RA-GZRS).
- CC. Standard general-purpose v2 account with read-access geo-redundant storage (RA-GRS).
- DD. Standard general-purpose v2 account with zone-redundant storage (ZRS).
Show answer and explanation
Answer: B
RA-GZRS combines synchronous copies across availability zones in the primary region with asynchronous copying to a paired region and a readable secondary endpoint before failover. Standard general-purpose v2 also supports blobs and queues.
If you picked AWhy it is tempting: This choice matches the zone-failure requirement and includes geo-replication, so it looks like it covers both outage scopes.
Why it is wrong: Use read-access geo-zone-redundant storage when the workload needs primary-region zone resilience and readable secondary data before failover.
If you picked CWhy it is tempting: This choice directly matches the need to review copied data elsewhere before failover.
Why it is wrong: A requirement for normal writes after one availability zone fails requires a zone-redundant primary-region design, not only read-access geo-redundancy.
If you picked DWhy it is tempting: This choice is strong for keeping data available in the primary region when one zone becomes unavailable.
Why it is wrong: Use a geo-redundant option when the scenario requires data copied to another region for regional outage handling.
Question 6 of 10Implement and Manage Storage
CramHQ is moving department shares from Windows file servers to SMB Azure file shares. Analysts sign in with AD DS accounts synced to Microsoft Entra ID. Several Azure VMs that need the shares are Microsoft Entra joined and will not have reliable connectivity to on-premises domain controllers at access time. Existing folder ACLs must continue to decide departmental access. Which configuration should you recommend?
- AA. Enable Microsoft Entra Domain Services authentication; join the Azure VMs to the managed domain; assign Azure RBAC share roles to synced groups; keep the Windows ACLs.
- BB. Enable on-premises AD DS authentication for the storage account; assign Azure RBAC share roles to synced AD DS groups; keep the Windows ACLs on folders.
- CC. Enable Microsoft Entra Kerberos for the storage account; assign Azure RBAC share roles to groups created only in Microsoft Entra ID; recreate matching Windows ACL entries on the folders.
- DD. Enable Microsoft Entra Kerberos for the storage account; assign Azure RBAC share roles to AD DS groups synced to Microsoft Entra ID; keep the Windows ACLs on folders.
Show answer and explanation
Answer: D
Microsoft Entra Kerberos supports hybrid identities from Microsoft Entra joined clients without requiring client line-of-sight to AD DS during access. Share roles can target synced groups, and folder ACLs continue to apply to the corresponding AD DS identities.
If you picked AWhy it is tempting: It mentions synced groups and keeps Windows ACLs, so it appears to preserve the existing authorization model.
Why it is wrong: Choose an Azure Files SMB identity source that fits the clients as stated; Microsoft Entra joined clients without reliable domain-controller connectivity point to Microsoft Entra Kerberos.
If you picked BWhy it is tempting: On-premises AD DS authentication closely resembles the existing file server model and keeps familiar group and ACL behavior.
Why it is wrong: On-premises AD DS authentication is a fit when clients are domain joined or have uninterrupted domain-controller connectivity; Microsoft Entra Kerberos removes that access-time controller dependency for supported joined clients.
If you picked CWhy it is tempting: Microsoft Entra Kerberos is the right authentication direction, and cloud-only Microsoft Entra groups can look like a natural Azure RBAC target.
Why it is wrong: For hybrid Azure Files authorization, assign share-level roles to synced principals and let Windows ACLs continue to apply to the corresponding AD DS identities.
Question 7 of 10Implement and Manage Storage
CramHQ must rotate secrets for a storage account used by live game servers. Several services still use connection strings with key1, while maintenance windows are unavailable during a tournament. Security wants both account keys refreshed without interrupting writes. Which recommendation best supports the rotation?
- AA. Use Azure Storage account access keys: update all connection strings using key1 to key2, regenerate key1, verify access, then move workloads to key1 and regenerate key2.
- BB. Use Azure Storage account access keys: regenerate key2, update key1 connection strings to key2, then regenerate key1 after all services report healthy writes.
- CC. Use Azure Storage account access keys: update only new deployments to key2, regenerate key2, and leave existing key1 connection strings unchanged until the next release.
- DD. Use Azure Storage account access keys: regenerate key1 first, update failed services to key2, then regenerate key2 after the failed services recover.
Show answer and explanation
Answer: A
Azure Storage provides two account access keys so applications can continue using one valid key while the other is regenerated. Moving consumers before each regeneration avoids breaking live connections and refreshes both keys.
If you picked BWhy it is tempting: It keeps services on key1 while key2 is regenerated and waits for healthy writes before changing key1, so it appears outage-aware.
Why it is wrong: A complete staged rotation moves workloads away from the active key, regenerates it, moves workloads to the refreshed key, and then regenerates the remaining key.
If you picked CWhy it is tempting: Updating only new deployments looks low risk during a tournament because existing services keep using their current connection strings.
Why it is wrong: Key rotation must account for all dependent consumers, not only new deployments, when the requirement is to refresh both account keys.
If you picked DWhy it is tempting: It eventually moves failed services to the other key, so it can look like a reactive way to discover dependencies.
Why it is wrong: Move consumers off a storage account key before regenerating that key; regeneration immediately invalidates connection strings that use it.
Question 8 of 10Implement and Manage Storage
CramHQ stores satellite telemetry files in an Azure Storage account used by automated jobs and analysts. A recent review found one container was briefly readable without credentials after an operator change. Management wants an account-level guardrail that prevents that class of mistake while preserving existing authenticated access paths and network design. What should you configure?
- AA. Set every blob container Public access level to Private; use periodic reviews to detect future changes.
- BB. Set Secure transfer required to Enabled and Minimum TLS version to TLS 1.2; leave authorization settings unchanged.
- CC. Set Public network access to Disabled on the storage account; keep private endpoint access and existing role assignments unchanged.
- DD. Set Allow Blob anonymous access to Disabled on the storage account; leave container public access levels and existing role assignments unchanged.
Show answer and explanation
Answer: D
This enforces the decision at the account boundary. Anonymous requests are rejected even if a container is configured for anonymous access, while authenticated requests continue subject to their existing permissions and network rules.
If you picked AWhy it is tempting: Setting containers to Private directly addresses the container that became readable without credentials.
Why it is wrong: Use an account-level control when the requirement is to prevent future lower-scope changes from allowing anonymous blob reads.
If you picked BWhy it is tempting: Secure transfer and TLS settings are real storage account security controls.
Why it is wrong: Transport settings control how clients connect; anonymous access settings control whether credential-free blob reads are allowed.
If you picked CWhy it is tempting: Disabling public network access can reduce public exposure and may seem like the strongest security option.
Why it is wrong: Network controls decide which paths can reach the account; anonymous access controls decide whether a reached blob request without credentials is accepted.
Question 9 of 10Implement and Manage Storage
CramHQ stores raw drive logs and reviewed simulation outputs as block blobs in the same container. Only the reviewed outputs should be copied to a second region for compute jobs, and the raw logs must stay local to avoid unnecessary transfer cost. Which recommendation should you implement?
- AA. Configure an object replication policy with separate replication rules for the same source container, using different destination containers for raw logs and reviewed outputs.
- BB. Configure an object replication policy with one replication rule for the container and omit filters.prefixMatch from the rule.
- CC. Configure an object replication policy with one replication rule for the container and set filters.minCreationTime to the first reviewed output creation time.
- DD. Configure an object replication policy with one replication rule for the container and set filters.prefixMatch to the reviewed output path.
Show answer and explanation
Answer: D
This matches the requirement because an object replication rule can include a prefixMatch filter. Only block blobs whose names match that path are copied to the destination container.
If you picked AWhy it is tempting: Using different destination containers sounds like it could separate raw logs from reviewed outputs after replication.
Why it is wrong: Use the replication rule's blob-name prefix filter when the selected data set is a subset inside the same source container.
If you picked BWhy it is tempting: A single rule for the container matches the source location, so it can look like the normal object replication setup.
Why it is wrong: Add prefixMatch when only blob names under a specific path or prefix should be replicated.
If you picked CWhy it is tempting: Starting replication from the first reviewed output time sounds like it avoids older raw logs.
Why it is wrong: Use a prefixMatch filter when the selection is based on blob path or name; a creation-time filter only narrows by when blobs were created.
Question 10 of 10Implement and Manage Storage
CramHQ must move 6 TB of tenant export blobs between two storage accounts. Both accounts reject traffic from the public internet and are reachable only from a peered operations VNet. Administrator workstations are not connected to that peered operations VNet. The operations team is not allowed to receive account keys or shared access signatures. Which recommendation should you make?
- AA. Use Azure Storage Explorer from an administrator workstation and sign in with Microsoft Entra ID after granting Storage Blob Data Contributor on both accounts.
- BB. Use the Azure portal upload and copy experience from an administrator workstation signed in with Microsoft Entra ID.
- CC. Run AzCopy on an operations VNet VM and sign in with Microsoft Entra ID after granting Storage Blob Data Contributor on both accounts.
- DD. Run AzCopy on an operations VNet VM and authenticate with a user delegation SAS generated by a storage administrator.
Show answer and explanation
Answer: C
AzCopy can run from a host that has the permitted private path and can authorize blob data operations with Microsoft Entra ID when the identity has the required data-plane role.
If you picked AWhy it is tempting: Storage Explorer can use Microsoft Entra sign-in, and Storage Blob Data Contributor is the right kind of data-plane role.
Why it is wrong: The storage data operation must originate from a source allowed by the storage account network rules and use permitted authorization.
If you picked BWhy it is tempting: The portal is an Azure service interface, so it can seem separate from the workstation's network path.
Why it is wrong: Interactive portal access does not remove the need for the data-plane operation to satisfy the storage account's network restrictions.
If you picked DWhy it is tempting: Running AzCopy on the operations VNet VM satisfies the network-path requirement, and a user delegation SAS can be used for blob access in other scenarios.
Why it is wrong: When the scenario forbids account keys and shared access signatures, use direct identity-based authorization instead of distributing a SAS.
