Implement and manage storage

AZ-104 · 40 questions

• Cascade Regional Airlines is provisioning a new storage account to hold high-throughput telemetry blobs streamed continuously from aircraft health-monitoring sensors during taxi and takeoff, where consistent low-latency writes matter more than cost? Which storage account configuration best fits this workload?
• A records-retention officer at Cascade Regional Airlines is planning where to archive ten years of decommissioned crew scheduling logs that must remain durable but will almost certainly never be read again? Which access tier minimizes ongoing storage cost for this scenario?
• An IT administrator at Cascade Regional Airlines discovers that maintenance photo blobs tiered to Archive six months ago now need to be reviewed urgently by an FAA auditor within the hour? What must happen before those specific blobs can be read?
• Cascade Regional Airlines stores flight-data recorder exports in a storage account and wants automatic cost optimization: files untouched for 30 days should move to Cool, and files untouched for 180 days should move to Archive, without any manual intervention? Which feature should the cloud team configure?
• A ground operations analyst needs to know which redundancy option keeps Cascade Regional Airlines' kiosk log data available for read access even during a regional outage that takes down the primary Azure region entirely? Which option should the analyst choose?
• Cascade Regional Airlines' compliance team requires that crew document scans survive the simultaneous loss of an entire Azure datacenter within the primary region, but a full cross-region failover is not required for this particular workload? Which redundancy option satisfies this requirement at the lowest cost?
• During a scheduled disaster-recovery test, Cascade Regional Airlines' cloud team wants to validate that a storage account configured with GRS can actually be made writable in the secondary region if the primary region were to fail permanently? What must the team initiate to make the secondary region primary?
• A DevOps engineer configuring backups for Cascade Regional Airlines' maintenance photo archive account needs the cheapest redundancy level that still protects against the loss of a single disk or server rack inside one datacenter? Which option meets that minimum bar?
• A compliance auditor asks Cascade Regional Airlines to prove that safety-incident report blobs cannot be modified or deleted, even accidentally by an administrator with full account access, for a mandatory five-year retention period? Which blob storage feature enforces this?
• An engineer accidentally overwrites a maintenance photo blob with a corrupted upload at Cascade Regional Airlines, and the storage account has blob versioning enabled? What is the correct way to recover the pre-corruption image?
• Cascade Regional Airlines wants a safety net so that if a support technician mistakenly deletes a crew document scan container, the deleted contents can be recovered within a defined window without needing versioning or a separate backup job? Which feature should be enabled?
• Legal counsel at Cascade Regional Airlines places a hold on a set of incident-investigation blobs pending litigation, requiring that they cannot be deleted or altered by anyone, with no expiration date, until legal explicitly releases the hold? Which immutability feature fits this open-ended requirement?
• A security architect reviewing Cascade Regional Airlines' storage design notes that flight-data recorder exports are encrypted at rest, but compliance now requires the airline itself to control and be able to revoke the encryption keys, rather than relying on keys Microsoft generates and manages? Which configuration satisfies this?
• Cascade Regional Airlines' network team wants a maintenance-records storage account reachable only from the airline's virtual network and from a short list of on-premises office IP ranges, with all other public internet traffic denied by default? Which storage account feature should be configured first?
• After locking down a storage account's firewall to deny all public network access, Cascade Regional Airlines' team notices that Azure Monitor diagnostic logs can no longer be written to the account, breaking an audit pipeline that a Microsoft-hosted service depends on? Which firewall setting should the team review?
• Cascade Regional Airlines locked down the network security group on the booking-tier subnet to deny all outbound traffic except to a handful of approved destinations, then discovered that VMs in that subnet can still reach a maintenance-records storage account whose public network access is left fully open. The network team wants a single control that governs whether the storage account itself accepts that traffic, independent of any subnet's NSG rules. What should they configure?
• Cascade Regional Airlines' finance team asks why last month's storage bill spiked after a batch of aircraft inspection photos, tiered to Cool for months, was suddenly accessed heavily by a new analytics job? What most directly explains this cost increase?
• A data analyst at Cascade Regional Airlines is deciding between the Cool and Cold access tiers for a set of quarterly maintenance summary reports expected to be accessed a handful of times per year but never truly abandoned? Which factor most directly distinguishes when Cold is preferable to Cool for this data?
• Cascade Regional Airlines' cloud team is choosing a storage account kind for a new workload that needs both blob storage for maintenance photos and table storage for structured inspection metadata, all under one account with the modern feature set including access tiers and lifecycle management? Which account kind should they choose?
• Cascade Regional Airlines' security team wants blobs newly uploaded to a maintenance-records container to be encrypted using a customer-managed key from the moment they are written, without requiring any application code changes on the upload path? Which statement about this requirement is accurate?
• Cascade Regional Airlines is bringing in an outside avionics inspection vendor to review photos of a recent landing-gear-door inspection stored in a single Blob container. Security wants the access credential tied to a specific Microsoft Entra ID identity rather than the storage account key, so it can be revoked by removing a role assignment instead of rotating keys. Which credential should IT issue to the vendor?
• Cascade's crew-records team stores scanned licensing and medical documents in a container named crew-doc-scans, separate from the flight-ops-logs container in the same storage account. A payroll auditor needs temporary read access to crew-doc-scans only, and must never be able to touch flight-ops-logs. Which SAS type satisfies this?
• A dispatch coordinator at Cascade needs to send a one-time download link for a single day's flight-release PDF to an outstation manager who will grab the file within the hour. The coordinator is about to generate a SAS token for the blob. What expiry setting best fits this task?
• An outstation office issued several SAS tokens against the same container to a rotating cast of ground-handling contractors over the past month. Security now wants the ability to instantly invalidate every one of those already-issued tokens at once, without rotating the storage account keys that other production apps depend on. What should have been used when the tokens were created?
• Cascade's central IT team wants to rotate the storage account access keys every quarter as a security best practice, but several internal applications are currently authenticated using key1. What rotation approach avoids an outage for those applications?
• A ground-handling contractor at an outstation needs to upload a batch of ramp-inspection photos into one virtual folder in a Blob container for a single afternoon. An IT technician suggests just giving the contractor the storage account access key since it's quick to hand over. Why is that the wrong call?
• Cascade is standing up a new flight-data ingestion service on Linux virtual machines at the hub, and the team needs the servers to mount an Azure file share using POSIX-style file permissions and Linux-native file locking, similar to how the existing Windows maintenance workstations mount their share over SMB. Which protocol should this new share use?
• Cascade's IT team is setting up an Azure file share to hold scanned aircraft maintenance logs that are only opened a handful of times per year, but whenever someone does need one, it must open instantly with no rehydration delay. Which share tier best fits this pattern?
• Cascade's crew-scheduling office wants each crew member's Azure Files SMB share access to be controlled by that individual's own domain credentials, with per-user, NTFS-style permissions on specific folders — not one shared secret handed to the whole team. What should IT enable on the storage account?
• Cascade wants a Windows file server at each outstation to keep local copies of shared operations documents in sync with a master copy in Azure and with the servers at every other outstation, so a document edited at one location eventually appears everywhere. What Azure File Sync construct ties all of these locations together?
• An outstation server in Cascade's Azure File Sync deployment only has 500 GB of local disk, but the cloud file share it's paired with holds several terabytes of historical documents. IT still wants every file to appear browsable in the local folder, without needing to expand the server's disk. What Azure File Sync feature accomplishes this?
• A new hire configuring Azure File Sync at Cascade is confused about which piece is which after a support ticket mentions both a 'server endpoint' and a 'cloud endpoint' inside the same sync group. Which statement correctly distinguishes the two?
• Cascade's IT team is migrating years of aircraft maintenance photo archives — several million files — from an aging on-premises NAS into Azure Blob storage overnight, and the job needs to resume automatically if the connection drops partway through. Which tool is purpose-built for this kind of high-throughput, resumable bulk transfer?
• A Cascade support engineer occasionally needs to browse a handful of Blob containers, spot-check whether a specific maintenance photo uploaded correctly, and adjust a container's public access level, all without writing a script. Which tool fits this ad hoc, visual task best?
• An outstation with only a slow, metered satellite internet link needs to move roughly 60 TB of historical aircraft maintenance video into Azure Blob storage as a one-time bulk transfer. Uploading over that link would take weeks and blow through the data cap. What Azure offering is designed for exactly this situation?
• Cascade's HQ storage account holds the crew-doc-scans container, and a regional office in another Azure region needs its own read-only copy of that container's contents kept continuously and automatically up to date, without triggering a full failover of the entire storage account. What feature should be configured?
• Before rolling out a schema change, a Cascade developer needs to copy a snapshot of one container's blobs from the Production storage account into a Staging storage account for testing — a one-off task, and the developer already has a command-line tool installed and is comfortable scripting it. What's the most direct way to accomplish the copy?
• A vendor's contract with Cascade Regional Airlines ended, so an administrator deleted the stored access policy that several outstanding SAS URLs referenced, and those URLs stopped working immediately. The URLs carried no expiry of their own — they took their permissions and expiry from the policy. Two weeks later a scripted container deployment re-creates a stored access policy on the same container using the same policy identifier. What happens to the vendor's old SAS URLs?
• Cascade's automation team is building a script that needs one single credential granting read and write access across both the Blob service and the File service in a storage account, rather than being scoped to one container or one service. Which SAS type is designed to span multiple storage services in a single token?
• Shortly after Cascade's central IT rotated a storage account's access keys, several outstation applications using recently issued service SAS tokens for a container suddenly began receiving authorization failures, while everything else kept working. What's the most likely cause, and what fixes it going forward?