Q01 - Question
External developers need limited blob access. You must revoke access without regenerating storage account keys. What should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Share the primary account key
- B. Make the container public
- C. Issue an ad hoc SAS with a long expiry
- D. A service-level SAS that references a stored access policy
D is correct.
Explanation: Stored access policies let you revoke permissions without regenerating account keys.
A is incorrect: Account keys give broad access.
B is incorrect: Public containers allow anonymous read access.
C is incorrect: Without a policy, use near-term expiry instead.
Q02 - Question
You need to centralize your organization's file shares in Azure Files while maintaining the performance and compatibility of an on-premises Windows file server. Which service should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Azure File Sync
- B. Azure Storage Explorer
- C. Azure Data Box Disk
- D. AzCopy
A is correct.
Explanation: Azure File Sync enables you to cache Azure Files shares on an on-premises Windows Server, keeping local performance and compatibility.
B is incorrect: Storage Explorer is a standalone app to manage storage data.
C is incorrect: Data Box Disk is for offline data transfer.
D is incorrect: AzCopy is a command-line tool for copying data.
Q03 - Question
A storage account must survive an availability zone failure and a regional outage, and allow reads from the secondary region during the outage. Which replication option meets this requirement?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. RA-GZRS
- B. ZRS
- C. GZRS
- D. LRS
A is correct.
Explanation: RA-GZRS uses three zones, a secondary region, and read access to the secondary.
B is incorrect: ZRS stays in one region.
C is incorrect: GZRS lacks secondary read access.
D is incorrect: LRS can lose all replicas.
Q04 - Question
A Standard general-purpose v2 storage account hosts a database workload that now needs consistent low-latency SSD performance. What should you do?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Convert the account to Premium in the Azure portal
- B. Upgrade the account to General-purpose v1
- C. Enable GZRS on the existing account
- D. Create a Premium storage account and copy the data
D is correct.
Explanation: You can't convert Standard to Premium. Create a new account and copy data.
A is incorrect: Standard-to-Premium conversion isn't supported.
B is incorrect: GPv1 is a legacy type.
C is incorrect: Redundancy doesn't change the performance type.
Q05 - Question
Compliance records are rarely read, must stay stored for at least 180 days, and can tolerate several hours of retrieval latency. Which tier minimizes storage cost?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Hot
- B. Archive
- C. Cool
- D. Cold
B is correct.
Explanation: Archive is the lowest-cost tier for data kept 180 days that tolerates hours of retrieval.
A is incorrect: Hot costs most to store.
C is incorrect: Cool costs more to store.
D is incorrect: Cold costs more to store.
Q06 - Question
You need to configure Azure Storage encryption for a new storage account. You want to generate and manage the encryption keys in your own Azure Key Vault. Which encryption option should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Customer-managed keys
- B. Platform-managed keys
- C. Infrastructure encryption
- D. Client-side encryption
A is correct.
Explanation: Customer-managed keys are created and managed by the customer and stored in a customer-owned Azure Key Vault.
B is incorrect: Platform-managed keys are generated and managed entirely by Azure.
C is incorrect: Infrastructure encryption encrypts data twice at the service and infrastructure levels, but doesn't specify key management in Key Vault.
D is incorrect: Client-side encryption manages keys on-premises or in another secure location before data is sent to Azure.
Q07 - Question
You need to automatically move blob data that has not been accessed for 30 days to the Cool tier. What should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Blob lifecycle management rules
- B. Object replication policies
- C. Blob access tiers at the account level
- D. Azure File Sync cloud tiering
A is correct.
Explanation: Azure Blob Storage lifecycle management policy rules can automatically transition blobs to a cooler storage tier based on access or modification time.
B is incorrect: Object replication copies blobs between containers asynchronously.
C is incorrect: Account-level access tiers set the default tier, but do not automatically move aging data based on access time.
D is incorrect: Azure File Sync is for Azure Files, not Blob Storage.
Q08 - Question
You plan to lift and shift an on-premises application to Azure. The application expects to use native file system APIs and share data with other applications running in Azure. Which storage service should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Azure Files
- B. Azure Blob Storage
- C. Azure Queue Storage
- D. Azure Table Storage
A is correct.
Explanation: Azure Files is ideal to lift and shift an application to the cloud that already uses the native file system APIs.
B is incorrect: Blob Storage is ideal for streaming and random-access scenarios, not native file system APIs.
C is incorrect: Queue Storage is for messages.
D is incorrect: Table Storage is for structured NoSQL data.
Q09 - Question
You configure object replication between two storage accounts in different regions. Which setting must be enabled on both accounts?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Blob versioning
- B. Blob snapshots
- C. Anonymous blob access
- D. Archive tier
A is correct.
Explanation: Object replication requires blob versioning on both source and destination accounts.
B is incorrect: Snapshots aren't replicated.
C is incorrect: Anonymous access isn't a stated requirement.
D is incorrect: Supported tiers are Hot, Cool, or Cold.
Q10 - Question
A production workload requires complete network isolation for blob access, with no public internet exposure. Which configuration should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Service endpoint for a subnet
- B. Custom domain with a CNAME record
- C. Private endpoint in the virtual network
- D. Firewall rule for a public IP range
C is correct.
Explanation: A private endpoint uses a private VNet IP address; traffic stays on the Microsoft backbone.
A is incorrect: Service endpoints keep the public endpoint.
B is incorrect: Custom domains only map names.
D is incorrect: Public IP rules keep public access.