Storage in Azure

Question 1: You are configuring an Azure Storage Account that requires high availability across zones in the primary region. If the primary region suffers a total outage, your application must automatically failover to a paired secondary region for read operations. Which redundancy option should you select?

A. Locally-redundant storage (LRS) B. Zone-redundant storage (ZRS) C. Geo-redundant storage (GRS) D. Geo-zone-redundant storage (GZRS)

Answer: D - Geo-zone-redundant storage (GZRS)

Explanation: Geo-zone-redundant storage (GZRS) replicates data synchronously across three Azure availability zones in the primary region (combining ZRS) and asynchronously replicates it to a secondary paired region for protection against regional disasters. Standard GRS only uses LRS in the primary region.

Question 2: You need to grant a third-party application temporary access to upload files to a specific Azure Blob storage container for 4 hours. You must ensure access is restricted only to uploading and automatically expires without rotating primary access keys. What should you generate?

A. Access Key B. Shared Access Signature (SAS) token C. Stored Access Policy D. Role Assignment (Azure RBAC)

Answer: B - Shared Access Signature (SAS) token

Explanation: A Shared Access Signature (SAS) token provides delegated, time-bound, fine-grained access to specific storage resources without exposing the storage account keys. You can specify exact permissions (Write-only) and expiration times.

Question 3: You want to enforce a security policy requiring all SAS tokens generated for a storage account to inherit a set start time, expiry time, and permission boundaries, so that revoking access to multiple SAS tokens can be done in a single action. What should you implement?

A. Azure Key Vault Key Rotation Policy B. Stored Access Policy C. Management Group Azure Policy D. Storage Account Access Key

Answer: B - Stored Access Policy

Explanation: A Stored Access Policy groups shared access signatures and provides additional controls, including the ability to revoke permissions for signatures tied to the policy by simply altering or deleting the policy itself.

Question 4: Your organization has an Azure Blob Storage container holding logs that are read frequently during the first 30 days, accessed occasionally over the next 60 days, and rarely accessed after 90 days. You need to automate cost optimization without manual intervention. What should you configure?

A. Blob Object Replication B. Azure Storage Static Website C. Blob Lifecycle Management rules D. Storage Account Redundancy Auto-Tiering

Answer: C - Blob Lifecycle Management rules

Explanation: Azure Blob Lifecycle Management policies allow you to define rule-based actions (such as moving blobs from Hot to Cool after 30 days, to Cold/Archive after 90 days, or deleting them) based on access times or modified dates.

Question 5: You are tasked with mounting an Azure File Share on a local Windows Server machine located on-premises. The connection must occur securely over SMB using corporate Microsoft Entra ID identities. Which feature enables this identity-based authentication?

A. Azure Active Directory Domain Services (Azure AD DS) or Active Directory Domain Services (AD DS) authentication for Azure Files B. Shared Access Signatures (SAS) over HTTPS C. Storage Account Public Endpoints with Access Keys D. Anonymous Public Access with Read privileges

Answer: A - Azure Active Directory Domain Services (Azure AD DS) or Active Directory Domain Services (AD DS) authentication for Azure Files

Explanation: Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS) or Microsoft Entra Domain Services (formerly Azure AD DS) to allow domain-joined Windows machines to mount file shares using standard identity credentials.

Question 6: You need to copy 50 TB of data from an on-premises file server to an Azure Blob storage account over the internet using a high-performance command-line utility capable of syncing directories and resuming interrupted downloads/uploads. Which utility should you use?

A. Azure Portal Web Upload B. AzCopy C. Azure Storage Explorer UI D. PowerShell Copy-Item

Answer: B - AzCopy

Explanation: AzCopy is Microsoft's dedicated command-line utility designed for copying data into and out of Azure Storage accounts with high performance, supporting directory syncing, parallel threads, and automatic resumption of interrupted operations.

Question 7: An application writes data to an Azure Blob storage account. Compliance mandates state that once data is written, it must be immutable—it cannot be modified or deleted by any user, including Subscription Administrators, for 7 years. What feature should you configure?

A. Soft Delete for Blobs B. Blob Versioning C. Legal Hold or Time-Based Retention Policy (WORM) D. Resource Lock (ReadOnly) on the Storage Account

Answer: C - Legal Hold or Time-Based Retention Policy (WORM)

Explanation: Immutable Blob Storage uses time-based retention policies (Write Once, Read Many / WORM) or legal holds to ensure that blob data cannot be overwritten or deleted by any user, including account owners, for the specified duration.

Question 8: You must restrict traffic to an Azure Storage account so that it accepts connections only from virtual machines located in a specific subnet of your Azure Virtual Network (VNet), blocking all direct public internet access. Which configuration achieves this?

A. Configure Storage Account Firewalls and Virtual Networks to allow access from Selected Networks/Subnets B. Enable Blob Soft Delete and Versioning C. Generate a User Delegation SAS token bounded to the subnet IP D. Enable Azure AD Authentication on the Blob Container

Answer: A - Configure Storage Account Firewalls and Virtual Networks to allow access from Selected Networks/Subnets

Explanation: Storage Account Firewalls allow you to restrict network access to the storage account to specific public IP ranges or specific subnets using Virtual Network Service Endpoints or Private Endpoints.

Question 9: You are setting up Object Replication between a source storage account in East US and a destination storage account in West US. What prerequisite must be enabled on both storage accounts for Object Replication to function?

A. Azure Storage Encryption with Customer-Managed Keys (CMK) B. Blob Versioning and Change Feed C. Soft Delete for Containers only D. NFS v3 protocol support

Answer: B - Blob Versioning and Change Feed

Explanation: Azure Blob Object Replication requires both Blob Versioning and Change Feed to be enabled on both the source and destination storage accounts before replication rules can be configured.

Question 10: You need to move block blob data that is currently in the Archive access tier back to the Hot access tier so that an application can read the data. What process must occur before the blob can be accessed?

A. Instant Tier Switch (Direct Read) B. Blob Rehydration (via Copy Blob or Set Blob Tier) C. Storage Account Failover D. Container Soft Delete Restore

Answer: B - Blob Rehydration (via Copy Blob or Set Blob Tier)

Explanation: Blobs in the Archive tier are offline and cannot be read directly. They must first be rehydrated back to an online tier (Hot or Cool) using either the Set Blob Tier operation or a Copy Blob operation, which can take several hours depending on the chosen rehydration priority.

Question 11: You have an Azure Blob Storage container that contains critical data. You need to ensure that if a blob is accidentally deleted, it can be recovered for up to 14 days after deletion. What should you configure?

A. Blob Versioning B. Soft Delete for Blobs C. Blob Snapshot D. Object Replication

Answer: B - Soft Delete for Blobs

Explanation: Soft Delete for Blobs enables recovery of blob data after it has been deleted or overwritten, retaining deleted items for a specified retention period (such as 14 days) before permanent deletion.

Question 12: You are planning to deploy an Azure Files share to store files for an application. The storage solution must support POSIX-compliant permissions, path-based symbolic links, and hard links over the NFS v3.0 protocol. Which storage account type and performance tier should you select?

A. Standard General Purpose v2 (BlobStorage) B. Premium Block Blobs C. Premium Fileshares (FileStorage) D. Standard Page Blobs

Answer: C - Premium Fileshares (FileStorage)

Explanation: Azure Files supports the NFS v3.0 protocol exclusively on Premium File Shares created under the FileStorage account type. Standard file shares only support the SMB protocol.

Question 13: You need to secure access to an Azure Storage account by ensuring that traffic between your Virtual Network (VNet) and the storage account does not traverse the public internet. You also need to ensure that the storage account is assigned a private IP address within your VNet subnet. What should you configure?

A. Azure Storage Service Endpoint B. Azure Private Endpoint C. Storage Account Public Endpoint Firewall Rule D. Shared Access Signature (SAS) with IP restrictions

Answer: B - Azure Private Endpoint

Explanation: An Azure Private Endpoint creates a Network Interface (NIC) inside your Virtual Network, assigning the Azure Storage account a private IP address from your subnet and keeping traffic entirely within the Microsoft backbone network. (Service Endpoints keep public IP addressing for the PaaS service while routing over the backbone).

Question 14: You need to configure encryption for an Azure Storage account using customer-managed keys (CMK) stored in an Azure Key Vault. Which type of identity should you assign to the Storage account to grant it permission to access the Key Vault keys?

A. Service Principal B. System-Assigned or User-Assigned Managed Identity C. Shared Key Authentication D. Entra ID User Account

Answer: B - System-Assigned or User-Assigned Managed Identity

Explanation: To allow Azure Storage to access customer-managed keys stored in an Azure Key Vault, you must enable a Managed Identity (System-Assigned or User-Assigned) on the storage account and grant that identity Key Vault permissions.

Question 15: You are managing an Azure File share mounted on multiple Windows virtual machines. You want to capture a point-in-time, read-only copy of the entire file share to protect against corruption. What should you create?

A. Blob Version B. Share Snapshot C. Container Soft Delete D. Object Replication Policy

Answer: B - Share Snapshot

Explanation: Azure Files supports Share Snapshots, which are point-in-time, read-only copies of your Azure File share. They allow you to restore earlier versions of files or the entire share.

Question 16: You need to prevent an Azure Storage account from being deleted accidentally by an administrator or through automated script execution. What resource should you apply to the storage account?

A. Azure Policy deny rule B. CanNotDelete (Delete) Resource Lock C. ReadOnly Resource Lock D. Azure RBAC Reader assignment

Answer: B - CanNotDelete (Delete) Resource Lock

Explanation: Applying a CanNotDelete resource lock prevents authorized users from deleting the Azure resource (storage account) while still allowing them to read, modify, or interact with the underlying data.

Question 17: You have a Blob storage container configured with Blob Versioning enabled. When a blob named doc1.pdf is overwritten with new content, what happens to the existing data?

A. The previous content is permanently deleted. B. The previous content is moved to the Archive tier automatically. C. A previous version of doc1.pdf is created and assigned a unique timestamp identifier. D. An error occurs because versioning prevents files from being overwritten.

Answer: C - A previous version of doc1.pdf is created and assigned a unique timestamp identifier.

Explanation: When Blob Versioning is enabled, modifying or overwriting a blob automatically saves a read-only snapshot/version of the previous state identified by a timestamp, leaving the current version updated.

Question 18: You are creating a new Azure Storage Account for a high-performance database log application that requires sub-millisecond latency for small random read/write operations on unmanaged disk volumes. Which storage performance tier and account type should you select?

A. Standard General Purpose v2 (Blob Storage) B. Premium Page Blobs C. Premium Block Blobs D. Standard Cool Blob Storage

Answer: B - Premium Page Blobs

Explanation: Premium Page Blobs are optimized for frequent, random read and write operations (such as virtual machine disk images and database logs) requiring low latency and high IOPS.

Question 19: You need to prevent access keys from being used to authenticate to an Azure Storage account, forcing all requests to authenticate exclusively using Microsoft Entra ID. Which storage account setting should you disable?

A. Shared Access Signatures (SAS) B. Storage Account Key Access (Disallow Storage Account Key access) C. Secure Transfer Required D. Infrastructure Encryption

Answer: B - Storage Account Key Access (Disallow Storage Account Key access)

Explanation: Disabling "Allow Storage Account Key access" forces the storage account to reject all requests authenticated with Account Keys or Account-level SAS tokens, enforcing Microsoft Entra ID authentication for enhanced security.

Question 20: You are creating an Azure Blob storage lifecycle management policy. You want to move blobs to the Cold tier if they have not been accessed for 60 days. What rule condition must be enabled on the storage account before access-time-based lifecycle rules can function?

A. Blob Versioning B. Access Tracking (Last Access Time tracking) C. Change Feed D. Blob Snapshotting

Answer: B - Access Tracking (Last Access Time tracking)

Explanation: To run lifecycle management rules based on the time a blob was last accessed (daysAfterLastAccessTimeGreaterThan), you must explicitly enable Last Access Time Tracking on the storage account.

Question 21: You have an on-premises Windows File Server with 10 TB of data. You want to sync this local file server with an Azure File Share, using Azure as a secondary cache location while keeping frequently accessed files local. Which service should you deploy?

A. Azure Data Box B. Azure File Sync C. Azure Import/Export Service D. AzCopy Sync

Answer: B - Azure File Sync

Explanation: Azure File Sync transforms Windows Server into a fast cache of your Azure File Share, enabling centralized file storage while maintaining local access performance with cloud tiering.

Question 22: You manage a storage account containing compliance-critical records. You need to assign the lowest-privilege built-in Azure RBAC role to an auditor so they can read blob data using their Microsoft Entra ID credentials without viewing storage account management keys. Which role should you assign?

A. Storage Account Contributor B. Reader C. Storage Blob Data Reader D. Owner

Answer: C - Storage Blob Data Reader

Explanation: The Storage Blob Data Reader role provides read access to Azure Blob storage containers and data using Entra ID credentials without granting control plane management or account key access.

Question 23: You need to migrate 100 TB of data from an on-premises network to an Azure Blob storage container. Your local network internet connection has a maximum bandwidth limit of 10 Mbps, making network transfer impractically slow. What is the recommended Microsoft solution?

A. Run AzCopy with high concurrency B. Order an Azure Data Box device C. Use the Azure Import/Export service with user-supplied SATA drives D. Create an Azure VPN Gateway

Answer: B - Order an Azure Data Box device

Explanation: Azure Data Box is a Microsoft-provided physical appliance (80–100 TB capacity) used to ship massive amounts of data to Azure offline when network speeds are insufficient.

Question 24: You need to configure custom domain mapping (e.g., www.contoso.com) for static website hosting enabled on an Azure Storage Account ($web container). What record type must you add to your DNS provider to map the custom domain directly to your primary blob endpoint?

A. A Record B. CNAME Record C. TXT Record D. MX Record

Answer: B - CNAME Record

Explanation: A CNAME (Canonical Name) record maps your custom domain (or subdomain) directly to the storage account's static website host endpoint URL without causing downtime.

Question 25: You have configured Azure File Sync between an on-premises server and an Azure File Share. You enable Cloud Tiering. What happens to files on the local server when they are tiered to the cloud?

A. The files are completely deleted from the local disk and replaced with a zero-byte pointer file. B. The files are zipped and moved to the local temp folder. C. The files are copied to the Archive tier in Blob storage. D. The local disk retains the full file content until storage capacity hits 100%.

Answer: A - The files are completely deleted from the local disk and replaced with a zero-byte pointer file.

Explanation: When Cloud Tiering is enabled on Azure File Sync, infrequently accessed files are replaced with lightweight pointer files (reparse points) locally, while the full file data is stored securely in the Azure File Share.

Question 26: You are configuring cross-region replication using Azure Blob Object Replication. You notice that block blobs copied over to the destination account are missing their original creation timestamps and history. What missing feature must be enabled alongside Versioning and Change Feed on the destination account?

A. Soft Delete for Containers B. Blob Snapshotting C. Customer-Managed Key Encryption D. Point-in-Time Restore

Answer: B - Blob Snapshotting

Explanation: Object Replication requires Blob Versioning and Change Feed on both accounts. When versioning is disabled or snapshots are omitted on the destination, destination objects will not preserve the full history tree of the source blobs.

Question 27: You need to ensure that an Azure Storage Account encrypts all incoming infrastructure data twice—once at the service layer (SSE) and once at the hardware/storage infrastructure layer—using two different encryption algorithms. Which feature should you select during account creation?

A. Customer-Managed Keys (CMK) B. Infrastructure Encryption (Double Encryption) C. Secure Transfer Required D. Storage Account Key Auto-Rotation

Answer: B - Infrastructure Encryption (Double Encryption)

Explanation: Infrastructure Encryption enables 256-bit AES encryption at both the service layer and the infrastructure/disk layer (Double Encryption), ensuring protection against vulnerabilities in any single encryption layer.

Question 28: You are deploying a legacy Linux application to an Azure Virtual Machine. The application requires mounting a shared directory using the NFS v3.0 protocol. Which storage solution provides native NFS v3.0 file share capability in Azure?

A. Standard Azure File Share (SMB) B. Azure Blob Storage with Hierarchical Namespace (Data Lake Storage Gen2) or Premium Files C. Azure Managed Disks (Ultra SSD) D. Azure Table Storage

Answer: B - Azure Blob Storage with Hierarchical Namespace (Data Lake Storage Gen2) or Premium Files

Explanation: Azure Files supports NFS v3.0 on Premium File Shares, and Azure Blob Storage supports NFS v3.0 protocol when Hierarchical Namespace (ADLS Gen2) is enabled. Standard SMB file shares do not support NFS.

Question 29: You need to generate a Shared Access Signature (SAS) token that uses Microsoft Entra ID credentials instead of storage account access keys to secure access to an Azure Blob storage container. Which type of SAS should you create?

A. Account SAS B. Service SAS C. User Delegation SAS D. Stored Access Policy SAS

Answer: C - User Delegation SAS

Explanation: A User Delegation SAS is secured using Microsoft Entra ID credentials rather than storage account access keys. This aligns with security best practices by avoiding shared storage key exposure.

Question 30: You have an Azure storage account configured with Geo-Redundant Storage (GRS). You need to grant read-only access to applications in the event of an outage in the primary region without initiating an account failover. Which redundancy configuration should you use?

A. Read-Access Geo-Redundant Storage (RA-GRS) B. Zone-Redundant Storage (ZRS) C. Read-Access Geo-Zone-Redundant Storage (RA-GZRS) D. Locally-Redundant Storage (LRS)

Answer: A - Read-Access Geo-Redundant Storage (RA-GRS)

Explanation: RA-GRS replicates data to a secondary geographic location and provides continuous read access to data in the secondary region, even if the primary region experiences an outage.

Question 31: You are migrating files to an Azure File share using AzCopy. You need to ensure that local file permissions (ACLs) are preserved during the transfer process. Which command-line flag must you include in your azcopy copy command?

A. --preserve-smb-info=true B. --preserve-permissions=true C. --preserve-smb-permissions=true D. --sync-acl=true

Answer: C - --preserve-smb-permissions=true

Explanation: When copying files between SMB file shares (or local Windows shares to Azure Files) using AzCopy, the --preserve-smb-permissions=true flag ensures NTFS ACL permissions are preserved.

Question 32: You need to prevent anonymous public access to all blob containers within a newly created storage account, regardless of individual container configuration settings. Which storage account property should you set?

A. Disable Allow Storage Account Key Access B. Set Allow Blob Public Access to Disabled C. Enable Default to Microsoft Entra authorization in the Azure portal D. Configure Shared Access Signature restriction policies

Answer: B - Set Allow Blob Public Access to Disabled

Explanation: Setting Allow Blob Public Access to Disabled (false) on the storage account overrides any individual container configuration, preventing anonymous public access across the entire account.

Question 33: You plan to host a client-side single-page web application using the static website feature in Azure Storage. Into which system-created container must you upload the application files?

A. $static B. $root C. $web D. $public

Answer: C - $web

Explanation: Enabling static website hosting on an Azure Storage Account automatically creates a special container named $web, which serves files uploaded to it over HTTPS.

Question 34: You have an Azure Blob Storage container with Soft Delete enabled for 30 days. A user accidentally overwrote a critical block blob. How should you recover the original content of the overwritten blob?

A. Restore the storage account using Point-in-Time Restore B. Revert to the soft-deleted version of the blob using the Azure portal or PowerShell C. Rehydrate the blob from the Archive tier D. Run an AzCopy sync operation from the secondary region

Answer: B - Revert to the soft-deleted version of the blob using the Azure portal or PowerShell

Explanation: When Soft Delete for Blobs is enabled, overwriting a blob retains the previous state as a soft-deleted blob version or snapshot. You can recover it by undeleting the specific soft-deleted item within the retention window.

Question 35: You are configuring security for an Azure Storage Account. You want to ensure that all administrative and data plane requests sent to the storage account require TLS 1.2 or higher. Where should you enforce this requirement?

A. Storage Account Minimum TLS Version configuration B. Network Security Group (NSG) outbound rules C. Shared Access Signature (SAS) policy settings D. Azure Key Vault access policies

Answer: A - Storage Account Minimum TLS Version configuration

Explanation: Azure Storage accounts allow you to set the Minimum TLS version property directly in the configuration settings, forcing all incoming traffic to use TLS 1.2 or higher.

Question 36: You need to assign permissions to a Linux VM so it can mount an Azure Files share using SMB 3.0 identity-based authentication. Which Microsoft Entra ID-based RBAC role provides full read, write, and delete access to the file share contents?

A. Storage Account Contributor B. Storage File Data SMB Share Elevated Contributor C. Storage File Data SMB Share Contributor D. Storage File Data Privileged Reader

Answer: C - Storage File Data SMB Share Contributor

Explanation: The Storage File Data SMB Share Contributor role grants read, write, and delete permissions to files and directories within an Azure File Share over SMB using Microsoft Entra ID authentication. (The Elevated Contributor role is required to modify NTFS permissions).

Question 37: You have an Azure Storage Account configured with Microsoft Entra ID authentication enabled. An administrator needs to navigate and manage blob storage containers through Azure Storage Explorer using their corporate credentials. Which permission model does Storage Explorer use when signed in via Microsoft Entra ID?

A. Storage Account Access Key B. Azure Role-Based Access Control (Azure RBAC) data plane roles C. Connection String authorization D. Account-level Shared Access Signature (SAS)

Answer: B - Azure Role-Based Access Control (Azure RBAC) data plane roles

Explanation: When signing into Azure Storage Explorer using Microsoft Entra ID, access control relies on Azure RBAC data plane roles (such as Storage Blob Data Owner or Storage Blob Data Contributor) assigned to the user identity.

Question 38: You are configuring an Azure Storage Account for a high-performance analytics workload. You need to enable file-level directory hierarchies (folders) natively within Blob Storage to optimize data operations. Which feature must be enabled during account creation?

A. Blob Versioning B. Hierarchical Namespace (Azure Data Lake Storage Gen2) C. Object Replication D. Large File Shares

Answer: B - Hierarchical Namespace (Azure Data Lake Storage Gen2)

Explanation: Enabling Hierarchical Namespace converts standard Azure Blob storage into Azure Data Lake Storage Gen2 (ADLS Gen2), providing true directory structures and file-level access controls for enhanced analytics performance.

Question 39: You have files stored in the Archive tier of an Azure Blob Storage container. An auditor needs to view a subset of these files within 1 hour. You decide to use the Set Blob Tier operation to move the blobs back to the Hot tier. Which parameter option should you specify to accelerate processing?

A. High Rehydration Priority B. Standard Rehydration Priority C. Premium Copy Option D. Fast-Track Sync

Answer: A - High Rehydration Priority

Explanation: Rehydrating blobs from the Archive tier can take up to 15 hours using Standard priority. Setting the High Rehydration Priority prioritizes the request, often rehydrating blobs under 1 hour (for blobs under 10 GB).

Question 40: You have an Azure Blob Storage container used for temporary log processing. You want to set up an alert whenever the total egress bandwidth for the storage account exceeds a specific threshold over a 5-minute window. Which Azure service should you use to create and manage this alert rule?

A. Azure Storage Explorer B. Azure Monitor Metrics C. Azure Advisor D. Azure Event Grid

Answer: B - Azure Monitor Metrics

Explanation: Azure Monitor Metrics collects platform metrics automatically from Azure Storage accounts, including total egress bandwidth. You can define metric alert rules directly within Azure Monitor to notify administrators when thresholds are exceeded.

Question 41: You need to copy data directly between two Azure Storage accounts without downloading the files to your local machine. Which AzCopy command parameter should you execute to accomplish this side-to-side copy operation?

A. azcopy sync B. azcopy copy C. azcopy move D. azcopy transfer

Answer: B - azcopy copy

Explanation: The azcopy copy command natively supports server-side synchronous copy directly between two Azure Storage accounts using their resource URLs (with SAS tokens or Microsoft Entra ID authentication) without streaming data through the client machine.

Question 42: You are configuring an Azure Storage account encryption configuration. Compliance requirements state that customer-managed keys (CMK) stored in an Azure Key Vault must be used to encrypt data at rest. What must be enabled on the Azure Key Vault before it can be linked to the storage account?

A. Enable Purge Protection and Soft Delete B. Enable Public Access for all networks C. Enable RBAC Authorization with Custom Roles D. Enable Storage Account Access Key rotation

Answer: A - Enable Purge Protection and Soft Delete

Explanation: Azure Key Vault requires both Soft Delete and Purge Protection to be enabled before it can host Customer-Managed Keys (CMK) for Azure Storage encryption. This prevents accidental or malicious deletion of encryption keys that would render storage account data unreadable.

Question 43: You need to mount an Azure File share on multiple Windows and Linux virtual machines. The share must support SMB 3.1.1 protocol with transit encryption enabled. Which storage account property enforces SMB encryption in transit?

A. Allow Storage Account Key access B. Enable Hierarchical Namespace C. Secure transfer required (HTTPS/SMB encryption) D. Large File Shares enabled

Answer: C - Secure transfer required (HTTPS/SMB encryption)

Explanation: Enforcing "Secure transfer required" requires connections over HTTPS for REST APIs and forces SMB 3.x connections to use encryption in transit for Azure File Shares.

Question 44: You have an Azure Blob Storage account configured with a default access tier set to Hot. When an application uploads a blob without explicitly specifying an access tier parameter, which access tier will the blob inherit?

A. Cool B. Archive C. Hot D. Cold

Answer: C - Hot

Explanation: If an upload operation does not explicitly specify an access tier, the blob automatically inherits the primary access tier setting configured at the storage account level (which in this case is Hot).

Question 45: You have an Azure storage account containing multiple containers. You want to delegate administration so a user can create, delete, and modify containers within the storage account via the Control Plane (ARM), but not read or write the actual data inside the blobs. Which built-in Azure RBAC role should you assign?

A. Storage Blob Data Contributor B. Storage Account Contributor C. Storage Blob Data Owner D. Reader

Answer: B - Storage Account Contributor

Explanation: Storage Account Contributor grants management plane access to create, delete, and configure storage accounts and containers, but does NOT grant data-plane access to read or write blob content. Data plane access requires specific roles such as Storage Blob Data Contributor or Storage Blob Data Owner.

Question 46: You manage an Azure File share used by an internal application. You need to expand the maximum capacity limit of the share from 5 TB up to 100 TB on a Standard General Purpose v2 storage account. What must be enabled on the storage account?

A. Hierarchical Namespace B. Large File Shares C. Blob Object Replication D. Infrastructure Encryption

Answer: B - Large File Shares

Explanation: Standard Azure File shares default to a maximum limit of 5 TB. To scale individual shares up to 100 TB capacity (and increase IOPS/throughput limits), you must enable the Large File Shares setting on the storage account.

Question 47: You want to configure an Azure Backup policy to protect an Azure File Share. Which vault resource type must you deploy to manage and schedule backups for Azure Files?

A. Key Vault B. Recovery Services Vault C. Backup Vault D. Storage Sync Vault

Answer: B - Recovery Services Vault

Explanation: Azure Backup protects Azure File Shares natively by taking share snapshots managed through a Recovery Services Vault.

Question 48: You need to configure an Azure Storage account to host public static assets for a marketing campaign. You want to enforce that all HTTP requests to container contents are rejected, requiring HTTPS connections exclusively. Which configuration setting controls this behavior?

A. Allow Storage Account Key Access B. Secure transfer required C. Minimum TLS version D. Infrastructure Encryption

Answer: B - Secure transfer required

Explanation: The "Secure transfer required" setting forces the storage account to reject any request sent over unencrypted HTTP, ensuring that all communications take place securely over HTTPS.

Question 49: You are planning to store high-priority operational data in an Azure Blob storage account. Your company requires the data to be protected against a regional disaster, but compliance policies prohibit sending data out of the primary geographic region under any circumstances. Which redundancy option aligns with these requirements?

A. Locally-redundant storage (LRS) B. Zone-redundant storage (ZRS) C. Geo-redundant storage (GRS) D. Geo-zone-redundant storage (GZRS)

Answer: B - Zone-redundant storage (ZRS)

Explanation: Zone-redundant storage (ZRS) replicates data synchronously across three availability zones in the primary region. It provides high availability against datacenter outages while keeping all data strictly within the primary geographic region.

Question 50: You need to ensure that an Azure Storage account mandates data-in-transit security by blocking any incoming traffic using unencrypted HTTP requests, while also requiring all HTTPS connections to use a minimum protocol version of TLS 1.2. Which two configurations handle these requirements?

A. Enable "Secure transfer required" and set Minimum TLS Version to "Version 1.2" B. Enable "Infrastructure Encryption" and assign "Storage Blob Data Reader" C. Create a Stored Access Policy and disable "Storage Account Key Access" D. Enable "Blob Public Access" and apply a CanNotDelete resource lock

Answer: A - Enable "Secure transfer required" and set Minimum TLS Version to "Version 1.2"

Explanation: Enforcing "Secure transfer required" blocks unencrypted HTTP traffic (requiring HTTPS), and configuring the "Minimum TLS Version" property to 1.2 ensures that older, insecure TLS/SSL protocols are reject