Microsoft Certified: Azure Administrator Associate - (AZ-104) Exam Questions

blockBlob is the correct answer. Block blobs are designed to store large amounts of unstructured data, such as images or backups, which is the use case described here with thousands of image files. Additionally, block blobs are more suitable for use cases where data needs to be frequently accessed, stored, or replaced (such as in a daily CSV file). This fits the requirements for the blob inventory rule where you need to filter blobs whose names start with "finance."

appendBlob is incorrect because it is generally used for log data where the need is to continuously append new data. It is not optimized for image storage or daily CSV storage.

pageBlob is incorrect because page blobs are typically used for storing virtual hard disks (VHDs) for Azure virtual machines, not for storing images or daily CSV files.

Reference(s):

• https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction

• https://learn.microsoft.com/en-us/rest/api/storageservices/understanding-block-blobs--append-blobs--and-page-blobs

container1/finance is the correct answer. According to the documentation, the prefix match string in a blob policy must always start with the container name followed by the desired blob name prefix. In this case, "container1" is the container, and "finance" is the required blob prefix, making container1/finance the appropriate match string for blobs starting with the word "finance."

container1/* is incorrect because it would match all blobs within the container and not only those starting with "finance."

finance is incorrect because it does not include the container name as required by the blob policy format.

Reference(s):

• https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-faq#the-blob-prefix-match-string-didn-t-apply-the-policy-to-the-expected-blobs

Container is the correct answer here. Azure Object Replication is a feature of Azure Blob Storage, and it works at the container level. To replicate blobs from one storage account to another, you must configure object replication policies between source and destination containers. This means that in the new storage account, you must create a container, as it's the fundamental object that holds blobs (such as images in this case). Without a container, the replication policy cannot be configured or function.

File share is incorrect because object replication does not support Azure Files. File shares are used in Azure Files, which is a completely separate service from Blob Storage, and is not part of object replication capabilities.

Table is incorrect because Azure Table storage is used for NoSQL structured data, and again, object replication only applies to block blobs in containers, not table data.

Queue is incorrect because Azure Queue Storage is designed for messaging between application components. It is not related to blob storage or object replication and cannot be used for replicating blob data.

Reference(s):

• https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-overview

• https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-configure?tabs=portal

• https://learn.microsoft.com/en-us/azure/storage/queues/storage-queues-introduction

• https://learn.microsoft.com/en-us/azure/storage/files/storage-files-introduction

• https://learn.microsoft.com/en-us/azure/storage/tables/table-storage-overview

StorageV2 or BlobStorage only is correct because object replication is supported by both general-purpose v2 storage accounts (StorageV2) and premium block blob storage accounts (BlobStorage). These account types meet the requirements for object replication, allowing replication of blobs between the source and destination accounts.

StorageV2 only is incorrect because while StorageV2 supports object replication, premium block blob storage accounts (BlobStorage) also support object replication, and they should not be excluded from the correct answer.

StorageV2 or FileStorage only and StorageV2, BlobStorage, or FileStorage are incorrect because FileStorage accounts do not support blob storage, which is necessary for object replication.

Reference(s):

• https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-overview

No is correct because while a private endpoint connection allows secure access to the container registry over a private network, it does not resolve all potential issues with deploying a container instance. The error might be related to permissions, image availability, or networking configuration rather than the absence of a private endpoint. Other issues like missing Azure Container Instance permissions, registry access policies, or image tags could prevent deployment.

A more appropriate solution would be ensuring that the container instance has the proper permissions to pull images from the registry. This can be done by checking if the container instance has the necessary identities (system-assigned or user-assigned) and permissions to access the container registry.

Reference(s):

• https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link

No is correct because selecting "Use dedicated data endpoint" for Registry1 is primarily used to isolate data plane traffic from management plane traffic in a container registry. While it improves network security and performance, it does not directly address issues related to deploying a container instance using an image. The error message could be caused by other factors, such as missing permissions, improper image tags, or incorrect access configurations for the Azure Container Instance. Using a dedicated data endpoint does not resolve these issues.

A more suitable solution would involve verifying the necessary access permissions and configurations to ensure the container instance can pull the image from the registry.

Reference(s):

• https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link

No is correct because assigning the AcrPull role to ACR-Tasks-Network does not resolve the error when deploying a container instance. The AcrPull role allows a service or identity to pull images from the container registry, but ACR-Tasks-Network is typically used for managing tasks within the Azure Container Registry (ACR). This role is unrelated to the container instance’s ability to pull images from the registry. The container instance itself or the identity running the container instance should have the AcrPull role assigned for successful image deployment.

A better solution would involve assigning the AcrPull role to the identity or service principal running the container instance, ensuring it has permission to pull images from the registry.

Reference(s):

• https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli

• https://learn.microsoft.com/en-us/azure/container-instances/container-instances-managed-identity

Yes is correct because enabling the Admin user on the Azure container registry provides credentials (username and password) that can be used to authenticate and pull images from the registry. This can resolve authentication issues when deploying a container instance, as the container instance can use the admin credentials to access the registry and pull image1. This is a quick solution to grant access, especially when other identity-based methods, such as Microsoft Entra, are not configured.

Reference(s):

• https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli

• https://learn.microsoft.com/en-us/azure/container-instances/container-instances-using-azure-container-registry

No is correct because the Storage Account Encryption Scope Contributor role does not grant permissions to list or regenerate storage account keys. To enable a user to list and regenerate storage account keys, the user needs to have the Storage Account Key Operator Service Role or Storage Account Contributor role. These roles specifically allow the management of storage account keys, which is not covered by the Storage Account Encryption Scope Contributor role.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Yes is correct because the Storage Account Key Operator Service Role grants the necessary permissions to list and regenerate storage account keys without providing broader access to the storage account's data. This role is specifically designed for key management tasks, allowing the user to perform actions related to storage account keys.

Assigning this role to User1 will enable them to list and regenerate the keys for storage1 as required.

Reference(s):

• https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-account-key-operator-service-role

• https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage?tabs=azure-portal