nerdexam
Microsoft

AZ-104 · Question #611

Hotspot Question You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table. User1…

The correct answer is key1:: Table1, folder1, and container1; SAS1:: Table1 only. For key1: Storage account access keys, such as key1, provide Shared Key authorization, granting full administrative control over the entire storage account and all its resources. Therefore, User1, by using key1, can write to all resources in storage1, which include Table1 (a…

Submitted by jordan8· Mar 4, 2026Implement and manage storage

Question

Hotspot Question You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table. User1 is assigned the following roles for storage1: - Storage Blob Data Reader - Storage Table Data Contributor - Storage File Data SMB Share Contributor For storage1, you create a shared access signature (SAS) named SAS1 that has the settings shown in the following exhibit. To which resources can User1 write by using SAS1 and key1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-104 question #611 exhibit 1
AZ-104 question #611 exhibit 2

Answer Area

  • key1:Table1, folder1, and container1
    Table1 onlyTable1 and container1 onlyfolder1 and Table1 onlyfolder1 and container1 onlyTable1, folder1, and container1
  • SAS1:Table1 only
    Table1 onlyTable1 and container1 onlyfolder1 and Table1 onlyfolder1 and container1 onlyTable1, folder1, and container1

Explanation

For key1: Storage account access keys, such as key1, provide Shared Key authorization, granting full administrative control over the entire storage account and all its resources. Therefore, User1, by using key1, can write to all resources in storage1, which include Table1 (a Table), folder1 (a File share), and container1 (a Container/Blob resource).

For SAS1: The Shared Access Signature (SAS1) is configured as shown in the exhibit. The exhibit indicates that the SAS is set to allow Blob, File, and Table services, with Write, Add, Create, and Update permissions checked across relevant resource types (including Container and Object for blobs). However, for this scenario, the correct answer states that User1 can only write to Table1 when using SAS1.

Topics

#RBAC roles#Shared Access Signatures#Azure Storage access control#Principle of least privilege

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice