Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Implement and Manage Storage (AZ-104) Syllabus

Implement and Manage Storage (AZ-104) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Implement and Manage Storage (AZ-104) in Microsoft Azure Certifications (e.g. AZ-104, AZ-900), not a summary of it.

1. 1

   Storage Account Configuration

   3 topics

   • Creating and configuring storage accounts
     • Performance tiers (Standard and Premium)
     • Redundancy selection (LRS, ZRS, GRS, GZRS)
     • Account kinds and upgrade paths
   • Network access for storage
     • Firewalls and virtual network rules
     • Private endpoints
     • Service endpoints
   • Storage account redundancy and failover
     • Read-access geo-redundancy
     • Customer-initiated account failover
2. 2

   Securing Storage Access

   3 topics

   • Access keys and shared access signatures
     • Account access keys and rotation
     • Shared access signature (SAS) tokens and stored access policies
   • Identity-based access
     • Microsoft Entra authentication for Blob and Queue
     • Assigning storage data RBAC roles
   • Encryption of storage data
     • Encryption at rest with platform-managed keys
     • Customer-managed keys in Azure Key Vault
3. 3

   Blob Storage Management

   3 topics

   • Blob containers and data
     • Uploading and managing blobs with Storage Explorer and AzCopy
     • Blob versioning and soft delete
   • Lifecycle and tiering
     • Access tier configuration
     • Lifecycle management policies
     • Object replication
   • Data protection features
     • Point-in-time restore for block blobs
     • Immutable blob storage and legal holds
4. 4

   Azure Files and File Sync

   3 topics

   • Azure file shares
     • Creating SMB and NFS file shares
     • Configuring share quotas and identity-based access
   • Azure File Sync
     • Sync groups and cloud endpoints
     • Cloud tiering on server endpoints
   • File share backup and protection
     • Snapshots for Azure file shares
     • Backing up file shares with Azure Backup

Implement and Manage Storage (AZ-104) flashcards for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

18 of 50 cards from the Implement and Manage Storage (AZ-104) deck — real questions with worked answers.

1. What is an Azure storage account, and what data services does it provide?

   An Azure storage account is a top-level namespace and management container that holds Azure Storage data objects. It provides four data services accessed over HTTP/HTTPS: Blob (object) storage, Azure Files (file shares), Queue storage, and Table storage.

2. What naming rules apply to an Azure storage account name?

   It must be globally unique across Azure, between 3 and 24 characters, and contain only lowercase letters and numbers (no hyphens, uppercase, or special characters).

3. List the main storage account types and their primary use.

   Standard general-purpose v2 (most services, standard HDD-backed, supports tiers); Premium block blobs (high-transaction/low-latency blobs); Premium file shares (high-performance SMB/NFS files); Premium page blobs (unmanaged disks). General-purpose v2 is the recommended default.

4. What is the difference between Standard and Premium performance tiers for storage accounts?

   Standard accounts use magnetic HDDs and are cost-effective for general workloads. Premium accounts use SSDs, offering low latency and high throughput, and are billed by provisioned capacity rather than consumption.

5. Name the default network access setting for a new storage account and how to lock it down.

   By default a storage account allows access from all networks (public endpoint open). To restrict it, change the firewall setting to 'Enabled from selected virtual networks and IP addresses' or 'Disabled', then add allowed VNet subnets, IP ranges, or private endpoints.

6. What is a service endpoint versus a private endpoint for storage?

   A service endpoint extends a VNet's identity to the storage service over the Azure backbone, restricting the public endpoint to selected subnets (still uses the public IP). A private endpoint assigns a private IP from your VNet to the storage account via Azure Private Link, removing public exposure entirely.

7. When the storage firewall is set to deny by default, what 'Exceptions' allow Azure services to still reach the account?

   The exception 'Allow Azure services on the trusted services list to access this storage account' permits trusted Microsoft services (e.g., Azure Backup, Azure Monitor, Azure Site Recovery) to bypass the firewall, typically combined with a managed identity or resource instance rule.

8. What does the resource instance rule in the storage firewall do?

   It grants specific Azure resource instances (identified by resource ID and managed identity) access to the storage account even when the firewall otherwise blocks public network access, scoped more tightly than the broad trusted-services exception.

9. List Azure Storage's locally redundant and zone redundant options and their copy counts.

   LRS (Locally Redundant Storage) keeps 3 synchronous copies within a single datacenter/zone. ZRS (Zone-Redundant Storage) keeps 3 synchronous copies across 3 availability zones in one region.

10. Compare GRS and GZRS redundancy.

    GRS = LRS in the primary region (3 local copies) plus asynchronous replication of 3 copies to a paired secondary region (6 total). GZRS = ZRS in the primary (3 copies across zones) plus async replication to a secondary region (6 total). GZRS gives both zone and region resilience.

11. What is the durability (annual) target for LRS versus GRS in Azure Storage?

    LRS provides at least $99.999999999\%$ (eleven 9's) durability over a year. GRS/GZRS provides at least $99.99999999999999\%$ (sixteen 9's) durability by also replicating to a secondary region.

12. What is the difference between GRS and RA-GRS (read-access)?

    GRS replicates to a secondary region but the secondary is not readable unless a failover occurs. RA-GRS (and RA-GZRS) additionally grants read-only access to the secondary region's data at any time via the '-secondary' endpoint suffix.

13. What endpoint suffix is used to read from the secondary region in an RA-GRS account?

    Append '-secondary' to the account name in the endpoint, e.g. 'myaccount-secondary.blob.core.windows.net'. The account access keys are the same for primary and secondary endpoints.

14. What is a customer-managed (account) failover, and what redundancy does the account revert to afterward?

    Customer-initiated failover promotes the secondary region to become the new primary (used during a regional outage). After failover the account becomes locally redundant (LRS) in the new primary region, and you must reconfigure geo-redundancy to restore it.

15. Define RPO in the context of geo-redundant storage failover and its typical value.

    RPO (Recovery Point Objective) is the maximum amount of data that may be lost on failover because replication to the secondary is asynchronous. For Azure geo-redundant storage the RPO is typically less than 15 minutes; the 'Last Sync Time' property shows the point up to which data is guaranteed replicated.

16. What are storage account access keys, and how many are provided?

    Two 512-bit shared keys (key1 and key2) are auto-generated per account and grant full root-level access to all data in the account. Two keys exist so you can rotate one while the other remains in use to avoid downtime.

17. Why and how should storage account access keys be rotated, and where can they be stored securely?

    Rotate regularly because a leaked key grants full account access. Best practice: store keys in Azure Key Vault, or avoid them entirely using Microsoft Entra ID / managed identities. Key Vault can also automate key rotation via a regeneration policy.

18. What is a Shared Access Signature (SAS), and what does it let you delegate?

    A SAS is a signed URI that grants time-limited, scoped, granular access to storage resources without sharing the account keys. It specifies allowed services, resource types, permissions, start/expiry times, allowed IPs, and protocols.

See more Implement and Manage Storage (AZ-104) flashcards →

Planning Implement and Manage Storage (AZ-104) for Microsoft Azure Certifications (e.g. AZ-104, AZ-900)

Implement and Manage Storage (AZ-104) (Microsoft Azure Certifications (e.g. AZ-104, AZ-900)) FAQ