Microsoft Certified: Azure Administrator Associate Implement and Manage Storage Syllabus

Implement and Manage Storage syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Implement and Manage Storage in Microsoft Certified: Azure Administrator Associate, not a summary of it.

1. 1

   Storage Accounts and Access

   5 topics

   • Creating storage accounts
     • Performance tiers (Standard vs Premium)
     • Account kinds and redundancy (LRS, ZRS, GRS, GZRS, RA-GRS)
   • Configuring network access to storage
     • Firewalls and virtual network rules
     • Service endpoints and private endpoints
   • Access keys and rotation
   • Shared access signatures (SAS)
     • Account, service, and user delegation SAS
     • Stored access policies
   • Microsoft Entra authorization for Blob and Queue
2. 2

   Blob Storage

   4 topics

   • Containers and blob types
     • Block, page, and append blobs
   • Access tiers and lifecycle management
     • Hot, cool, cold, and archive tiers
     • Lifecycle management policy rules
     • Rehydration from archive
   • Blob versioning and soft delete
   • Object replication and immutability policies
3. 3

   Azure Files and Data Transfer

   5 topics

   • Creating and configuring file shares
     • SMB and NFS protocols
     • Identity-based authentication for SMB shares
   • Azure File Sync
     • Sync groups, cloud endpoints, server endpoints
     • Cloud tiering configuration
   • AzCopy for data movement
   • Azure Storage Explorer operations
   • Import/Export service for large datasets

Implement and Manage Storage flashcards for Microsoft Certified: Azure Administrator Associate

20 of 50 cards from the Implement and Manage Storage deck — real questions with worked answers.

1. What four data services are included in an Azure storage account?

   Blob (object) storage, Azure Files (file shares), Queue storage, and Table storage. (Azure Disks use managed disks but blobs underlie unmanaged disks.)

2. What are the two main storage account performance tiers, and what underlying media back each?

   Standard (backed by HDD) for general-purpose workloads, and Premium (backed by SSD) for low-latency/high-throughput scenarios via specialized account kinds (BlockBlobStorage, FileStorage, PageBlobStorage).

3. What is the recommended general-purpose storage account type for most new deployments?

   General-purpose v2 (GPv2). It supports all services (blob, file, queue, table), all redundancy options, and access tiers.

4. List the storage redundancy options that keep all copies within a single region.

   LRS (Locally Redundant Storage – 3 copies in one datacenter) and ZRS (Zone-Redundant Storage – 3 copies across 3 availability zones in one region).

5. List the geo-redundant storage options and how many copies of data they keep.

   GRS and RA-GRS keep 6 copies (3 LRS in primary + 3 LRS in secondary region). GZRS and RA-GZRS keep 6 copies (ZRS in primary + LRS in secondary). RA- variants add read access to the secondary.

6. How many copies of your data does LRS maintain and where?

   Three synchronous copies within a single physical location (datacenter) in the primary region. It protects against drive/rack failure but not a datacenter-wide outage.

7. What durability (annual) does Azure design LRS, ZRS, and GRS to provide?

   LRS: at least 11 nines (99.999999999%). ZRS and GRS: at least 12 nines. GZRS: at least 16 nines of durability over a year.

8. What naming rules apply to an Azure storage account name?

   3–24 characters, lowercase letters and numbers only, and globally unique across all of Azure (because it forms part of the public endpoint URL).

9. What is the default network access setting for a new storage account, and how do you restrict it?

   By default it is 'Enabled from all networks' (public). You restrict it via the Networking blade by selecting 'Enabled from selected virtual networks and IP addresses' or 'Disabled' (private endpoint only).

10. What is a service endpoint versus a private endpoint for storage networking?

    A service endpoint extends a VNet's identity to the storage service over the Azure backbone but uses the public IP/endpoint. A private endpoint assigns a private IP from your VNet to the storage account, keeping traffic fully private.

11. When you enable selected-network firewall rules on a storage account, what 'Exceptions' option is commonly required?

    'Allow Azure services on the trusted services list to access this storage account', which lets trusted Microsoft services (e.g., Azure Backup, Monitor) bypass the firewall.

12. How many access keys does each storage account have, and why two?

    Two (key1 and key2). Having two allows zero-downtime key rotation: you switch apps to key2, regenerate key1, then switch back, never breaking access.

13. What grants when you authorize with a storage account access key?

    Full administrative access to everything in the account. Account keys are like a root password, so Microsoft recommends Entra ID authorization or SAS over keys.

14. What is the recommended secure store for managing and rotating storage account access keys?

    Azure Key Vault, which can store keys/connection strings and automate rotation via managed identities and key-rotation policies.

15. What is a Shared Access Signature (SAS)?

    A signed URI that grants restricted, time-limited delegated access to storage resources, specifying allowed permissions, services, resource types, time window, and optionally IP/protocol—without sharing the account key.

16. Name the three types of SAS in Azure Storage.

    User delegation SAS (signed with Entra ID credentials, Blob only), Service SAS (signed with account key, scoped to one service), and Account SAS (signed with account key, can span multiple services).

17. Which SAS type is most secure and why?

    User delegation SAS, because it is secured with Microsoft Entra ID credentials (a user delegation key) rather than the account key, and respects Entra permissions; it applies to Blob storage.

18. What is a stored access policy and what advantage does it give a service SAS?

    A server-side policy on a container/queue/table/share that defines permissions and expiry. A SAS tied to it can be revoked or modified by changing/deleting the policy—giving centralized control and revocation without regenerating account keys.

19. How do you immediately revoke ALL SAS tokens issued for a storage account?

    Regenerate the account key used to sign them. (For SAS tied to a stored access policy, delete/modify the policy. For user delegation SAS, revoke the user delegation key.)

20. Which two Azure Storage services support Microsoft Entra ID authorization for data plane operations?

    Azure Blob storage and Azure Queue storage support Entra ID (OAuth) authorization for data operations. (Table also supports it; Files supports Entra for SMB via Kerberos.)

See more Implement and Manage Storage flashcards →

Planning Implement and Manage Storage for Microsoft Certified: Azure Administrator Associate

Implement and Manage Storage (Microsoft Certified: Azure Administrator Associate) FAQ