Examius

🇺🇸 Microsoft Certified: Azure Administrator Associate · subject

Microsoft Certified: Azure Administrator Associate Implement and Manage Storage Syllabus

The Implement and Manage Storage syllabus for Microsoft Certified: Azure Administrator Associate in full: 3 chapters, 14 topics and 14 sub-topics, every one listed below, plus 50 Implement and Manage Storage flashcards with answers.

3Chapters
14Topics
14Sub-topics
50Flashcards

Implement and Manage Storage syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Storage Accounts and Access

     5 topics
    • Creating storage accounts
      • Performance tiers (Standard vs Premium)
      • Account kinds and redundancy (LRS, ZRS, GRS, GZRS, RA-GRS)
    • Configuring network access to storage
      • Firewalls and virtual network rules
      • Service endpoints and private endpoints
    • Access keys and rotation
    • Shared access signatures (SAS)
      • Account, service, and user delegation SAS
      • Stored access policies
    • Microsoft Entra authorization for Blob and Queue

  2. Blob Storage

     4 topics
    • Containers and blob types
      • Block, page, and append blobs
    • Access tiers and lifecycle management
      • Hot, cool, cold, and archive tiers
      • Lifecycle management policy rules
      • Rehydration from archive
    • Blob versioning and soft delete
    • Object replication and immutability policies

  3. Azure Files and Data Transfer

     5 topics
    • Creating and configuring file shares
      • SMB and NFS protocols
      • Identity-based authentication for SMB shares
    • Azure File Sync
      • Sync groups, cloud endpoints, server endpoints
      • Cloud tiering configuration
    • AzCopy for data movement
    • Azure Storage Explorer operations
    • Import/Export service for large datasets

Microsoft Certified: Azure Administrator Associate Implement and Manage Storage flashcards — 50 questions with answers

  1. What four data services are included in an Azure storage account?

    Blob (object) storage, Azure Files (file shares), Queue storage, and Table storage. (Azure Disks use managed disks but blobs underlie unmanaged disks.)

  2. What are the two main storage account performance tiers, and what underlying media back each?

    Standard (backed by HDD) for general-purpose workloads, and Premium (backed by SSD) for low-latency/high-throughput scenarios via specialized account kinds (BlockBlobStorage, FileStorage, PageBlobStorage).

  3. What is the recommended general-purpose storage account type for most new deployments?

    General-purpose v2 (GPv2). It supports all services (blob, file, queue, table), all redundancy options, and access tiers.

  4. List the storage redundancy options that keep all copies within a single region.

    LRS (Locally Redundant Storage – 3 copies in one datacenter) and ZRS (Zone-Redundant Storage – 3 copies across 3 availability zones in one region).

  5. List the geo-redundant storage options and how many copies of data they keep.

    GRS and RA-GRS keep 6 copies (3 LRS in primary + 3 LRS in secondary region). GZRS and RA-GZRS keep 6 copies (ZRS in primary + LRS in secondary). RA- variants add read access to the secondary.

  6. How many copies of your data does LRS maintain and where?

    Three synchronous copies within a single physical location (datacenter) in the primary region. It protects against drive/rack failure but not a datacenter-wide outage.

  7. What durability (annual) does Azure design LRS, ZRS, and GRS to provide?

    LRS: at least 11 nines (99.999999999%). ZRS and GRS: at least 12 nines. GZRS: at least 16 nines of durability over a year.

  8. What naming rules apply to an Azure storage account name?

    3–24 characters, lowercase letters and numbers only, and globally unique across all of Azure (because it forms part of the public endpoint URL).

  9. What is the default network access setting for a new storage account, and how do you restrict it?

    By default it is 'Enabled from all networks' (public). You restrict it via the Networking blade by selecting 'Enabled from selected virtual networks and IP addresses' or 'Disabled' (private endpoint only).

  10. What is a service endpoint versus a private endpoint for storage networking?

    A service endpoint extends a VNet's identity to the storage service over the Azure backbone but uses the public IP/endpoint. A private endpoint assigns a private IP from your VNet to the storage account, keeping traffic fully private.

  11. When you enable selected-network firewall rules on a storage account, what 'Exceptions' option is commonly required?

    'Allow Azure services on the trusted services list to access this storage account', which lets trusted Microsoft services (e.g., Azure Backup, Monitor) bypass the firewall.

  12. How many access keys does each storage account have, and why two?

    Two (key1 and key2). Having two allows zero-downtime key rotation: you switch apps to key2, regenerate key1, then switch back, never breaking access.

  13. What grants when you authorize with a storage account access key?

    Full administrative access to everything in the account. Account keys are like a root password, so Microsoft recommends Entra ID authorization or SAS over keys.

  14. What is the recommended secure store for managing and rotating storage account access keys?

    Azure Key Vault, which can store keys/connection strings and automate rotation via managed identities and key-rotation policies.

  15. What is a Shared Access Signature (SAS)?

    A signed URI that grants restricted, time-limited delegated access to storage resources, specifying allowed permissions, services, resource types, time window, and optionally IP/protocol—without sharing the account key.

  16. Name the three types of SAS in Azure Storage.

    User delegation SAS (signed with Entra ID credentials, Blob only), Service SAS (signed with account key, scoped to one service), and Account SAS (signed with account key, can span multiple services).

  17. Which SAS type is most secure and why?

    User delegation SAS, because it is secured with Microsoft Entra ID credentials (a user delegation key) rather than the account key, and respects Entra permissions; it applies to Blob storage.

  18. What is a stored access policy and what advantage does it give a service SAS?

    A server-side policy on a container/queue/table/share that defines permissions and expiry. A SAS tied to it can be revoked or modified by changing/deleting the policy—giving centralized control and revocation without regenerating account keys.

  19. How do you immediately revoke ALL SAS tokens issued for a storage account?

    Regenerate the account key used to sign them. (For SAS tied to a stored access policy, delete/modify the policy. For user delegation SAS, revoke the user delegation key.)

  20. Which two Azure Storage services support Microsoft Entra ID authorization for data plane operations?

    Azure Blob storage and Azure Queue storage support Entra ID (OAuth) authorization for data operations. (Table also supports it; Files supports Entra for SMB via Kerberos.)

Show the other 30 Implement and Manage Storage flashcards

  1. Which built-in RBAC roles are used for data-plane access to blobs, and how do they differ from control-plane roles?

    Data roles include Storage Blob Data Reader, Storage Blob Data Contributor, and Storage Blob Data Owner. Control-plane roles like Owner/Contributor manage the resource but do NOT grant data access unless they also include data actions or use keys.

  2. What are the three blob types in Azure Storage and their primary use cases?

    Block blobs (text/binary files, up to ~190.7 TiB), Append blobs (optimized for append operations like logging), and Page blobs (random read/write, back Azure VM disks, up to 8 TiB).

  3. What is the maximum size of a single block blob and the maximum block size?

    A block blob can be up to about 190.7 TiB (50,000 blocks Ă— up to 4,000 MiB per block). Default/older max block size is 100 MiB.

  4. What is a container in Blob storage and what are the public access level options?

    A container is a logical grouping of blobs (like a folder at the top level). Public access levels: Private (no anonymous), Blob (anonymous read of blobs only), and Container (anonymous read of blobs + container listing).

  5. List the Azure Blob access (storage) tiers and their intended use.

    Hot (frequent access, lowest access cost/highest storage cost), Cool (infrequent, min 30 days), Cold (rarely accessed, min 90 days), and Archive (offline, lowest storage cost, min 180 days, must be rehydrated to read).

  6. Which blob access tier is offline and requires rehydration before data can be read?

    The Archive tier. To access data you must rehydrate it to Hot or Cool, choosing a rehydration priority of Standard (up to ~15 hours) or High (often under 1 hour).

  7. What are the minimum storage durations (early-deletion charges) for Cool, Cold, and Archive tiers?

    Cool: 30 days. Cold: 90 days. Archive: 180 days. Deleting/moving before these incurs an early deletion charge.

  8. At which scope can the default access tier be set, and which tiers can be set on individual blobs?

    Hot and Cool (and Cold) can be set as the account default; individual blobs can be set to Hot, Cool, Cold, or Archive. Archive is a blob-level-only tier (not an account default).

  9. What is Azure Blob lifecycle management?

    A rule-based policy engine that automatically transitions blobs between tiers or deletes them based on conditions like days since last modified/last accessed or days since creation, applied to selected blob types/prefixes/index tags.

  10. Give an example lifecycle rule condition and action.

    Example: 'tierToCool after 30 days since last modified, tierToArchive after 90 days, delete after 365 days.' Conditions include daysAfterModificationGreaterThan, daysAfterLastAccessTimeGreaterThan, and daysAfterCreationGreaterThan.

  11. What is blob versioning and what triggers a new version?

    A feature that automatically maintains previous versions of a blob. When enabled, any modification (overwrite, delete metadata change, etc.) creates a new version with a unique version ID, preserving the prior state for recovery.

  12. What is the difference between blob soft delete and container soft delete?

    Blob soft delete retains deleted blobs/versions/snapshots for a configurable retention period (1–365 days). Container soft delete retains an entire deleted container (1–365 days) so it can be restored.

  13. What retention range is configurable for blob soft delete?

    1 to 365 days. Within that window, deleted (or overwritten) blobs can be undeleted; after it, they are permanently removed.

  14. What is Azure Blob object replication?

    Asynchronous replication of block blobs from a source container in one storage account to a destination container in another (often in a different region/account), based on replication rules and prefix filters. Requires versioning and change feed enabled.

  15. What prerequisites must be enabled for object replication to work?

    Blob versioning must be enabled on both source and destination accounts, and the change feed must be enabled on the source account.

  16. What is an immutability policy (WORM) in Blob storage?

    A Write Once, Read Many policy that prevents blobs from being modified or deleted for a period. Types: time-based retention (locked or unlocked) and legal hold (held until explicitly cleared). Used for compliance (e.g., SEC 17a-4).

  17. What is the difference between a legal hold and a time-based retention immutability policy?

    Time-based retention locks data for a set interval (then becomes deletable). Legal hold has no expiry—data stays immutable until the named legal hold tag is explicitly removed. Both can apply at container or version (blob) scope.

  18. What protocols do Azure Files shares support, and what is the standard maximum share size?

    SMB and NFS (NFS on premium FileStorage accounts). Standard shares default to 5 TiB but can be enabled for large file shares up to 100 TiB; premium shares support up to 100 TiB.

  19. What authentication methods are available for Azure Files SMB shares?

    Storage account key, Entra Domain Services (Entra DS) authentication, on-premises Active Directory Domain Services (AD DS) identity-based auth, and Microsoft Entra Kerberos for hybrid identities.

  20. What is Azure File Sync?

    A service that synchronizes on-premises Windows Server file shares with an Azure file share, turning the server into a fast local cache while keeping a full copy in the cloud—enabling centralization and multi-site sync.

  21. What is cloud tiering in Azure File Sync?

    A feature where infrequently accessed files are tiered (their contents moved) to the Azure file share, leaving a pointer/recall stub on the local server to save space; files are recalled on access based on free-space or date policies.

  22. List the key components of an Azure File Sync deployment.

    Storage Sync Service (top-level Azure resource), Sync Group (defines the topology), Cloud Endpoint (an Azure file share), Server Endpoint (a path on a registered server), and the registered server running the Azure File Sync agent.

  23. What is AzCopy?

    A command-line utility for high-performance copying/moving of data to and from Azure Blob and File storage. It supports parallel transfers, resume, sync, and authorization via SAS tokens or Entra ID login.

  24. Which AzCopy command synchronizes a source and destination, and how does it differ from copy?

    'azcopy sync' makes the destination match the source (transfers only changed/new files and can delete extras). 'azcopy copy' transfers data without ensuring deletion of items absent at the source.

  25. What two authorization methods can AzCopy use?

    A Shared Access Signature (SAS) token appended to the resource URL, or Microsoft Entra ID authentication via 'azcopy login' (interactive or with a managed identity/service principal).

  26. What is Azure Storage Explorer?

    A free, standalone cross-platform GUI app (Windows/macOS/Linux) for managing Azure Storage—browse and manage blobs, files, queues, tables and ADLS Gen2, upload/download data, manage access, and generate SAS tokens.

  27. What sign-in/connection methods does Azure Storage Explorer support?

    Entra ID account login, connection string, account name and key, a SAS URI, or a local emulator (Azurite). It can attach to individual resources or whole subscriptions.

  28. What is the Azure Import/Export service used for?

    Securely transferring large amounts of data into or out of Azure Blob storage (and import into Azure Files) by shipping physical disk drives to/from an Azure datacenter, useful when network transfer is too slow or costly.

  29. What tool prepares drives for an Azure Import job and what encryption is used?

    The WAImportExport tool prepares and encrypts the drives. Data is protected with BitLocker (AES-256) encryption; the keys are provided to Azure as part of the job.

  30. What is the difference between an Import job and an Export job in Azure Import/Export?

    Import: you ship your own disks containing data, and Azure copies it INTO Blob/File storage. Export: Azure copies data OUT of Blob storage onto disks you supply (drives shipped to you). Export supports Blob storage only.

Microsoft Certified: Azure Administrator Associate Implement and Manage Storage FAQ

What is in the Microsoft Certified: Azure Administrator Associate Implement and Manage Storage syllabus?

Microsoft Certified: Azure Administrator Associate Implement and Manage Storage is split into 3 chapters: Storage Accounts and Access, Blob Storage and Azure Files and Data Transfer. Together they contain 14 topics and 14 sub-topics.

How many chapters are in Microsoft Certified: Azure Administrator Associate Implement and Manage Storage?

3 chapters, containing 14 topics and 14 sub-topics. The largest chapter is Storage Accounts and Access, with 5 topics.

Are there flashcards for Microsoft Certified: Azure Administrator Associate Implement and Manage Storage?

Yes — a 50-card Implement and Manage Storage deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.