Examius
🇬🇧 Microsoft Azure Certifications (e.g. AZ-104, AZ-900) · flashcards
Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Implement and Manage Storage (AZ-104) Flashcards
50 question-and-answer cards covering Implement and Manage Storage (AZ-104) as it is examined in Microsoft Azure Certifications (e.g. AZ-104, AZ-900). 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Implement and Manage Storage (AZ-104) deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
Compare Microsoft-managed keys, customer-managed keys, and customer-provided keys for storage encryption.
Microsoft-managed keys: default, Microsoft handles all key management. Customer-managed keys (CMK): you supply/manage keys in Azure Key Vault or Managed HSM for account-level encryption control and rotation. Customer-provided keys (CPK): the client passes a key on each Blob request for per-request encryption.
What is infrastructure encryption in Azure Storage?
An optional second layer of encryption (double encryption) applied at the infrastructure level using a separate Microsoft-managed key, in addition to the standard service-level encryption. It must be enabled at account creation and protects data even if one encryption key is compromised.
What is the structure of the blob storage hierarchy?
Storage account → containers → blobs. A container groups blobs (like a directory at the top level). Blobs live inside containers; flat namespace by default (virtual folders are simulated by '/' in blob names) unless hierarchical namespace (Data Lake Gen2) is enabled.
What are the three types of blobs and their uses?
Block blobs: store text/binary objects up to ~190.7 TiB, optimized for upload/streaming (the default). Append blobs: optimized for append operations like logging. Page blobs: random read/write 512-byte pages up to 8 TiB, used for Azure VM disks (VHDs).
What public access levels can a blob container have?
Private (no anonymous access—default), Blob (anonymous read of blobs only, not container listing), and Container (anonymous read and list of blobs and container metadata). Anonymous access also requires that it be allowed at the account level.
List the Azure Blob storage access tiers and their intended access frequency.
Hot: frequently accessed/hot data, highest storage cost, lowest access cost. Cool: infrequently accessed, stored ≥30 days, lower storage cost, higher access cost. Cold: rarely accessed, stored ≥90 days. Archive: rarely accessed, stored ≥180 days, offline, lowest storage cost but requires rehydration to read.
Which blob access tiers can be set at the account level, and which is blob-level only?
Hot and Cool can be set as the default at the account level (and per blob). Cold and Archive are blob/object-level tiers only—Archive cannot be a default account tier and applies to individual blobs.
What is required to read data from an archived blob, and what are the rehydration priorities?
Archive is offline; the blob must be rehydrated to an online tier (Hot/Cool) or copied to a new online blob. Two priorities: Standard (may take up to ~15 hours) and High (often under 1 hour for objects under 10 GB). The data is unreadable until rehydration completes.
What is a blob lifecycle management policy and what actions can it automate?
A rule-based policy (JSON) on a storage account that automatically transitions blobs between tiers or deletes them based on age/last-modified or last-accessed time. Actions include tierToCool, tierToCold, tierToArchive, delete, and equivalents for snapshots/versions—used to optimize cost.
In a lifecycle policy, what does 'daysAfterModificationGreaterThan' control?
It is the condition specifying the number of days since the blob was last modified (or since creation/last access depending on filter) after which the associated action (tier change or delete) is applied. Example: tierToArchive after $\text{daysAfterModificationGreaterThan} = 180$.
What is blob soft delete and what does it protect against?
Soft delete retains deleted or overwritten blobs (and optionally containers) for a configurable retention period (1–365 days), allowing recovery before permanent deletion. It protects against accidental deletion or overwrite of data.
What is blob versioning and how does it differ from snapshots?
Blob versioning automatically maintains previous versions of a blob each time it is modified or deleted, so you can restore or read earlier states. Snapshots are read-only, manually (or policy) created point-in-time copies. Versioning is automatic on write; snapshots are explicit captures.
What is point-in-time restore for block blobs and what must be enabled for it?
Point-in-time restore lets you restore one or more containers to a prior state within a retention window. It requires that soft delete, versioning, and the blob change feed all be enabled on the account.
What is an immutable blob storage policy, and what are its two types?
Immutable storage enforces WORM (Write Once, Read Many) so data cannot be modified or deleted for a period. Two types: time-based retention policy (immutable for N days) and legal hold (immutable until the named tag/hold is removed). Used for compliance (e.g., SEC 17a-4).
What protocols and OS support does Azure Files provide?
Azure Files offers fully managed file shares accessible via SMB (2.1/3.0/3.1.1) on Windows, Linux, and macOS, and via NFS (v4.1) on premium shares for Linux. It also supports access through the Azure Files REST API and Azure File Sync.
What are the two tiers/billing models for Azure file shares?
Standard file shares (transaction-optimized, hot, cool) use a pay-as-you-go model on HDD-backed storage. Premium file shares use SSD-backed storage in a FileStorage account with a provisioned model—you pay for provisioned GiB, IOPS, and throughput regardless of usage.
What port must be open to mount an Azure file share over SMB, and why is it often a problem?
SMB uses TCP port 445. Many ISPs and corporate firewalls block port 445 outbound, which prevents direct internet mounting. Workarounds include VPN/ExpressRoute, a private endpoint, or SMB over QUIC (port 443) via Azure File Sync/Windows Server.
What is Azure File Sync and what does it enable?
Azure File Sync centralizes file shares in Azure Files while caching them on one or more on-premises (or cloud) Windows Servers. The server presents a local SMB/NFS share with the performance of a local file server, while Azure holds the master copy—enabling multi-site sync and cloud tiering.
List the core components of an Azure File Sync deployment.
Storage Sync Service (top-level Azure resource), Sync Group (defines the sync topology), Cloud Endpoint (an Azure file share in the sync group), Server Endpoint (a path on a registered Windows Server), and the Azure File Sync agent installed on each registered server.
What is cloud tiering in Azure File Sync?
Cloud tiering is an optional Azure File Sync feature that keeps frequently accessed (hot) files cached locally on the server while tiering infrequently used (cool) files up to the Azure file share, leaving a pointer/reparse point locally. It conserves on-premises disk space; you set a free-space or date policy.
What is the difference between the cloud endpoint and a server endpoint in a sync group?
A cloud endpoint is the Azure file share that serves as the authoritative cloud copy in the sync group (only one per sync group). A server endpoint is a specific folder path on a registered Windows Server; multiple server endpoints can sync to the same cloud endpoint, enabling many-site synchronization.
How are Azure file shares backed up, and what service is used?
Azure file shares are protected by Azure Backup using a Recovery Services vault. Backup uses share snapshots; you define a backup policy with schedule and retention. Snapshots are stored within the storage account and enable item-level (file/folder) and full-share restore.
What is the difference between snapshot-based protection and soft delete for Azure Files?
Share snapshots are read-only point-in-time copies (manual or via Azure Backup) used to restore files. Soft delete for file shares retains a deleted share (and its snapshots) for a configurable retention period (1–365 days) so the whole share can be recovered after accidental deletion.
What two restore granularities does Azure Backup support for Azure file shares?
Full-share restore (restore the entire file share to a snapshot's state, to the original or an alternate location) and item-level (individual file/folder) restore. Restores can overwrite originals or write to an alternate location to avoid data loss.
What this deck covers
The Implement and Manage Storage (AZ-104) deck follows the Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Implement and Manage Storage (AZ-104) syllabus — 4 chapters and 12 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 12.5 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 268 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Implement and Manage Storage (AZ-104) flashcards FAQ
How many Implement and Manage Storage (AZ-104) flashcards are in this Microsoft Azure Certifications (e.g. AZ-104, AZ-900) deck?
50 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Microsoft Azure Certifications (e.g. AZ-104, AZ-900) flashcards free?
Yes. The preview here is free to read with no signup, and the full 50-card deck is free inside the Examius app.
What do the Implement and Manage Storage (AZ-104) cards cover?
They follow the Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Implement and Manage Storage (AZ-104) syllabus — 4 chapters and 12 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.