2.3 - Azure Files, File Sync and data movement tools
AZ-104 objective 2.3 covers moving data into Azure Storage and managing Azure Files. Several tools handle transfers: AzCopy is a command-line copier that authenticates with a SAS or with Microsoft Entra credentials, Azure Storage Explorer is the free graphical client for uploading and downloading blobs, and the portal handles small ad-hoc transfers. Azure Files serves SMB and NFS shares; premium shares require a FileStorage account kind, and on a Linux VM you attach an SMB share natively with the mount command. Azure File Sync caches an Azure file share on one or more on-premises Windows Servers while the authoritative master copy stays in the cloud: you install the Azure File Sync agent on each server and register it before it can join a sync group, and cloud tiering keeps only hot, frequently used files on local disk while cold files stay in Azure. When two users edit the same file on different File Sync servers and save at nearly the same time, File Sync keeps both changes by saving the losing write as a separate conflict copy rather than discarding it. Expect scenarios that ask which data-movement or file-sharing tool fits.
Free graphical upload and download = Storage Explorer; scriptable copy with SAS or Entra = AzCopy. Cache an Azure file share on-premises = Azure File Sync (install and register the agent). Premium shares need a FileStorage account. Conflicts keep both as a copy.
Practice questions
1. You want an on-premises Windows Server to cache an Azure file share locally while the master copy lives in Azure. Which service do you use?
- Azure File Sync (correct answer)
- Azure Import/Export using physical disks that are shipped to the datacenter and back
- Azure Data Box
- A blob lifecycle rule
Azure File Sync turns a Windows Server into a fast local cache of an Azure file share, syncing changes and tiering cold files to the cloud. Import/Export and Data Box move bulk data physically, and a lifecycle rule manages blob tiers.
2. Windows clients must mount an Azure file share as a mapped network drive. Which protocol does the share use?
- SMB (correct answer)
- NFS version 4.1, which is instead the protocol used by Linux and macOS clients that do not speak Server Message Block
- FTP
- iSCSI
Azure Files SMB shares use the Server Message Block protocol over port 445, which Windows mounts natively as a drive letter. NFS 4.1 targets Linux, FTP is not offered, and iSCSI is block storage.
3. You need an NFS 4.1 file share on Azure Files. Which storage account tier is required?
- Premium FileStorage (correct answer)
- A standard general-purpose v2 account, which only supports SMB shares and cannot host any NFS file share at all
- Standard blob storage
- Cool tier general-purpose v1
NFS 4.1 shares are only available on premium FileStorage accounts backed by SSD. Standard general-purpose v2 accounts serve SMB shares only, and blob or v1 accounts do not host NFS file shares.
4. You must cap how much data an SMB file share can consume so it never exceeds a set size. What do you set on the share?
- A quota (correct answer)
- A blob lifecycle management rule that automatically moves older objects to the archive tier after a retention period
- A resource lock
- A private endpoint
A share quota sets the maximum size an Azure file share may grow to. Lifecycle rules apply to blobs, not file shares, a resource lock prevents deletion, and a private endpoint governs network access.
5. You want point-in-time, read-only copies of an entire Azure file share to recover earlier file versions. Which feature provides this?
- Share snapshots (correct answer)
- A geo-redundant failover of the storage account to its paired secondary region followed by a full account restore
- A CanNotDelete lock
- A shared access signature
Share snapshots are incremental, read-only point-in-time copies of a file share used to restore earlier file versions. A geo failover is a disaster measure, a lock prevents deletion, and a SAS grants scoped access.
6. Domain-joined users must access an SMB share with their existing on-premises Active Directory credentials, with no domain controllers deployed in Azure. Which option do you enable?
- AD DS authentication (correct answer)
- Entra Domain Services authentication, which requires a managed domain running inside Azure rather than your own on-premises directory
- The storage account access key
- Anonymous access
AD DS authentication lets Azure Files use your on-premises Active Directory identities directly, no Azure domain controllers needed. Entra Domain Services requires a managed domain in Azure, the account key bypasses identity, and anonymous access is not supported for SMB.