2.1 - Storage accounts, redundancy and shared access signatures
AZ-104 objective 2.1 covers creating and securing storage accounts. The account name sets the public endpoint URL, such as mydata.blob.core.windows.net, and some properties, like the account name and region, cannot be changed after creation, while the replication (redundancy) option can be changed later. A general-purpose v2 account holds blob containers, file shares, queues and tables together in one account. Redundancy ranges from locally redundant storage through zone-redundant to geo-redundant options: with plain GRS the secondary-region copy becomes readable only after Microsoft initiates a failover, whereas read-access GRS lets you read it any time. For access, a shared access signature (SAS) grants scoped, time-limited permissions without sharing account keys. A user delegation SAS is signed with Microsoft Entra credentials, so it can be revoked before its expiry without regenerating account keys, and a service SAS is limited to a single service such as blob and queue. Short-lived SAS tokens most reduce the risk if one leaks. Service endpoints and private endpoints keep storage traffic off the public internet by tying access to a subnet or a private IP. Expect scenarios that ask which storage setting, SAS type or redundancy option fits.
Account name sets the endpoint URL and cannot change later; redundancy can. Plain GRS secondary is readable only after failover; RA-GRS any time. Revocable without rotating keys = user delegation SAS. Short expiry limits leak damage.
Practice questions
1. A storage account must survive the complete loss of its primary region at the lowest cost that still copies data to another region. Which redundancy option fits?
- Geo-redundant storage (GRS) (correct answer)
- Locally redundant storage (LRS), which keeps all three of its copies inside a single datacenter
- Zone-redundant storage (ZRS)
- Premium page blob storage
GRS copies data to a paired secondary region, so it survives a full regional outage, and it is cheaper than the zone-plus-geo GZRS. LRS and ZRS keep every copy in the primary region, so a regional loss would make data unavailable.
2. A partner needs read access to one container for the next 24 hours only, without ever receiving the storage account keys. What should you issue?
- A shared access signature (SAS) (correct answer)
- The full storage account access key copied and sent directly to the external partner by email
- A ReadOnly resource lock
- A new subscription
A SAS grants scoped, time-limited access to specific resources without exposing the account keys. Sharing the account key hands over full control indefinitely, a resource lock protects against deletion, and a subscription is unrelated.
3. For a new storage account that must support blobs, files, queues, and tables together, which account type does Microsoft recommend?
- General-purpose v2 (correct answer)
- BlockBlobStorage, a premium account type that only holds block blobs and append blobs and no other service
- FileStorage
- A classic account
General-purpose v2 supports all four services and every current feature, so it is the default recommendation. BlockBlobStorage and FileStorage are single-service premium accounts, and classic accounts are legacy.
4. You need premium block blob storage with the lowest latency for small, frequent objects. Which account kind must you create?
- FileStorage
- BlockBlobStorage (correct answer)
- A general-purpose v2 account left on the Standard performance tier for all of its blob, file, and queue workloads
- A general-purpose v1 account
BlockBlobStorage is the premium account kind dedicated to block and append blobs, giving very low latency. FileStorage is premium for files only, and general-purpose accounts on Standard do not deliver premium blob latency.
5. To host premium SMB and NFS file shares with high IOPS, which storage account kind is required?
- General-purpose v1
- BlockBlobStorage
- FileStorage (correct answer)
- A general-purpose v2 account configured with only locally redundant storage and the hot access tier enabled
FileStorage is the premium account kind purpose-built for high-performance file shares. BlockBlobStorage is for blobs, and GPv1 and standard GPv2 do not provide premium file share performance.
6. Locally redundant storage (LRS) keeps how many copies of your data, and where?
- Three copies within a single datacenter (correct answer)
- Three copies spread across three separate availability zones located inside the primary region for zonal resilience
- Six copies across two regions
- One copy only
LRS synchronously stores three copies within one datacenter in the primary region. Three copies across zones describes ZRS, six copies across regions describes GRS/GZRS, and a single copy is never used.