Question 540 An operator accidentally deletes a blob, and the team wants a recovery window for that mistake. Which capability should be enabled beforehand? An NSG rule Only LRS replicas A higher App Service plan tier Blob soft delete with an appropriate retention period Explanation Correct Answer D:Soft delete retains deleted objects temporarily for recovery. Incorrect Answers A:Network filtering isn't a recovery window. B:Local replica placement doesn't preserve a deleted version by itself. C:Web compute size does not undo blob deletion.
Question 541 An application overwrites a critical configuration blob and later needs the prior contents. Which storage feature can help? Copy the current blob to a new filename but never enable versioning A management-group tag audit Switch the VM OS disk type Blob versioning with suitable retention settings Explanation Correct Answer D:Versioning retains earlier object versions for supported recovery cases. Incorrect Answers A:Independent copies do not establish built-in previous-version history for a single blob name. B:Tags aren't object version data. C:An unrelated disk doesn't restore object history.
Question 542 A regulated organization needs write-once retention that prevents early removal of particular stored records. Which Azure Storage concept applies? Use a normal delete lock on the storage account as a guaranteed object immutability policy Immutable Blob Storage policies with appropriate retention or legal hold An Azure Function retry count A resource tag named Immutable Explanation Correct Answer B:Immutability controls can prevent modification/deletion during protected periods. Incorrect Answers A:Management locks are not identical to supported legal-hold or time-based immutable blob retention controls. C:Function retries don't create WORM storage. D:Labels have no enforcement effect on blob deletion.
Question 543 A partner needs time-limited permission to read one blob but should not receive a full storage account key. Which access mechanism is relevant? Make every container anonymously public Publish the account root key on the download page A tightly scoped shared access signature or supported delegated authorization Give the partner subscription Owner just for download Explanation Correct Answer C:A SAS can constrain permissions and expiry for defined storage access. Incorrect Answers A:Broad public access violates the time-limited partner requirement. B:The full key gives broader sensitive authority. D:Subscription Owner is excessive and unrelated to minimal blob reads.
Question 544 A contractor has an old signed storage URL that stops working after the agreed window. Which SAS property most directly explains this? The signature's expiration time The Blob's file extension The Azure region pair name The resource group's creation month Explanation Correct Answer A:SAS validity is bounded by configured expiry and other restrictions. Incorrect Answers B:Extensions do not automatically expire URL credentials. C:Region metadata isn't a SAS validity condition. D:Group age doesn't set signed URL expiration.
Question 545 An application team shares the storage account access key with many subcontractors and wants a safer alternative. What should it prioritize? Scoped identities or limited delegated access rather than distributing the account root key Use a longer Blob container name as the secret Set all subcontractors as subscription Owners Store the key in every public web page for convenience Explanation Correct Answer A:Account keys confer broad capabilities and should be tightly protected. Incorrect Answers B:Container names are not secure keys. C:Broader roles worsen least privilege. D:Publishing keys exposes the storage account.
Question 546 A storage account should accept data requests only from approved source networks through supported public endpoint controls. Which feature helps? VM availability sets Storage account network firewall and allowed network rules Blob hot access tier Azure subscription display name Explanation Correct Answer B:Account-level network restrictions can limit exposure of public service endpoints. Incorrect Answers A:Compute placement doesn't filter storage API clients. C:Data temperature isn't a firewall rule. D:Names cannot enforce network origins.
Question 547 A manager asks whether Azure Storage supports encryption of stored data at rest without a custom in-app cipher. What capability is relevant? A VM availability set Assume HTTPS alone configures encryption for all stored data at rest An ExpressRoute circuit alone Azure Storage service-side encryption at rest Explanation Correct Answer D:Supported Azure Storage services encrypt data at rest as part of their managed storage behavior. Incorrect Answers A:Host distribution is not storage encryption. B:Transport encryption protects data in transit; at-rest encryption is a separate storage security capability. C:Network transport doesn't replace encryption of persistent data.
Question 548 A regulated company wants more control over key lifecycle for supported Azure Storage encryption. What should it evaluate? Disable all storage authentication to simplify keys Create extra blob containers without key configuration Change only the storage account display name Customer-managed encryption keys integrated with supported key-management services Explanation Correct Answer D:Managed keys let an organization control defined key operations rather than rely solely on provider-managed keys. Incorrect Answers A:Access control and encryption key ownership are distinct. B:More containers do not introduce customer key management. C:Names are unrelated to encryption key control.
Question 549 A storage account must serve confidential file operations over private VNet addresses. Which additional service is relevant? A public unauthenticated Blob container Assign a data-reader role without creating the required private endpoint path Azure Private Link private endpoints for the required storage service Only a cost budget Explanation Correct Answer C:Private endpoints provide a private IP connection path for supported storage subresources. Incorrect Answers A:Anonymous public access contradicts confidentiality. B:Authorization does not by itself make a public endpoint private or establish private VNet connectivity. D:Cost limits don't establish a private network path.
Question 550 A storage private endpoint is healthy but internal clients resolve the blob hostname to a public IP. Which cause is plausible? The VM disk cache is enabled The private DNS zone linkage or record integration is missing The storage account lacks blob versioning The object access tier is Hot rather than Cool Explanation Correct Answer B:Correct name resolution is required to use the endpoint's private IP. Incorrect Answers A:Local disk caching cannot change a DNS record globally. C:Versioning is about history, not endpoint resolution. D:Tiering doesn't select a private DNS answer.
