Pass Your Microsoft AZ-104 Exam Easy!

GRS maintains local copies within each region but transfers data from the primary to the secondary asynchronously. An acknowledged write in the source region is not therefore proof that the remote copy has received it. If the primary stops accepting traffic before the latest changes replicate, an unplanned failover can expose a recovery point gap. The relevant evidence is the published Last Sync Time, not the count of storage replicas or the use of a geo-redundant SKU. Treating cross-region replication as synchronous would understate potential data loss.

Read-access geo-redundant storage (RA-GRS or RA-GZRS) can expose a secondary read endpoint before an outage, subject to application and service support. Read access is not a substitute for promoting the secondary to a writable primary. In the outage scenario, attempting to send writes to the secondary read endpoint before failover cannot provide normal writes. The recovery team must choose the appropriate customer-managed failover procedure, accept relevant data-loss risks, and validate the new primary service endpoints after the operation completes.

The state after customer-managed unplanned failover is not the same as the state before the disaster. Microsoft documents loss of geo-redundancy after the secondary is promoted, requiring reconfiguration for geo-replication to resume. The original primary's copy is not maintained as a ready-to-use synchronized recovery partner during that transition. A statement that GRS stays enabled without intervention is therefore misleading and would leave the recovered workload with less geographic protection than expected. Track the new redundancy mode and verify replication health before any later failback.

Distributing storage account access keys to every user creates a credential-exposure risk and does not establish an object-replication relationship. Azure Storage object replication is configured between eligible accounts and container pairs through a replication policy, using service-side change tracking rather than giving every human broad Shared Key authority. The required checks are supported source and destination account/container types, blob versioning at both ends, source change feed, and rules mapping the intended block blobs. Users should receive only permissions needed for their separate jobs.

A copied account name cannot tell Azure Storage which source container should replicate to which destination container, and it cannot make an unsupported account or blob type eligible. Object replication is driven by a policy with rules identifying the intended containers, not by renaming resources to resemble each other. In this scenario, first validate both account types and supported block blobs, then configure versioning, source change feed, and a real replication policy. Bypassing those compatibility checks can leave the team with a nominal destination but no functioning replication.

Disabling versioning directly defeats an object-replication prerequisite. Microsoft requires blob versioning at both source and destination so the service can track and copy supported blob versions; the source also requires change feed. Turning versioning off while adding a replication rule is not an alternative simplification and can prevent the planned source-to-destination replication from operating. The team should validate account/container eligibility, enable required source and target capabilities, and create the supported mapping rule instead of removing the mechanism's change history.

Geo-redundant storage replicates data according to a storage account's configured redundancy model; it does not automatically create the customer's separate object-replication policy between two named accounts and containers. GRS on only the source is therefore not proof that eligible block blobs will appear in the intended second account. Object replication needs a supported source/destination pair, blob versioning on both, source change feed, and explicit policy rules. The design should be verified at the destination rather than inferred from a redundant storage SKU.

Object replication between storage accounts requires compatible source and destination block-blob containers and appropriate storage feature prerequisites. Establishing the right accounts, containers and versioning is necessary foundation but by itself would replicate whatever the policy rule selects, potentially including unrelated objects. This scenario adds a narrower content selection: only blob names under the specified logs prefix are eligible. Define the source/destination container pair and a rule with a matching prefix filter, after checking versioning at both accounts and change feed at the source. Validate sample logs and nonlogs separately.

Azure Blob object replication requires blob versioning enabled in both source and destination accounts and a change feed enabled in the source account. Missing any of these prerequisites can prevent a rule from operating, but enabling them does not restrict replication to a named path inside one container. The scenario's key discriminator is the prefix of eligible log blob names. Apply the proper prefix-match filter in the object replication policy while retaining the documented versioning/change-feed prerequisites. Test one eligible object and one unrelated object and examine asynchronous replication status rather than assuming rule creation means completion.

Inspecting replicated versions and asynchronous lag is useful after object replication is already configured. It can reveal delayed or missing copies but cannot create the source-prefix filter that the question asks the administrator to define. In this scenario, the log path is an object name prefix within a specific container; that path must appear in the object replication rule's filter and must be checked against actual blob names. Validate source versioning, source change feed and destination versioning first, then confirm the target receives matching log versions and excludes unrelated content.

Blob object replication requires source blob change feed and blob versioning in both the source and destination accounts. A missing prerequisite tends to affect whether the policy is valid or whether eligible versions are replicated broadly; it does not neatly explain why most blobs transfer but one particular expected prefix is systematically omitted. The scenario points to a specific filtering inconsistency. Inspect the rule's prefix filter and compare its actual string matching against source blob names. Only then should account-wide prerequisites or asynchronous lag be revisited if the filter is correct.

Confirming account and container compatibility is important when setting up object replication, especially for supported blob types and versioning. Here, however, the policy already transfers most eligible blobs, so the observed exception is localized to an expected name prefix rather than a completely inactive replication relationship. A supported configuration can still filter out objects because of an incorrect prefix or rule source-container mapping. Check which source container and prefix the rule covers, compare case and delimiter placement to actual blob names, and submit a matching object to establish whether filtering is the cause.

Reviewing destination versions and replication timestamps can distinguish a delayed transfer from an excluded object, since Azure Blob object replication works asynchronously. But this is a troubleshooting observation, not the most direct suspected configuration fault when one prefix never appears and other prefixes do. Compare the policy rule's blob-name prefix filter and source-container mapping to the missing object names first. If they match, use the target replication state and errors to determine whether feature prerequisites, permissions or normal replication lag explain the remaining discrepancy. Avoid asserting that all missing objects must be permanently excluded.

Object replication needs source change feed, but the scenario already states it is enabled. Repeating that setting does not repair a destination that is missing blob versioning. The destination must retain the versions created through replication so the rule can track object changes. Inspect both accounts independently; do not infer that a feature on the source is automatically active on the destination.

Geo-redundant storage copies account data as part of an account-redundancy design; it is not the same as the separate object replication policy between specified source and destination containers. Enabling GRS does not establish the missing destination blob versioning prerequisite. The policy rejection has identified a version-tracking feature gap, not an account disaster-redundancy selection. Fix the destination versioning capability instead of changing account replication redundancy.

A new container can be needed when defining a source-to-destination rule, but it will reside in the same destination storage account with blob versioning still disabled. The object replication prerequisite is at the storage account feature level, so creating an extra container cannot satisfy it. The specified source versioning and change feed are already enabled; change the destination setting rather than reproducing the rejected configuration in a new container.

Anonymous public reads concern data disclosure to unauthenticated clients. They do not turn on blob versioning or enable the object replication engine to track versions. The scenario has a missing replication prerequisite, not an access problem requiring public exposure. Enabling anonymous access would add unnecessary risk while leaving the policy invalid. Keep the destination private and enable supported account-level blob versioning.

When an administrator enables object replication but the policy rejects the destination because versions are not tracked, the action 'Check required blob versioning and change-feed prerequisites' can be relevant: object replication depends on source/destination capabilities, not simply a second account. For the different problem of an engineer proposes replacing account GRS with object replication between selected containers to provide all-service geo-disaster behavior, 'Check required blob versioning and change-feed prerequisites' misses the mechanism that object replication is scoped to supported blob objects and rules rather than every Azure Storage service. Choosing 'Check required blob versioning and change-feed prerequisites' would address that other need, whereas 'Treat object replication as selected blob replication, not whole-account redundancy' is intended to solve the stated condition.

'Inspect replicated versions, last updates, and asynchronous status on the target' applies to a different feature boundary because replication may lag; policy existence is not proof that each object version reached the destination. In the stated scenario where an engineer proposes replacing account GRS with object replication between selected containers to provide all-service geo-disaster behavior, 'Inspect replicated versions, last updates, and asynchronous status on the target' does not satisfy the mechanism that object replication is scoped to supported blob objects and rules rather than every Azure Storage service. The necessary action is 'Treat object replication as selected blob replication, not whole-account redundancy', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Confirm supported source/destination accounts, containers, versioning and replication rules' is associated with this separate need: a second storage account will receive object replication from a source blob container. That is because object replication is asynchronous and subject to storage feature prerequisites. Here an engineer proposes replacing account GRS with object replication between selected containers to provide all-service geo-disaster behavior, so 'Confirm supported source/destination accounts, containers, versioning and replication rules' misses the fact that object replication is scoped to supported blob objects and rules rather than every Azure Storage service. 'Treat object replication as selected blob replication, not whole-account redundancy' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Treat object replication as selected blob replication, not whole-account redundancy' applies to a different feature boundary because object replication is scoped to supported blob objects and rules rather than every Azure Storage service. In the stated scenario where an object replication rule was updated, yet destination versions are still behind, 'Treat object replication as selected blob replication, not whole-account redundancy' does not satisfy the mechanism that replication may lag; policy existence is not proof that each object version reached the destination. The necessary action is 'Inspect replicated versions, last updates, and asynchronous status on the target', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Check required blob versioning and change-feed prerequisites' is associated with this separate need: an administrator enables object replication but the policy rejects the destination because versions are not tracked. That is because object replication depends on source/destination capabilities, not simply a second account. Here an object replication rule was updated, yet destination versions are still behind, so 'Check required blob versioning and change-feed prerequisites' misses the fact that replication may lag; policy existence is not proof that each object version reached the destination. 'Inspect replicated versions, last updates, and asynchronous status on the target' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Geo-redundant storage and container-level object replication are distinct features with different destination semantics. An account-level redundancy status does not prove that a particular source blob version reached its separately configured object-replication destination. Inspect the destination object versions, rule status and any asynchronous replication metadata for the specific replication policy. The question asks for progress after a rule update, so generic account redundancy is not a substitute.

'Check key version/rotation configuration and storage managed identity Key Vault permissions' solves another task because Key rotation, key availability and authorization must remain consistent for decrypt/encrypt operations. For the situation where a customer needs to retain control of storage encryption keys rather than use Microsoft's default key management, this distractor misses the requirement that Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. Unlike 'Check key version/rotation configuration and storage managed identity Key Vault permissions', 'Configure supported customer-managed keys for storage encryption' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When two departments need separate encryption policy boundaries inside one supported storage account, the action 'Use compatible storage encryption scopes per container or blob' can be relevant: encryption scopes can partition key policy within an account where supported. For the different problem of a customer needs to retain control of storage encryption keys rather than use Microsoft's default key management, 'Use compatible storage encryption scopes per container or blob' misses the mechanism that Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. Choosing 'Use compatible storage encryption scopes per container or blob' would address that other need, whereas 'Configure supported customer-managed keys for storage encryption' is intended to solve the stated condition.

'Enforce transport protection separately from encryption at rest' applies to a different feature boundary because Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. In the stated scenario where a customer needs to retain control of storage encryption keys rather than use Microsoft's default key management, 'Enforce transport protection separately from encryption at rest' does not satisfy the mechanism that Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. The necessary action is 'Configure supported customer-managed keys for storage encryption', which should be checked against this Azure resource's actual permissions and state.

Shared access signatures authorize storage operations; they do not transfer management of storage encryption keys to the customer. Keeping only Microsoft-managed keys leaves the storage-service default key-management arrangement unchanged, even if clients use SAS credentials to read or write blobs. The required capability is customer-managed keys through a supported Key Vault or Managed HSM configuration, with identity authorization and key availability maintained for the storage account. Issuing extra SAS tokens addresses a different data-access concern and can increase credential exposure without delivering the specified control of encryption-key custody.

When two departments need separate encryption policy boundaries inside one supported storage account, the action 'Use compatible storage encryption scopes per container or blob' can be relevant: encryption scopes can partition key policy within an account where supported. For the different problem of an encrypted account must use a Key Vault-held customer key, 'Use compatible storage encryption scopes per container or blob' misses the mechanism that the storage service must access the usable key; permission or key-state failures can disrupt operations. Choosing 'Use compatible storage encryption scopes per container or blob' would address that other need, whereas 'Configure managed identity and authorized Key Vault key access for supported CMK encryption' is intended to solve the stated condition.

Configuring CMK encryption requires an authorized key and a suitable identity with permission to use the key for cryptographic operations. Choosing the customer-managed-key option does not automatically supply Key Vault permissions or make a disabled or deleted key usable. The administrator should verify the managed identity and supported Key Vault grant before enabling the storage encryption configuration, rather than assuming a management setting creates unrestricted key access.

The nearby action 'Enforce transport protection separately from encryption at rest' is associated with this separate need: a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically. That is because Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. Here an encrypted account must use a Key Vault-held customer key, so 'Enforce transport protection separately from encryption at rest' misses the fact that the storage service must access the usable key; permission or key-state failures can disrupt operations. 'Configure managed identity and authorized Key Vault key access for supported CMK encryption' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, the action 'Enforce transport protection separately from encryption at rest' can be relevant: Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. For the different problem of Blob operations fail after the customer-controlled vault key is disabled, 'Enforce transport protection separately from encryption at rest' misses the mechanism that CMK availability is a runtime dependency; changing the blob SAS will not repair key unavailability. Choosing 'Enforce transport protection separately from encryption at rest' would address that other need, whereas 'Restore authorized access to an enabled compatible encryption key' is intended to solve the stated condition.

'Configure supported customer-managed keys for storage encryption' applies to a different feature boundary because Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. In the stated scenario where Blob operations fail after the customer-controlled vault key is disabled, 'Configure supported customer-managed keys for storage encryption' does not satisfy the mechanism that CMK availability is a runtime dependency; changing the blob SAS will not repair key unavailability. The necessary action is 'Restore authorized access to an enabled compatible encryption key', which should be checked against this Azure resource's actual permissions and state.

Network allowlisting governs which client paths can reach Azure Storage but does not make a disabled encryption key usable again. Azure Storage must access its customer-managed key in Key Vault to read or write affected encrypted blob data. Microsoft documents that disabling the active key denies those data operations even when the client has otherwise valid authorization. Here the key is deliberately disabled and restoration has been approved. Re-enable the correct key and confirm its managed identity permissions; changing firewall rules alone adds network exposure without restoring the cryptographic dependency.

When two departments need separate encryption policy boundaries inside one supported storage account, the action 'Use compatible storage encryption scopes per container or blob' can be relevant: encryption scopes can partition key policy within an account where supported. For the different problem of Blob operations fail after the customer-controlled vault key is disabled, 'Use compatible storage encryption scopes per container or blob' misses the mechanism that CMK availability is a runtime dependency; changing the blob SAS will not repair key unavailability. Choosing 'Use compatible storage encryption scopes per container or blob' would address that other need, whereas 'Restore authorized access to an enabled compatible encryption key' is intended to solve the stated condition.

'Use compatible storage encryption scopes per container or blob' applies to a different feature boundary because encryption scopes can partition key policy within an account where supported. In the stated scenario where a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, 'Use compatible storage encryption scopes per container or blob' does not satisfy the mechanism that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. The necessary action is 'Enforce transport protection separately from encryption at rest', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Configure supported customer-managed keys for storage encryption' is associated with this separate need: a customer needs to retain control of storage encryption keys rather than use Microsoft's default key management. That is because Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. Here a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, so 'Configure supported customer-managed keys for storage encryption' misses the fact that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. 'Enforce transport protection separately from encryption at rest' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check key version/rotation configuration and storage managed identity Key Vault permissions' solves another task because Key rotation, key availability and authorization must remain consistent for decrypt/encrypt operations. For the situation where a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, this distractor misses the requirement that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. Unlike 'Check key version/rotation configuration and storage managed identity Key Vault permissions', 'Enforce transport protection separately from encryption at rest' directly targets that requirement; its success must be confirmed at the authorized resource scope.