Pass Your Microsoft AZ-104 Exam Easy!

'Use compatible storage encryption scopes per container or blob' applies to a different feature boundary because encryption scopes can partition key policy within an account where supported. In the stated scenario where a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, 'Use compatible storage encryption scopes per container or blob' does not satisfy the mechanism that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. The necessary action is 'Enforce transport protection separately from encryption at rest', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Configure supported customer-managed keys for storage encryption' is associated with this separate need: a customer needs to retain control of storage encryption keys rather than use Microsoft's default key management. That is because Storage service encrypts at rest by default; CMK changes key custody and operational responsibility. Here a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, so 'Configure supported customer-managed keys for storage encryption' misses the fact that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. 'Enforce transport protection separately from encryption at rest' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Check key version/rotation configuration and storage managed identity Key Vault permissions' solves another task because Key rotation, key availability and authorization must remain consistent for decrypt/encrypt operations. For the situation where a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, this distractor misses the requirement that Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. Unlike 'Check key version/rotation configuration and storage managed identity Key Vault permissions', 'Enforce transport protection separately from encryption at rest' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Changing per-container encryption-scope configuration targets a different feature and does not explain why a storage account using a Key Vault customer-managed key lost access after the previous key version was disabled. Encryption at rest depends on the account's configured CMK and its version/identity authorization. The scenario directly ties failures to the rotation timing, and a container-level alteration does not make the disabled vault key usable. Investigate the actual vault key version and required access before proposing an unrelated encryption-scope migration.

Replacing customer-managed encryption with Microsoft-managed keys changes the governance and key-control model that the organization deliberately selected. The failure occurs immediately after disabling an old Key Vault key version, not because the application must abandon CMK. Depending on the account and policy, changing the encryption configuration may be unauthorized or impossible in the current failure state. First verify key version selection, the enabled state of key material and the existing identity permissions; then complete a supported, orderly rotation without dropping the mandated CMK control.

Storage account access keys authorize storage requests and may sign SAS tokens; they do not trigger Azure Storage's customer-managed encryption key-version discovery in Key Vault. Rotating both keys could break dependent clients without changing the currently referenced disabled Key Vault key version. The relevant control plane is the CMK configuration, key URI and version, plus the account managed identity's permissions. Check the documented automatic update interval and reenable the old version if authorized rather than treating access-key rotation as a CMK repair.

A customer-managed key can change who controls encryption at the storage account level, but using one account-wide key does not automatically establish separate protection boundaries for two departments. The requirement is separation within one supported account, which is the purpose of compatible encryption scopes applied to the relevant containers or blobs. A common account-wide key does not by itself differentiate departmental encryption policies.

When a stakeholder says Azure Storage's default encryption at rest means HTTP traffic is encrypted automatically, the action 'Enforce transport protection separately from encryption at rest' can be relevant: Storage encryption protects persisted bytes while HTTPS/TLS protects data in transit. For the different problem of two departments need separate encryption policy boundaries inside one supported storage account, 'Enforce transport protection separately from encryption at rest' misses the mechanism that encryption scopes can partition key policy within an account where supported. Choosing 'Enforce transport protection separately from encryption at rest' would address that other need, whereas 'Use compatible storage encryption scopes per container or blob' is intended to solve the stated condition.

The nearby action 'Check key version/rotation configuration and storage managed identity Key Vault permissions' is associated with this separate need: a CMK is rotated and storage encryption starts failing. That is because Key rotation, key availability and authorization must remain consistent for decrypt/encrypt operations. Here two departments need separate encryption policy boundaries inside one supported storage account, so 'Check key version/rotation configuration and storage managed identity Key Vault permissions' misses the fact that encryption scopes can partition key policy within an account where supported. 'Use compatible storage encryption scopes per container or blob' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Configure managed identity and authorized Key Vault key access for supported CMK encryption' solves another task because the storage service must access the usable key; permission or key-state failures can disrupt operations. For the situation where two departments need separate encryption policy boundaries inside one supported storage account, this distractor misses the requirement that encryption scopes can partition key policy within an account where supported. Unlike 'Configure managed identity and authorized Key Vault key access for supported CMK encryption', 'Use compatible storage encryption scopes per container or blob' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Azure Storage Explorer is a useful graphical client for browsing and operating on Blob containers, but relying on an interactive GUI workflow does not satisfy this question’s required command-line job recovery process. The operator specifically needs AzCopy job IDs and log/plan files that can drive azcopy jobs show and resume in an unattended script. A GUI transfer may be legitimate for manual investigation or smaller copies, but it does not provide this stated operational contract in place of the AzCopy command-line job. Prefer the client whose recovery semantics were explicitly specified.

The portal can inspect storage accounts and individual blobs but manually navigating and copying objects is not a scalable recovery design for millions of unattended transfers. The scenario requires a durable transfer job identifier, failure logs and a plan that can resume pending blobs without repeating the already completed set. A storage account overview is not a bulk-transfer engine with that AzCopy plan-file interface. Use an authenticated transfer tool designed for the workload, then check job results and target inventory rather than inferring success from portal visibility.

An individual az storage blob upload operation can upload a named local file, and other Azure CLI commands support batch use. However, the offered single-file command neither describes copying an Azure-storage account’s millions of blobs directly to another account nor provides AzCopy v10’s job logs and resumable plan-file contract. The requirement is explicitly to resume a transfer by AzCopy job ID after failure. A different CLI upload subcommand may be valid for a separate, simpler task but is not a substitute for these exact recovery semantics.

Azure Data Factory Copy activity can be a legitimate managed pipeline for large transfer operations, and it has its own run-monitoring and retry features. Its pipeline or activity run identifier is not an AzCopy job ID and cannot be fed to the azcopy jobs resume command that reads AzCopy plan files. The prompt expressly requires an unattended command-line process with AzCopy-style transfer recovery, rather than a separate orchestration service. Mixing those interfaces would cause the recovery procedure to fail even if the Data Factory pipeline itself could copy the blobs.

'Treat object replication as selected blob replication, not whole-account redundancy' applies to a different feature boundary because object replication is scoped to supported blob objects and rules rather than every Azure Storage service. In the stated scenario where Azure Storage Explorer lists an account but cannot read private blob objects, 'Treat object replication as selected blob replication, not whole-account redundancy' does not satisfy the mechanism that Storage Explorer's UI visibility is not equivalent to Blob DataActions. The necessary action is 'Grant appropriate data-plane authorization to the signed-in identity or supplied token', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Select a supported storage account type after checking each workload's feature matrix' is associated with this separate need: a workload requires Blob and Files features with varying redundancy and performance support. That is because account types have different Files, Blob, HNS, SKU, performance and redundancy constraints. Here Azure Storage Explorer lists an account but cannot read private blob objects, so 'Select a supported storage account type after checking each workload's feature matrix' misses the fact that Storage Explorer's UI visibility is not equivalent to Blob DataActions. 'Grant appropriate data-plane authorization to the signed-in identity or supplied token' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an enterprise must migrate millions of objects with a script and progress logs, the action 'Use AzCopy for authorized, repeatable bulk data transfer' can be relevant: azCopy supports scripted transfer and return status; permission and network limits still apply. For the different problem of Azure Storage Explorer lists an account but cannot read private blob objects, 'Use AzCopy for authorized, repeatable bulk data transfer' misses the mechanism that Storage Explorer's UI visibility is not equivalent to Blob DataActions. Choosing 'Use AzCopy for authorized, repeatable bulk data transfer' would address that other need, whereas 'Grant appropriate data-plane authorization to the signed-in identity or supplied token' is intended to solve the stated condition.

The nearby action 'Inspect exit code and transfer log before accepting completion' is associated with this separate need: an operator reports that AzCopy completed because they issued the command, although the process returned a nonzero code. That is because failed or skipped transfers can remain even when the command started successfully. Here a transfer using AzCopy worked yesterday but now returns SAS-expired messages, so 'Inspect exit code and transfer log before accepting completion' misses the fact that time-limited tokens stop authorizing new requests after expiry. 'Refresh the correctly scoped SAS authorization and restart failed items under control' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Map source and target paths explicitly and verify transfer results' solves another task because successful tool launch is not evidence every object arrived under its intended prefix. For the situation where a transfer using AzCopy worked yesterday but now returns SAS-expired messages, this distractor misses the requirement that time-limited tokens stop authorizing new requests after expiry. Unlike 'Map source and target paths explicitly and verify transfer results', 'Refresh the correctly scoped SAS authorization and restart failed items under control' directly targets that requirement; its success must be confirmed at the authorized resource scope.

'Use AzCopy for authorized, repeatable bulk data transfer' applies to a different feature boundary because azCopy supports scripted transfer and return status; permission and network limits still apply. In the stated scenario where a transfer using AzCopy worked yesterday but now returns SAS-expired messages, 'Use AzCopy for authorized, repeatable bulk data transfer' does not satisfy the mechanism that time-limited tokens stop authorizing new requests after expiry. The necessary action is 'Refresh the correctly scoped SAS authorization and restart failed items under control', which should be checked against this Azure resource's actual permissions and state.

A byte count or total number of transferred objects can match even when every object landed beneath the wrong prefix or lost an expected customer/day subdirectory. The question requires relative paths such as customer identifier and daily file name to survive the move into a new top-level archive prefix. Aggregate transfer statistics do not show the actual destination blob names or validate the source-to-target mapping. Inspect the AzCopy command's source and destination path interpretation and compare representative or complete mapped names, not just quantities.

AzCopy is an appropriate bulk-copy tool, but choosing a capable tool is not proof that a particular command preserves the intended hierarchy. Wildcards, trailing paths, recursion, and destination prefixes change how object names are constructed. A job can complete successfully while placing objects in a prefix that the application does not query. To meet the case's requirement, determine the intended source-relative path mapping in advance and verify resulting destination object names and content or metadata as appropriate after transfer.

Azure Blob object replication is a separately configured asynchronous policy-based mechanism for supported block blobs and containers; it is not retroactive validation of an AzCopy job's destination hierarchy. The scenario concerns a completed copy where the main uncertainty is the object key or prefix on the target. Introducing a replication rule may require versioning and source change feed but would not prove where those previously copied objects landed. Validate the actual AzCopy command and the archive destination object inventory against the required customer/day layout.

When a copy script moves container data into a new hierarchy, the action 'Map source and target paths explicitly and verify transfer results' can be relevant: successful tool launch is not evidence every object arrived under its intended prefix. For the different problem of an operator reports that AzCopy completed because they issued the command, although the process returned a nonzero code, 'Map source and target paths explicitly and verify transfer results' misses the mechanism that failed or skipped transfers can remain even when the command started successfully. Choosing 'Map source and target paths explicitly and verify transfer results' would address that other need, whereas 'Inspect exit code and transfer log before accepting completion' is intended to solve the stated condition.

The nearby action 'Use AzCopy for authorized, repeatable bulk data transfer' is associated with this separate need: an enterprise must migrate millions of objects with a script and progress logs. That is because azCopy supports scripted transfer and return status; permission and network limits still apply. Here an operator reports that AzCopy completed because they issued the command, although the process returned a nonzero code, so 'Use AzCopy for authorized, repeatable bulk data transfer' misses the fact that failed or skipped transfers can remain even when the command started successfully. 'Inspect exit code and transfer log before accepting completion' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Refresh the correctly scoped SAS authorization and restart failed items under control' solves another task because time-limited tokens stop authorizing new requests after expiry. For the situation where an operator reports that AzCopy completed because they issued the command, although the process returned a nonzero code, this distractor misses the requirement that failed or skipped transfers can remain even when the command started successfully. Unlike 'Refresh the correctly scoped SAS authorization and restart failed items under control', 'Inspect exit code and transfer log before accepting completion' directly targets that requirement; its success must be confirmed at the authorized resource scope.

Billing totals and account byte usage are aggregated financial or storage-size measurements; neither proves that each of the 80,000 required blob names is present or that content digests and custom metadata agree. Billing can include retained versions, transactions, redundancy and timing differences unrelated to the application manifest. Even a coincidentally equal total byte count can hide swapped objects, missing names, corruption or metadata omissions. This proposed shortcut does not meet either the full-object inventory reconciliation or the trusted per-object content and metadata requirement in the question.

AzCopy job status and logs are important transfer diagnostics; they can identify failed or retried copy operations and should be reviewed. However a successful job status by itself is not an application-level attestation that every required destination blob matches a separately maintained SHA-256 manifest and has all expected custom metadata. The application has made both exact integrity and naming requirements explicit. Inspecting the job can inform which transfers need investigation, but it cannot replace systematic target inventory comparison and per-object validation of the required integrity evidence.

A ten-blob sample can help detect common transfer mistakes early, but the organization is about to retire the only original copy of 80,000 objects and has specifically required exact integrity for EVERY object. Sampling cannot establish that unsampled blobs retain the right metadata and independently recorded SHA-256 content digests. A corrupted file, missing object or wrong metadata entry among the other 79,990 could go unnoticed. Use sampling as an initial diagnostic only; the formal acceptance criteria require complete inventory reconciliation and an item-by-item metadata/digest comparison against the trusted source manifest.

A screenshot may show that some blobs appear in a selected container, but it cannot enumerate all 80,000 expected objects or reliably validate deep path prefixes, metadata and content digests. Visual presence in one folder-like view also says nothing about omitted objects, preserved versions or exact bytes. The requirement is an auditable dataset-wide comparison against a source manifest, not a subjective impression that the destination looks populated. Verify all object names and lengths and separately compare the expected per-object metadata and SHA-256 contents through supported authorized APIs and independent integrity checks.

The nearby action 'Review the Azure Files share provisioned size/quota and supported capacity limits' is associated with this separate need: a department anticipates growth past its share quota. That is because a share quota is distinct from resource group quota; capability varies by file share tier. Here a legacy line-of-business program must mount a shared folder using SMB, so 'Review the Azure Files share provisioned size/quota and supported capacity limits' misses the fact that Blob containers are object endpoints, not an SMB replacement without application changes. 'Provision a compatible Azure Files SMB share' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a share resolves and SMB port connectivity works, but a user's open fails with Access denied, the action 'Check share-level role and filesystem ACL identity permissions' can be relevant: Network reachability does not grant the user permission to files inside the share. For the different problem of a legacy line-of-business program must mount a shared folder using SMB, 'Check share-level role and filesystem ACL identity permissions' misses the mechanism that Blob containers are object endpoints, not an SMB replacement without application changes. Choosing 'Check share-level role and filesystem ACL identity permissions' would address that other need, whereas 'Provision a compatible Azure Files SMB share' is intended to solve the stated condition.

'Copy only the affected file from its known-good share snapshot into the live share' applies to a different feature boundary because file-level copy from a point-in-time snapshot restores one known-good item without reverting newer unrelated files. In the stated scenario where a legacy line-of-business program must mount a shared folder using SMB, 'Copy only the affected file from its known-good share snapshot into the live share' does not satisfy the mechanism that Blob containers are object endpoints, not an SMB replacement without application changes. The necessary action is 'Provision a compatible Azure Files SMB share', which should be checked against this Azure resource's actual permissions and state.

Network throughput can affect the rate at which SMB requests transfer data, but it does not raise the maximum permitted size of the live Azure Files share. The scenario identifies a five-tebibyte share quota, not a bandwidth bottleneck or virtual-network limit. Even with faster connectivity, writes that exceed the configured share capacity can fail. The supported action is to change the file-share quota itself, verify the model-specific maximum and monitor usage. Performance provisioning is a separate decision and, under some billing models, can have separate charges.

An Azure Files share snapshot preserves a read-only point-in-time view that can help recover overwritten or deleted files. It does not change the quota on the current writable file share or cause live data to fit in a larger volume. Snapshot storage can also contribute to billed usage, depending on the storage model and changed blocks. This department requires more capacity for new live files, so administrators must modify the supported share quota or provisioned capacity rather than relying on a backup copy. A snapshot could still be taken as a recovery precaution before an administrative change.

Azure subscription vCPU quotas control compute allocations for virtual machines, including region-wide and VM-family limits. They do not govern the maximum file capacity of an Azure Files share. A vCPU request would not remove the five-tebibyte storage quota and could add irrelevant capacity that the business has not requested. The scenario specifies a classic Azure Files SMB share under a pay-as-you-go billing model, so the administrator should update its share quota and confirm the resulting usable storage. Compute quotas, storage-account limits and individual share quotas must be evaluated separately.