AZ-104 - Implement and Manage Storage (20% of the exam) - Section 2.2

Configure and manage storage accounts including redundancy and networking options.

Compare LRS, ZRS, and GRS redundancy options and choose the appropriate tier based on durability and regional failover requirements. Restrict storage account network access using storage firewalls and virtual network rules, and use private endpoints to expose storage exclusively over a private IP address within a virtual network.

storage account typesredundancy optionsLRS GRS ZRSstorage firewallsprivate endpoints

Practice question for this objective

Free sampleImplement and Manage Storagemedium

An administrator configures a virtual network rule that grants a subnet access to a geo-redundant storage account. They assume a separate rule is needed before that subnet can reach the read-only geo-redundant (RA-GRS) instance. Is a separate rule required for the RA-GRS instance?

  • AYes
  • BNo Correct
A virtual network rule granting access to a storage account also grants access to its RA-GRS instance. No is correct because the documentation states that virtual network rules that grant access from a virtual network to a storage account also grant access to any RA-GRS instance, so no separate rule is needed.

Why A is wrong: Answering Yes would wrongly imply the RA-GRS instance needs its own network rule, but access to the primary account already extends to the RA-GRS instance.

Why B is correct: Correct. No is correct because the documentation states that virtual network rules that grant access from a virtual network to a storage account also grant access to any RA-GRS instance, so no separate rule is needed.

See more AZ-104 practice questions, answers explained.

Exam traps in Implement and Manage Storage

Answers that look right on this material and are not. Each one is a distractor from a different question in the AZ-104 bank for this domain.

  • The Microsoft.Storage same-region service endpoint

    Why it is wrong: Microsoft.Storage provides connectivity only to accounts in the same region as the virtual network.

  • Whether the secondary region copy is encrypted at all

    Why it is wrong: All redundancy options encrypt data in both regions, so encryption is not the difference.

  • Yes

    Why it is wrong: Saying Yes assumes the type is editable, but Azure does not allow changing a storage account to a different type after creation.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.