AZ-104 Practice Test.

Answer: A
Azure AD (Microsoft Entra ID) built-in directory roles like Helpdesk Administrator govern directory-level actions such as password resets and are separate from Azure RBAC, which governs access to Azure resources like subscriptions and resource groups. Owner and Contributor are Azure RBAC roles that control resource management, not directory user administration, and would grant far more (or unrelated) permissions than needed. A classic service administrator role is a legacy subscription-level construct unrelated to directory user management.

Answer: A
Azure Policy with a deny effect evaluates resource properties (like SKU) at creation and blocks non-compliant deployments, and assigning it at the management group scope applies it to all child subscriptions automatically. Blueprints orchestrate artifacts like policies and role assignments as a package but the enforcement mechanism for a SKU restriction is still a policy; assigning per-subscription is also less efficient than a management-group assignment. Resource locks only prevent deletion or modification of existing resources, not SKU selection at creation. A custom RBAC role can restrict who can create storage accounts but cannot enforce which SKU is chosen.

Answer: C
Contributor grants full read/write management of resources in scope but explicitly excludes the ability to modify role assignments, which matches the requirement. Owner includes everything Contributor has plus the ability to assign roles to other users, exceeding the requirement. Reader only allows viewing resources, not managing them. User Access Administrator manages role assignments but does not by itself grant broad resource management rights.

Answer: A
SSPR can be enabled for 'Selected' groups of users rather than all users, and even enabled users must register authentication methods (like phone or authenticator app) before they can use it, so an unregistered or out-of-scope user would be unable to reset their own password. SSPR works for both cloud-only and hybrid-synced accounts (with password writeback for hybrid). SSPR is a directory feature unrelated to Azure resource RBAC roles like Contributor. Global Administrators are not the only accounts eligible for SSPR; in fact restricting SSPR to only admins would defeat its self-service purpose.

Answer: B
A CanNotDelete lock prevents the resource from being deleted while still allowing read and write operations such as resizing disks or updating NIC settings. A ReadOnly lock would block the required configuration changes since it prevents all modifications, not just deletion. 'Contributor deny assignment' and 'Owner lock' are not actual Azure resource lock types; Azure only supports CanNotDelete and ReadOnly as lock levels.

Answer: A
Custom RBAC roles let administrators define a precise set of allowed and not-allowed actions (using Actions and NotActions), which is the correct mechanism to grant only start/restart while excluding stop, delete, and resize. Virtual Machine Contributor grants broad management including stop, delete, and resize, so relying on training does not technically enforce the restriction. Deny assignments are typically created by Azure (e.g., for managed apps) and are not a standard user-configurable mechanism for this scenario at the management group level in this way. Administrative units organize Azure AD objects like users and groups for delegated administration; they do not scope Azure resource-level action permissions on VMs.

Answer: A
The Activity log records subscription-level control-plane operations (create, update, delete, and their success or failure status) along with the caller identity, making it the correct source for an audit of who changed what. Azure AD sign-in logs show authentication events, not resource management operations. Network Watcher's topology view visualizes network resource relationships, not a change history. Azure Advisor provides best-practice recommendations, not an audit trail of actions taken.

Answer: A
Azure Monitor metric alert rules can evaluate a signal like CPU percentage against a threshold and, when triggered, invoke an action group that can send email notifications and call a Logic App, exactly matching the requirement. A saved search without a linked alert only stores a query for manual review and does not trigger automatic notifications. Azure Advisor cost recommendations address spending efficiency, not performance thresholds or automated remediation. Network Watcher's connection monitor tests network reachability, not CPU utilization.

Answer: A
A scheduled Start/Stop solution (via the dedicated feature or an Automation runbook) automatically deallocates VMs outside business hours, stopping compute billing during idle periods and restarting them for use, which precisely matches the need for automated, scheduled operation. Simply downsizing the VM does not address the fact that they run continuously and only need to run part of the day. Changing regions might offer marginal pricing differences but does not solve the core problem of paying for idle time. Spot pricing is designed for interruptible workloads that Azure can reclaim, and converting an existing running dev/test VM to Spot does not equate to scheduling its uptime and does not guarantee availability during required business hours.

Answer: A
The Azure Monitor Agent, deployed via data collection rules, gathers performance counters and event logs from both Azure and on-premises (Arc-enabled) machines and sends them to a Log Analytics workspace, where KQL queries can be run in Log Analytics. Storage Explorer is a tool for browsing blobs, files, queues, and tables, not for aggregating logs across servers. Network Watcher flow logs capture NSG traffic flow data, not general performance counters and event logs. A Recovery Services vault is used for backup and site recovery, not log collection and querying.

Answer: A
Azure Service Health tracks planned maintenance, service issues, and health advisories affecting a subscription's resources and region, while Resource Health shows the current and historical health of individual resources, matching the need to be alerted about upcoming maintenance and to review platform health history. Azure Policy's compliance dashboard reports on adherence to governance rules, not platform outages or maintenance. Cost Management + Billing tracks spending, not service health. Azure Migrate is used to assess and migrate on-premises workloads to Azure, unrelated to ongoing platform health notifications.

Answer: A
Sending diagnostic logs to a storage account is the most cost-effective option for long-term archival when logs are needed only occasionally for auditing rather than real-time analysis, and retention policies can be configured on the storage. Log Analytics workspaces provide powerful real-time querying but incur higher per-GB ingestion and retention costs, which is unnecessary if the logs are mainly for later compliance lookups. Sending to an Event Hub with no consumer just streams data without any retention or storage, so the logs would be lost. The Activity log captures control-plane subscription events and has its own fixed retention; it is not a destination for resource-level diagnostic logs like SQL Database query/audit logs.

Answer: A
ARM or Bicep templates provide declarative, idempotent, parameterized infrastructure-as-code that can be redeployed consistently across subscriptions or environments, exactly meeting the repeatability requirement. Manually creating VMs through the portal is error-prone and does not guarantee consistency, and documentation alone does not automate anything. Exporting a template once without reusing it wastes the main benefit of having a reusable template. Azure Advisor only offers recommendations for existing resources; it does not generate deployable infrastructure templates.

Answer: A
Virtual Machine Scale Sets natively support autoscaling based on metrics like CPU or custom metrics, automatically adding or removing VM instances behind a load balancer, matching the elasticity requirement. A single larger VM does not provide horizontal elasticity or high availability across multiple instances. An Availability Set groups VMs for fault domain/update domain distribution but does not itself provide autoscaling; the VM count is fixed unless manually changed. Azure Container Instances with a static count does not scale automatically and is a different compute model (containers, not VMs) that isn't described as needed here.

Answer: A
Shutting down the guest OS from within the VM stops the OS but does not release the underlying compute allocation; the VM remains in a 'Stopped' (allocated) state and continues to incur compute charges, unlike using 'Stop' (deallocate) from the Azure portal or CLI which releases the hardware allocation. Only stopping and deallocating (not just stopping) halts compute billing. Storage charges for the VM's disks apply regardless of power state, but that does not mean compute is automatically waived. Azure does not automatically deallocate a VM just because the guest OS was shut down from inside.

Answer: D
Changing a managed disk's storage tier/SKU (e.g., from Standard HDD to Premium SSD) typically requires the VM to be deallocated first, after which the SKU can be changed and the VM restarted, resulting in brief downtime but preserving the disk's data and identity. Some scenarios allow limited online changes, but the safe, generally applicable approach for this kind of tier change is to deallocate first. Deleting and recreating the VM and disk is unnecessarily destructive and risks data loss when a simple SKU change suffices. Attaching a new disk does not automatically migrate an OS or its data; OS migration between disks requires an explicit imaging or cloning process, not automatic OS relocation.

Answer: A
Azure Container Instances (ACI) offers a simple, serverless way to run individual containers on demand without provisioning or managing any underlying VMs or clusters, ideal for a simple periodic batch job. Azure Kubernetes Service is designed for orchestrating multiple containers with scaling, service discovery, and cluster management, which is unnecessary overhead for this simple single-run scenario. Running Docker manually on a Scale Set requires managing the VM infrastructure and container runtime yourself, adding operational burden not needed here. Service Fabric is a full microservices orchestration platform, again more complex than required for a simple daily batch job.

Answer: A
Availability Zones represent physically separate datacenters within a region, each with independent power, cooling, and networking; spreading VMs across two or more zones protects against a full datacenter-level failure, which an Availability Set (confined to a single datacenter's fault/update domains) cannot do. A single Availability Set only protects against rack-level (fault domain) or planned maintenance (update domain) failures within one datacenter, not a full datacenter outage. A single VM, regardless of disk type, has no redundancy against instance or datacenter failure. Deploying VMs in the same fault domain intentionally reduces redundancy rather than increasing it, which is the opposite of what's needed.

Answer: A
Generalizing (via sysprep on Windows or waagent deprovision on Linux) removes machine-specific information so that each VM created from the resulting image gets a fresh, unique identity, including computer name and administrator account set at provisioning time. If the source were not generalized (a 'specialized' image), the original computer name and settings would be retained, but that is not the case described. A generalized image is reusable to create many VMs, not limited to a single deployment. Generalized images can absolutely include pre-installed applications and configurations beyond just the base OS, which is one of the main benefits of custom images.

Answer: A
Azure Files provides fully managed SMB (and NFS) file shares that can be mounted concurrently from on-premises machines and Azure VMs without needing to run and maintain a file server VM. Blob Storage, even with public access, does not natively expose the SMB protocol for file-share-style mounting. Table Storage is a NoSQL key-value store, not a file share and has no SMB interface. Managed disks are block storage attached to a single VM at a time (or a few, with shared disks), not a general multi-client SMB file share.

Answer: A
The Archive access tier offers the lowest storage cost among blob tiers and is designed for data that is rarely accessed and can tolerate several hours of retrieval latency (rehydration), matching a 7-year compliance archive scenario. The Hot tier is optimized for frequently accessed data and has the highest storage cost, unsuitable for rarely accessed archives. The Cool tier is meant for infrequently accessed data still requiring rapid access (minutes, not hours) and costs more than Archive. The Premium block blob tier is optimized for high-performance, low-latency scenarios with higher cost, the opposite of what a low-cost long-term archive needs.

Answer: A
Time-based immutability policies enforce write-once-read-many (WORM) behavior at the container level, preventing modification or deletion of blobs for the configured retention period, which can be locked so that not even the account owner can shorten or remove it, matching legal/regulatory retention needs. A ReadOnly resource lock only prevents changes to the storage account's own configuration (like SKU or replication), not to blob content, and does not enforce immutability of the data. Soft delete protects against accidental deletion for a limited window but permanent deletion by an authorized user is still possible after that window (and during it) and it doesn't guarantee a fixed 5-year non-modifiable retention. Conditional access controls authentication conditions for sign-in, not data immutability within already-authorized sessions.

Answer: A
A SAS token can be scoped to specific resources, permissions (e.g., read-only), and a defined start/expiry time, allowing time-limited, granular access without exposing the full account key or requiring the third party to authenticate via Azure AD. Sharing the primary access key grants full account-level access to everything in the storage account, far exceeding the least-privilege need, and manually rotating it is an operationally risky workaround. An Azure AD app registration would still require the third party to be able to authenticate against Azure AD, which the requirement explicitly rules out. Enabling public container access exposes the data to anyone on the internet, not just the intended third party, and toggling it manually is error-prone and not scoped to specific permissions or blobs.

Answer: A
GRS/GZRS replicates data asynchronously to a secondary, geographically distant region, and enabling account failover (or RA-GRS/RA-GZRS for read access) allows the storage account to continue serving requests if the primary region fails. LRS only replicates within a single datacenter, offering no protection against a regional or even datacenter-level outage. ZRS replicates synchronously across availability zones within a single region, protecting against datacenter failure but not a full regional outage. Relying solely on manual backups does not provide automatic failover or continuous availability during a regional outage; it would require manual restoration, causing extended downtime.

Answer: A
Azure File Sync centralizes file shares in Azure Files while keeping a cache of frequently used files on the on-premises server (cloud tiering) and provides multi-directional sync between the server endpoint and the cloud endpoint, matching the requirement exactly. AzCopy scheduled one-way only copies data in a single direction and does not provide caching or bidirectional sync. Azure Data Box is intended for one-time bulk data transfer via physical shipped devices, not ongoing bidirectional synchronization. The Azure Import/Export service similarly supports one-time bulk data movement using disks shipped to a datacenter, not continuous sync with local caching.

Answer: A
Azure automatically creates default system routes that enable direct communication between all subnets within the same virtual network, so without any NSG rules blocking it or custom routes overriding it, VMs in different subnets of the same VNet can reach each other. 'Peering' is a concept for connecting two separate VNets, not subnets within the same VNet, so no peering is needed here. A VPN gateway is used for connecting to on-premises networks or other VNets over encrypted tunnels, not for intra-VNet subnet communication. Availability Zones are a compute/infrastructure resiliency concept unrelated to whether subnets within a VNet can route to each other.

Answer: D
When NSGs exist at both subnet and NIC level, traffic must be allowed by both NSGs to pass; each NSG evaluates its own rules by priority order (lowest number first), and if either NSG has an explicit deny that applies (and no higher-priority allow overrides it within that same NSG), the traffic is blocked overall — so the actual outcome depends on each NSG's own rule priorities, not a blanket 'NIC always wins' or 'subnet always wins' rule. Neither NIC-level nor subnet-level NSGs automatically and entirely override the other; both are evaluated independently and traffic must pass both. Azure fully supports applying NSGs at both subnet and NIC levels simultaneously.

Answer: A
Global VNet peering connects VNets across regions using the Microsoft backbone network, enabling low-latency private IP communication without traversing the public internet, which is exactly what's needed here. A site-to-site VPN, while it can connect networks, typically uses IPsec tunnels over the public internet (or ExpressRoute) and is more commonly used for on-premises-to-Azure connectivity, adding unnecessary encryption/tunneling overhead compared to native peering for VNet-to-VNet in the same cloud. NAT gateways provide outbound internet connectivity for private resources; they do not establish private connectivity between two VNets. Assigning public IPs to VMs and exposing them via NSG rules routes traffic over the public internet and increases the attack surface, which conflicts with the requirement to avoid the public internet.

Answer: D
Network Watcher provides diagnostic tools such as IP flow verify (to check whether specific traffic is allowed or denied by NSG rules) and connection troubleshoot (to test connectivity and identify where a connection fails, including latency and hops), directly addressing suspected health probe or connectivity misconfigurations. Cost Management analyzes spending and has no role in network diagnostics. Identity Protection risk reports relate to user sign-in risk detection, unrelated to VM network connectivity. Azure Backup's restore point browser is for recovering backed-up data, not diagnosing live network issues.

Answer: A
Application Gateway operates at Layer 7 (HTTP/HTTPS) and supports path-based routing rules to direct requests to different backend pools based on URL path, as well as centralized SSL/TLS termination, matching all stated requirements. A standard Load Balancer operates at Layer 4 and distributes traffic based on IP/port, without awareness of HTTP paths or built-in SSL termination for path routing. ExpressRoute provides private dedicated connectivity between on-premises networks and Azure; it does not perform application-layer load balancing or path-based routing. An NSG filters traffic based on IP/port/protocol rules and has no concept of URL paths or SSL termination.

Answer: A
Historically, Azure provides a default outbound access IP for VMs that don't have an explicit outbound connectivity method (public IP, NAT gateway, or load balancer outbound rules) configured, allowing outbound internet connectivity, although Microsoft recommends explicit methods like a NAT gateway for reliability and to avoid this implicit, less-visible mechanism going forward. Outbound access is possible even without a public IP or NAT gateway due to this default mechanism, though it is not considered a best practice for production. A VPN gateway is unrelated to general internet-bound (as opposed to on-premises-bound) traffic. A managed identity is used for authenticating to Azure AD-secured services, and has no bearing on whether a VM has outbound internet connectivity.

Answer: A
Peering being 'Connected' only establishes the network-layer reachability path between VNets; NSGs applied to subnets or NICs, or user-defined routes that redirect or block traffic, can still prevent communication and must be checked separately. VNets with overlapping (identical or overlapping) address spaces actually cannot be peered successfully at all — non-overlapping address spaces are a prerequisite for peering to succeed, not a cause of connectivity failure after peering is already established. VM size has no bearing on network connectivity between peered VNets. The creation date of VMs is irrelevant to network connectivity.

Answer: A
Azure Private DNS zones allow custom domain names to be resolved within linked virtual networks without exposing those records to the public internet, and the same zone can be linked to multiple VNets for consistent internal name resolution. The default Azure-provided DNS only resolves Azure-internal hostnames automatically assigned to resources; it does not support custom private domain names like corp.internal. Public DNS zones are designed for internet-facing name resolution; there isn't a 'private visibility' toggle that turns a public zone into an internal-only one — that is what Private DNS zones are for. Simply opening port 53 outbound via an NSG rule does not create or host any DNS records; it only permits DNS traffic to flow, which is unrelated to actually defining the custom names.

Answer: A
Best practice for break-glass (emergency access) accounts is to explicitly exclude them from Conditional Access policies that could lock out administrators (like MFA requirements that might fail during an identity provider outage), while securing them with strong, unique, closely monitored credentials, ensuring they remain usable during an emergency. Simply granting Global Administrator without excluding it from the policy would still let the MFA-requiring policy apply and potentially cause lockout during the exact incident the account is meant to resolve. Placing it in the same group as regular users defeats its purpose as an exception path. A shared password known to multiple people is a poor security practice that increases risk of compromise and undermines accountability, even for an emergency account.

Answer: C
Azure RBAC role assignments are additive across scopes: permissions granted at a higher scope (subscription) are inherited by lower scopes (resource groups), and additional roles assigned directly at a lower scope add further permissions, so the user effectively has the union of Reader (from the subscription) and Contributor (from the resource group) — and since Contributor's permissions are a superset relevant to that resource group, the effective permission there is Contributor. RBAC does not have the subscription scope 'override' or take precedence over a more specific, additional assignment at a narrower scope. Conflicting Azure RBAC assignments don't cancel out; they combine (unlike deny assignments, which do override allow assignments, but that's not what's described here). There's no session-based 'role activation' choice for standard RBAC role assignments (that concept applies to PIM eligible role activation, not to two permanently active assignments as described).

Answer: A
Privileged Identity Management enables 'eligible' role assignments that users must actively activate, optionally requiring approval, justification, and MFA, with the elevated access automatically expiring after a configured duration, directly matching the just-in-time requirement. A permanent standing role assignment, even if periodically reviewed, keeps the user privileged at all times, which is the opposite of just-in-time, time-limited access. A conditional access device-compliance policy controls sign-in conditions but does not implement time-bound role activation or approval workflows for elevation. Dynamic groups automatically add/remove members based on attributes but do not provide time-limited, approval-gated privilege elevation.

Answer: C
Assigning the built-in 'allowed locations' policy at the root or a top-level management group ensures it is automatically inherited by all subscriptions currently under it and any new ones added later, minimizing ongoing manual work while enforcing the restriction tenant-wide. Manually assigning the policy per subscription requires repeated effort every time a new subscription is created and risks being forgotten. Azure AD user profile regional preferences have no effect on Azure resource deployment location restrictions. Azure Advisor only provides after-the-fact recommendations; it does not prevent resource creation in disallowed regions, so it fails the 'prevent' requirement.

Answer: A
A custom role composes Actions with NotActions to subtract from a broad grant, and DataActions covers operations on data within a resource rather than on the resource itself. AssignableScopes is mandatory and limits where the definition can be used, which prevents a role built for one subscription being assigned across the tenant.

Answer: A
Role assignments accumulate rather than override, so a narrower assignment cannot reduce what a broader one already granted. Reducing effective permissions requires either removing the broader assignment or using a deny assignment, which is why an unexpectedly permissive result usually traces to an inherited assignment higher in the hierarchy.

Answer: A
Assignment establishes compliance evaluation and governs new or updated resources, while bringing existing resources into line requires an explicit remediation task with a managed identity holding the necessary permissions. Setting the effect to deny would block future non-compliant deployments without correcting anything already present.

Answer: A
A move operates on a dependency set rather than a single resource, and support varies by resource type so the operation must be validated before attempting it. Moving between resource groups does not change region, and relocating to another region is a separate operation typically requiring redeployment or a replication service.

Answer: A
Locally redundant storage protects against hardware failure within one facility, zone-redundant extends that across facilities in a region, and geo-redundant adds a second region for regional protection. Read-access geo-redundant additionally permits reading from the secondary, which matters because plain geo-redundant data is not readable until a failover occurs.

Answer: A
A shared access signature delegates precisely scoped and expiring access without exposing the account key, which would grant full control over everything in the account. Anonymous public access removes access control entirely, and a stored access policy adds the ability to revoke a signature before its expiry, which a standalone signature does not offer.

Answer: B
Tiers trade storage price against access cost and latency, with archive cheapest to store and slowest and costliest to retrieve. Early deletion penalties apply to cool and archive tiers, so data moved to archive and deleted shortly afterward can cost more than leaving it in hot storage.

Answer: A
A purpose-built transfer utility handles resume after interruption, parallel transfer for throughput and synchronization so only changed files move, none of which manual portal upload provides. For very large one-time transfers a physical import service avoids the network entirely, which is the alternative when bandwidth arithmetic does not work.

Answer: A
A bastion service terminates the session inside the virtual network and reaches the machine over its private address, so the machines need no public IP and no inbound management rule. Just-in-time access is the alternative that opens the port only for an approved window, and a permanently open rule to a home range still exposes the port continuously to whoever else occupies that address space.

Answer: A
Autoscale rules pair a metric condition with an action, and the cooldown prevents a burst of scaling operations before the previous change has taken effect. Scale-out rules should be paired with scale-in rules using a different threshold, since identical thresholds cause the set to oscillate around the boundary.

Answer: A
Generalizing removes machine-specific identity so the image can produce many distinct machines, which is what distinguishes an image from a snapshot of a specific machine. Snapshots and backups restore the original machine rather than creating new independent ones, so using them as a deployment template produces identity conflicts.

Answer: A
App service removes operating system management and patching entirely while providing scaling and deployment slots, which suits standard web workloads. Virtual machines retain full control at the cost of that operational work, so the choice is a trade between customization needs and the burden of maintaining the platform.

Answer: A
Slot swapping addresses both cold start on release and rollback speed, since the previous version remains warm in the other slot after the swap. Slot-specific settings must be marked as such, or configuration intended for staging follows the application into production during the swap.

Answer: A
Subnets in the same virtual network route to one another by default, so restriction requires explicit rules rather than being the starting position. Rules are evaluated in priority order with the first match applying, and default rules at the bottom permit intra-network traffic, which is why a restrictive rule must be given a priority above them.

Answer: A
Traffic must pass every layer, so a rule permitting it at one level is defeated by a block at another, and both subnet and interface groups apply where both exist. The guest firewall is a frequent oversight because platform-level rules appear correct while the operating system silently drops the packets.

Answer: A
Private DNS zones resolve names within linked virtual networks and can register records automatically, keeping internal topology unpublished. Publishing private addresses in a public zone discloses internal structure to anyone who queries it, and maintaining hosts files does not scale and drifts immediately.

Answer: A
The load balancer works at the transport layer without inspecting request content, while an application gateway inspects HTTP and can route by path or host and terminate TLS. Traffic manager operates through DNS responses and therefore distributes across regions rather than balancing individual connections.

Answer: A
Routing determines where packets go while security groups only permit or deny, so forcing traffic through an appliance requires a route rather than a rule. The appliance must also have IP forwarding enabled on its interface, which is the step most often missed when traffic reaches it but goes no further.

Answer: A
Flow verification evaluates the combined effective rules across subnet and interface groups and reports which one decided the outcome, which manual inspection of overlapping rule sets frequently gets wrong. The activity log records who changed configuration rather than how traffic is currently evaluated, so it answers a different question.

Answer: D
The activity log covers control plane operations such as create, update and delete along with who performed them, whereas diagnostic logs record what happened inside a resource. Activity log retention is limited by default, so exporting to a workspace or storage is necessary where longer investigation windows are required.

Answer: A
Separating the condition from the notification lets one action group serve many alert rules, so changing an on-call contact updates every alert at once. Action groups can also invoke automation such as a function or a webhook, which is how alerting is connected to automated remediation.

Answer: A
Backup addresses recovery from logical loss such as deletion or corruption, which redundancy and availability features do not, since those replicate the deletion faithfully. Site recovery is the complementary service addressing regional failover for continuity rather than point-in-time restoration.

Answer: A
Update management provides the assessment, scheduled deployment and compliance reporting that ad hoc patching cannot, and maintenance windows contain the disruption. Permitting update traffic is a prerequisite for reaching update sources but provides no orchestration or evidence of what was applied.

Answer: A
Incremental mode is the default and additive, whereas complete mode removes resources in the target scope that the template does not define. Complete mode is powerful for enforcing a declared state and correspondingly dangerous, since a resource omitted by mistake is deleted rather than ignored.

Answer: A
File shares provide the SMB protocol and hierarchical structure that existing applications expect, which blob storage's HTTP object model does not. Access from on-premises typically requires private connectivity or the appropriate port to be permitted, since the SMB port is commonly blocked by internet service providers.

Answer: D
Guest invitation lets the partner authenticate with their own credentials, so their organization's lifecycle events such as a departure remove the access without action on the host side. Creating and sharing internal accounts breaks attribution entirely, since actions cannot be traced to an individual person.

Answer: A
Eligible assignments replace standing privilege with activation on demand, which shrinks the window during which a compromised account holds administrative rights. Activation records who elevated, when and why, producing an audit trail that permanent assignment cannot generate.

Answer: A
Expanding the disk at the platform level makes capacity available, but the partition and file system inside the guest must be extended before applications can use it. Shrinking a managed disk is not supported, which is why over-provisioning is not easily reversed and initial sizing deserves more attention than it usually receives.