Task 2.2: Configure and manage storage accounts

• AGeo-zone-redundant storage (GZRS)

  Incorrect

  GZRS copies to the secondary region, but the secondary isn't readable until a failover.

• BRead-access geo-redundant storage (RA-GRS)

  Incorrect

  RA-GRS keeps the primary copies in one zone with LRS, so a zone loss isn't covered.

• CZone-redundant storage (ZRS)

  Incorrect

  ZRS spreads copies across zones in one region only; there's no secondary region to read from.

• DRead-access geo-zone-redundant storage (RA-GZRS)

  Correct

  RA-GZRS replicates across zones in the primary region and to a secondary region that is readable at all times.

GZRS combines ZRS in the primary region with geo-replication; the RA variant adds read access to the secondary region without a failover. RA-GRS has read access but uses LRS in the primary region.

• ABlob versioning on StorA and on StorB

  Correct

  Object replication requires blob versioning enabled on both the source and the destination accounts.

• BPoint-in-time restore on StorA

  Incorrect

  Point-in-time restore is a data protection feature; object replication doesn't depend on it.

• CGeo-redundant storage on StorB

  Incorrect

  Object replication lists no redundancy requirement; it depends on versioning and change feed, not on GRS.

• DContainer soft delete on StorB

  Incorrect

  Container soft delete protects containers from deletion; it isn't a prerequisite for replication.

• EChange feed on StorA

  Correct

  Azure Storage reads the source account's change feed to find writes and deletes to replicate, so it must be enabled there.

Object replication copies block blobs asynchronously between accounts. It needs blob versioning on both accounts and change feed on the source, and it isn't supported on accounts with a hierarchical namespace.

• Aazcopy copy 'D:\site' 'https://stweb.blob.core.windows.net/web' --recursive

  Incorrect

  copy uploads files but never removes blobs that no longer exist in the source folder.

• Bazcopy sync 'D:\site' 'https://stweb.blob.core.windows.net/web' --recursive

  Incorrect

  By default sync doesn't delete anything at the destination, so blobs for removed files would remain.

• Cazcopy sync 'D:\site' 'https://stweb.blob.core.windows.net/web' --recursive --delete-destination=true

  Correct

  With --delete-destination=true, sync deletes destination blobs that aren't in the source, without prompting.

• Dazcopy sync 'D:\site' 'https://stweb.blob.core.windows.net/web' --recursive --delete-destination=prompt

  Incorrect

  prompt asks before each deletion, which stalls an unattended job.

azcopy sync compares names and last-modified times and copies what changed. Deleting extra files at the destination needs --delete-destination, and true deletes without a prompt; enabling soft delete first protects against mistakes.

• Acontosologs01

  Correct

  Lowercase letters and numbers, between 3 and 24 characters, and unique across Azure.

• Bcl

  Incorrect

  Two characters is shorter than the 3-character minimum.

• Ccontoso_logs_01

  Incorrect

  Underscores aren't allowed.

• DContoso-Logs-01

  Incorrect

  Uppercase letters and hyphens aren't allowed in storage account names.

Storage account names are 3 to 24 characters of lowercase letters and numbers, and must be unique across Azure because they form the endpoint URLs.

• AAllow storage account key access

  Incorrect

  Key access is about authorization, not the transport protocol.

• BMinimum TLS version, set to 1.2

  Correct

  The minimum TLS version makes the account reject requests that use older versions.

• CInfrastructure encryption

  Incorrect

  Infrastructure encryption protects data at rest, not connections.

• DSecure transfer required

  Incorrect

  Secure transfer requires HTTPS but doesn't set which TLS version is accepted.

The minimum TLS version setting rejects requests below the chosen version. Secure transfer separately forces HTTPS.

• AConnect to the storage account with Microsoft Entra ID

  Incorrect

  An Entra connection still needs an identity with access in your tenant, which the contractor doesn't have.

• BAttach to the container with the SAS URL

  Correct

  Storage Explorer can attach to an individual resource using a SAS, without signing in to Azure.

• CConnect with the storage account's connection string from you

  Incorrect

  A connection string with the account key would expose the whole account.

• DSign in to Azure with a personal Microsoft account

  Incorrect

  Signing in shows resources the account can access; a personal account has no access to your tenant.

Storage Explorer can sign in to Azure, which needs management and data permissions, or attach to an individual resource using a SAS, connection string or other method. A container SAS limits the contractor to that container.

• Aazcopy copy between the two container URLs

  Correct

  AzCopy copies between accounts using the service's server-to-server copy, without routing data through your machine.

• BSet object replication and then delete the policy

  Incorrect

  Object replication is ongoing asynchronous replication, not a one-time copy tool.

• CDownload the container with Storage Explorer, then upload it

  Incorrect

  Downloading and uploading moves the data through your machine.

• Dazcopy sync with the local folder as the destination

  Incorrect

  Syncing to a local folder downloads the data instead of copying it between accounts.

azcopy copy accepts two blob URLs, each with a SAS or Microsoft Entra authorization, and copies between accounts server to server.