Microsoft Updated AZ-104 Exam Questions and Answers by malakai

n this scenario, User1 has two role assignments:

Reader (Inherited from Resource Group scope)

Scope: Resource Group (inherited)

Permission type: Read-only access

Allows User1 to view the configuration and properties of Azure resources within the resource group (including the storage account).

However, it does not allow data operations, such as reading or writing blob contents.

Storage Blob Data Contributor (Assigned at “This resource” level)

Scope: storageacct1234 (this resource)

Permission type: Data access for blob content

Allows read, write, and delete operations on blob data in the storage account.

According to Microsoft Azure built-in roles documentation:

Reader role: “View Azure resources but cannot make any changes.”

Storage Blob Data Contributor role: “Grants read, write, and delete permissions to Azure Storage blob containers and data.”

This means:

User1 can upload blobs because the Storage Blob Data Contributor role provides write permissions.

User1 can view blob data because the same role provides read access to blob content.

User1 cannot assign roles (no RBAC management rights, as the role doesn’t include Microsoft.Authorization/* actions).

User1 cannot modify the firewall or network settings of the storage account — those actions require Contributor or Owner roles at the management plane level.

User1 can view file shares under the storage account metadata due to Reader access but cannot access data within them because that requires Storage File Data SMB Share Reader/Contributor permissions (different data plane).

✅ Final Verified Answers:

B. Upload blob data to storageacct1234

D. View blob data in storageacct1234

Summary (from Microsoft Role Documentation Extracts):

Storage Blob Data Contributor = Can read/write/delete blob data (Data Plane)

Reader = Can view Azure resource configuration (Management Plane)

No permission to assign roles or modify security/firewall settings.

https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability https://docs.microsoft.com/en-us/azure/availability-zones/az-overview#availability-zones

Traffic Analytics is a feature within Azure Network Watcher that provides insights into network traffic patterns, security threats, and performance using NSG flow logs. To enable Traffic Analytics, two key resources are required:

A Log Analytics Workspace – This is where Azure Network Watcher sends and stores the processed flow log data for analysis.

A Storage Account – Network Security Group (NSG) flow logs are first written to a designated storage account before they are ingested by Traffic Analytics for processing.

According to Microsoft Azure Administrator documentation, under “Enable Traffic Analytics”:

“Traffic Analytics uses Network Watcher NSG flow logs, which must be stored in a storage account. These logs are then processed and analyzed in a Log Analytics workspace to provide insights into network activity.”

Workflow:

NSG flow logs → stored in Azure Storage Account

Logs are processed by Azure Monitor → ingested into Log Analytics workspace

Traffic Analytics visualizes and analyzes the data

Other options such as Azure Monitor workbooks or Sentinel workspaces are not mandatory to activate Traffic Analytics.

Thus, to use Traffic Analytics, you must create:

✅ A Storage Account to store flow logs

✅ A Log Analytics Workspace to process and visualize them