Microsoft Updated AZ-104 Exam Questions and Answers by mylo

In Microsoft Azure, containerized application deployment can occur using multiple services, depending on the image type and operating system platform used. The question refers to two images — Image1 (Windows Server) and Image2 (Linux) — which are stored in an Azure Container Registry (ACR).

According to the Microsoft Azure Administrator Study Guide (AZ-104) and official Azure documentation, both Windows-based and Linux-based container images can be deployed using any of the following services, depending on the workload requirements:

Azure App Service (Web App for Containers) – supports both Windows and Linux containers for web applications. It allows developers to directly deploy containerized applications from Docker Hub, Azure Container Registry, or a private registry.

Azure Container Apps – serverless container hosting designed for microservices and event-driven architectures. It supports Linux and Windows containers, using Kubernetes behind the scenes, without requiring users to manage the cluster infrastructure.

Azure Container Instances (ACI) – provides lightweight, serverless containers for quick deployment and isolated workloads. It supports both Windows and Linux images and can pull directly from Azure Container Registry.

Therefore, since both Image1 (Windows Server) and Image2 (Linux) are valid container images supported by the same three Azure container services, the correct and verified solution is to select “App Service, Azure Container Apps, or Azure Container Instances” for both.

This matches Azure documentation under:

“Run containerized applications in Azure App Service”

“Deploy containers using Azure Container Instances”

“Build and deploy microservices using Azure Container Apps”

Each of these Azure services supports containerized deployments from ACR regardless of the underlying operating system image type.

Final Verified Answer:

✅ Image1: App Service, Azure Container Apps, or Azure Container Instances

✅ Image2: App Service, Azure Container Apps, or Azure Container Instances

In Azure, storage account keys are managed through Azure Role-Based Access Control (RBAC) permissions. The ability to list and regenerate storage account keys requires access to specific management operations on the storage account resource, not encryption scopes.

According to Microsoft Azure Administrator documentation, the permissions required to list and regenerate storage account keys are:

Microsoft.Storage/storageAccounts/listkeys/action

Microsoft.Storage/storageAccounts/regeneratekey/action

Only specific built-in roles include these actions, such as:

Owner

Contributor

Storage Account Contributor

However, the role mentioned in the question — Storage Account Encryption Scope Contributor — is designed for a different purpose.

From Microsoft’s official documentation for Storage Account Encryption Scope Contributor:

“Grants permissions to manage encryption scopes within a storage account. Does not grant access to manage storage account keys or data.”

This means that assigning the Storage Account Encryption Scope Contributor role gives the user permissions to configure encryption scopes (for example, enabling or modifying encryption at the blob container level), but not to list or regenerate access keys.

Therefore, the solution fails to meet the requirement of enabling User1 to list and regenerate keys.

To achieve the goal, the correct role would be:

✅ Storage Account Contributor

This role explicitly allows managing all storage account properties, including key management.

Key Point (Microsoft Official Documentation Summary):

Storage Account Encryption Scope Contributor → Manage encryption scopes only.

Storage Account Contributor → Manage storage account settings, including listing and regenerating keys.

https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#:~:text=The%20User%20Access%20Administrator%20role%20enables%20the%20user%20to%20grant,Azure%20subscriptions%20and%20management%20groups.

Litwareinc.com users can be assigned to package1. = No

After 365 days, fabrikam.com users will be removed from Group1. = Yes

After 395 days, fabrikam.com users will be removed from the contoso.com tenant = No

Litwareinc.com users cannot be assigned to package1 because they are not a connected organization in the contoso.com tenant. Only users from connected organizations can request access packages that are configured for external users1

Fabrikam.com users will be removed from Group1 after 365 days because the access package has an expiration policy of 365 days for external users. This means that the access assignments for external users will end after 365 days, unless they are renewed or extended2

Fabrikam.com users will not be removed from the contoso.com tenant after 395 days because the external user lifecycle settings have a deletion policy of 30 days after blocking. This means that external users will be blocked from signing in after 365 days of inactivity, and then deleted after another 30 days. Therefore, the total time before deletion is 395 days of inactivity, not 395 days from the date of assignment3