AZ-104 Question 90

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A3

  The correct answer is: A. Enable Active Directory Domain Service (AD DS) authentication for storage1. Why not the others? B. Grant share-level permissions by using File Explorer ➤ That comes after AD authentication is enabled and is used for NTFS permissions, not RBAC assignment. C. Mount share1 by using File Explorer ➤ Mounting can only happen after authentication is enabled and permissions are in place. D. Create a private endpoint ➤ This is optional and only used to restrict access via a private network, not required for enabling AD-based authentication or RBAC.

• 1

  A is correct

• Chose A2

  Answer: Enable Active Directory Domain Service (AD DS) authentication for storage1. "1. Enable Azure AD DS authentication over SMB for your storage account to register the storage account with the associated Azure AD DS deployment. 2. Assign share-level permissions to an Azure AD identity (a user, group, or service principal)." https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal#overview-of-the-workflow https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal#assign-share-level-permissions