Explanation:
Access Control (IAM) - to grant User1 permission to write blob data.
Geo-replication - to perform and manage the failover operation to the secondary region.
This question involves granting write access for a user to an Azure Storage Account (RA-GRS type) and initiating a failover operation to its secondary endpoint.
Let's analyze the requirements step-by-step based on the Azure Administrator AZ-104 study guide.
Requirement 1 - "User1 must be able to write blob data to contoso2023." To allow a user (User1) to write blob data to an Azure Storage account, you must assign the appropriate Azure RBAC (Role-Based Access Control) role.
This is managed through Access Control (IAM) in the storage account.
In this scenario, you would assign a built-in Azure role such as:
Storage Blob Data Contributor (allows read/write/delete permissions to blob data) Storage Blob Data Owner (if full data control is required) This is done by navigating to:
## Storage account # Access Control (IAM) # Add role assignment # Select Role # Assign to User1.
This satisfies the requirement for User1 to write blob data to the storage account.
# Correct setting: Access Control (IAM)
Requirement 2 - "The contoso2023 account must fail over to its secondary endpoint." An RA-GRS (Read-Access Geo-Redundant Storage) account replicates data asynchronously to a secondary region.
Under normal circumstances, only read access is available from the secondary region.
To initiate failover, you must promote the secondary region to become the new primary.
This is achieved through the Geo-replication settings of the storage account.
Steps to perform failover:
Navigate to the storage account (contoso2023).
Under the Data management section, select Geo-replication.
Review the replication status and click Initiate account failover.
Confirm the failover operation.
This process switches the account to use the secondary endpoint as the new primary, satisfying the second requirement.
# Correct setting: Geo-replication
Why Not Other Options
Access Keys / SAS: Used for authentication, not for RBAC-based permission assignment or failover operations.
Networking: Used to control access via IP or VNet, not permissions or replication.
Data Protection / Encryption: Manage backups and encryption, unrelated to failover or user access.
# Verified Microsoft Learn Documentation Extract (AZ-104 Reference):
"To grant access to Azure Storage resources for specific users, assign an Azure RBAC role such as Storage Blob Data Contributor through Access Control (IAM)."
"To initiate a failover from the primary to the secondary region in a geo-redundant storage account, navigate to the Geo-replication settings and select Initiate account failover." (Source: Microsoft Learn - Manage access to Azure Storage with RBAC and Perform a storage account failover,