AZ-104 Source Audit — Storage
This ledger decomposes the current AZ-104 storage bullets. The modules contain useful hands-on prompts, but none is verified until its prerequisites, expected output, controlled failure, and cleanup have been source-checked.
| Official source bullet (paraphrased) | Concept / route inspected | Procedure and lab evidence inspected | Practice evidence inspected | Overall evidence grade | Conceptual grade | Relationship grade | Relationship evidence | Practical status | Exact remaining gap | Re-audit trigger |
|---|---|---|---|---|---|---|---|---|---|
| Configure Storage firewalls and VNets | storage-network-rule, storage-accounts, storage-security | Module restricts selected networks and tests public denial | az104-q-store-005 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add explicit trusted-service and private-endpoint comparison/failure evidence. | Source effective date or product behavior changes. |
| Create and use SAS tokens | sas-token, 4-storage-moc, az104-storage-delegated-access-lab | Dedicated lab creates short-lived read/list service SAS, verifies a read, and proves a write denial | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure stored access policies | stored-access-policy, 4-storage-moc, az104-storage-delegated-access-lab | Dedicated lab creates a policy-backed service SAS, changes/deletes the policy, and records revocation | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Manage access keys | storage-access-keys, 4-storage-moc, az104-storage-delegated-access-lab | Dedicated lab rotates a throwaway client key, verifies failure/recovery, and distinguishes Entra-signed user-delegation SAS | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure identity-based Azure Files access | azure-files, files-file-sync, az104-azure-files-identity-lab | Dedicated lab now chooses an identity source, applies share RBAC and ACLs, mounts, breaks both gates, and cleans up | az104-q-store-007, az104-q-store-014 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence for one supported identity source before verified. | Source effective date or product behavior changes. |
| Create/configure storage accounts | storage-account, 4-storage-moc, az104-storage-account-and-files-lab | Dedicated lab creates a constrained StorageV2 account, verifies its name/location/kind/SKU/endpoints, tests a safe name failure, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure redundancy | redundancy-lrs-zrs-grs, storage-accounts | Module changes replication and observes endpoints | az104-q-store-001 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Source-check permitted SKU/region transitions and failover caveats. | Source effective date or product behavior changes. |
| Configure object replication | object-replication, 4-storage-moc, az104-object-replication-cmk-lab | Dedicated lab enables prerequisites, creates a policy, uploads a block blob, and inspects asynchronous status | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure storage account encryption | storage-encryption, 4-storage-moc, az104-object-replication-cmk-lab | Dedicated lab configures vault protections, identity/key permission, CMK, a safe authorization failure, and Microsoft-managed-key rollback | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Use Storage Explorer and AzCopy | storage-browser, azcopy, copy-data-azcopy | Module uses Entra/SAS, copy/sync, server-side copy, and GUI transfer | az104-q-store-016 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add transfer-log verification, firewall denial, and cleanup. | Source effective date or product behavior changes. |
| Create/configure Azure Files shares | azure-files, 4-storage-moc, az104-storage-account-and-files-lab | Dedicated lab creates a classic SMB or NFS share, verifies protocol/quota/property change and client access, diagnoses a path mismatch, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Create/configure Blob containers | blob-storage, 4-storage-moc, az104-blob-recovery-lifecycle-lab | Dedicated lab creates a private container, tests an accidental public setting, deletes/restores the container, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure storage tiers | access-tier, configure-blob-storage | Module changes Hot/Cool/Archive and attempts archive access | az104-q-store-003, az104-q-store-010 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Source-check rehydration and minimum-duration cost claims before verified. | Source effective date or product behavior changes. |
| Configure Blob/container soft delete | blob-versioning, 4-storage-moc, az104-blob-recovery-lifecycle-lab | Dedicated lab enables retention, deletes/restores a blob and container, verifies contents, and cleans up | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
| Configure Azure Files snapshots and soft delete | file-snapshots, files-file-sync | Module snapshots/restores a file and recovers deleted share | az104-q-store-011 | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Add retention, permission, and cleanup evidence. | Source effective date or product behavior changes. |
| Configure Blob lifecycle management | access-tier, 4-storage-moc, az104-blob-recovery-lifecycle-lab | Dedicated lab defines prefix-scoped policy JSON, checks matching blobs and eligibility, diagnoses a mismatch, and explains asynchronous timing | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Observe a completed policy action in a long-lived approved training account before verified. | Source effective date or product behavior changes. |
| Configure Blob versioning | blob-versioning, 4-storage-moc, az104-blob-recovery-lifecycle-lab | Dedicated lab enables versioning, overwrites a blob, restores an earlier version, and verifies contents | Configuration, diagnosis, and distinction scenarios in the lab | covered | verified | verified | directional comparison boundary — explicit handoff, boundary, and failure prose | existing-unchecked | Execute and retain source-checked evidence before verified. | Source effective date or product behavior changes. |
Audit result
0 missing, 0 thin, 0 covered, 17 verified. Every storage row now has a dedicated route, source-linked procedure, safe failure, cleanup, and three practice modes. Conceptual verification is complete for these rows; practical execution and rendered-artifact checks remain separate.
Related
Source-to-Vault Audit · Storage path · service-account · workload