Storage Account Types, Redundancy and Failover
Almost every storage question reduces to two choices: which account kind, and which redundancy option. General purpose v2 is the default and the only answer unless the scenario pushes you elsewhere, because it carries blobs, files, queues and tables with access tiers. Premium accounts trade breadth for latency and are chosen per workload: premium block blobs for high transaction rates, premium file shares for SMB and NFS performance, and premium page blobs for unmanaged disks. Redundancy is the other axis. Locally redundant storage keeps three copies inside one datacentre and protects against drive and rack failure only. Zone redundant storage spreads three copies across three availability zones in one region and survives the loss of a zone. Geo redundant storage keeps three local copies and asynchronously replicates to the paired region, and geo zone redundant storage combines zone spreading in the primary with that geo replication. The read access variants, RA-GRS and RA-GZRS, are the only way to read the secondary copy before a failover, through the separate secondary endpoint. Because geo replication is asynchronous, a failover can lose recent writes, and a customer-managed failover leaves the account as locally redundant afterward so you must reconfigure geo redundancy yourself.
Exam tip. Match the redundancy to the failure named in the question and nothing more. A zone outage means ZRS, a regional outage means GRS or GZRS, and the words read from the second region are what force the RA variants.
Blob Access Tiers, Lifecycle Management and Data Protection
Blob storage prices storage against access, so the tier decision is a bet on how often the data is read. Hot costs the most to store and the least to read. Cool is cheaper to store with higher read costs and a 30 day minimum retention. Cold is cheaper again with a 90 day minimum. Archive is the cheapest storage and is offline: the data cannot be read at all until it is rehydrated to hot or cool, which takes hours, and it carries a 180 day minimum. Leaving any of these tiers before the minimum incurs an early deletion charge for the remaining days, which is why moving data down a tier too eagerly can cost more than leaving it alone. Lifecycle management automates the movement with rules based on days since creation, last modification or last access, and it is the only sensible way to run tiering at scale. Data protection is a separate stack of features that people confuse constantly. Soft delete keeps deleted blobs or containers recoverable for a retention period. Versioning automatically keeps a previous version each time a blob is overwritten. Snapshots are manual, read-only, point-in-time copies you create yourself. Object replication asynchronously copies block blobs from one account to another, and it requires versioning and change feed on the source.
Exam tip. If a question asks how to recover a blob someone overwrote, the answer is versioning or a snapshot, not soft delete. Soft delete recovers deletions. If it asks how to recover a blob someone deleted, that is soft delete.
Storage Access Control: Keys, SAS and Microsoft Entra Authorization
There are three ways to reach data in a storage account and the exam expects you to pick between them on the wording of the requirement. The two account access keys give complete control of the whole account and have no expiry, which is why they exist in pairs: you rotate one while applications use the other, then swap. A shared access signature grants limited, time-boxed access to specific resources, and its three types differ in what signs them. An account SAS is signed with an access key and can cover several services. A service SAS is signed with an access key and covers one service. A user delegation SAS is signed with a Microsoft Entra key, applies to blobs, and is the only kind that can be revoked by revoking the user delegation key or by removing the signing user's permissions. Tying a service SAS to a stored access policy is the other way to get revocation, because deleting the policy invalidates every SAS issued under it. Microsoft Entra authorization with RBAC data roles, such as Storage Blob Data Reader and Storage Blob Data Contributor, is the option Microsoft recommends because no secret is handed out at all. Network controls sit alongside all of this: switching the account firewall from all networks to selected networks blocks everything that is not on an allowed virtual network subnet or IP range, including the portal's own data view, until you add an exception.
Exam tip. Read the word revoke carefully. A plain service SAS cannot be revoked without regenerating the key and breaking everything else that uses it, which is why the correct answer is nearly always a stored access policy or a user delegation SAS.
Azure Files, File Sync and Moving Data
Azure Files provides fully managed file shares reachable over SMB, NFS and the REST API, which is what separates it from blob storage in a scenario. An SMB share can be mounted by Windows, Linux and macOS clients and authenticated either with the storage account key or with identity-based authentication using on-premises Active Directory Domain Services, Microsoft Entra Domain Services or Microsoft Entra Kerberos for hybrid identities. NFS shares require a premium file share and use network-level security rather than identity. Azure File Sync turns a Windows Server into a cache of an Azure file share: you install the sync agent, register the server with a Storage Sync Service, create a sync group whose cloud endpoint is the file share and whose server endpoints are folders on registered servers, and cloud tiering then replaces cold files on the server with pointers so the local disk holds only the hot working set while the full data set lives in Azure. For getting data in and out, AzCopy is the scriptable command line tool for bulk copying between accounts and from local disk, Storage Explorer is the graphical option for browsing and ad hoc work, and Azure Import/Export or Data Box covers volumes too large to send over the network.
Exam tip. The phrase branch office file server with local performance and a single central copy is Azure File Sync with cloud tiering, every time. If the requirement is only to give cloud VMs a shared drive, a plain Azure Files share is enough and File Sync is the over-engineered wrong answer.