Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

Your company has an Azure environment structured with the following hierarchy:

* Management Group: `MG-Production`
* Subscription: `Sub-AppServices`
* Resource Group: `RG-DataStorage`
* Storage Account: `saproddata101`

A user-assigned managed identity named `mi-web-app` is used by an App Service web app. The web app must be able to read, write, and delete blobs inside the containers of `saproddata101` using Microsoft Entra authentication. The solution must follow the principle of least privilege and prevent the managed identity from deleting or modifying the configuration of the storage account itself.

Which role assignment should you configure?

  1. Assign the Storage Blob Data Contributor role to mi-web-app at the scope of the saproddata101 storage account.Answer
  2. B
    Assign the Storage Account Contributor role to mi-web-app at the scope of the saproddata101 storage account.
  3. C
    Assign the Storage Blob Data Contributor role to mi-web-app at the scope of the MG-Production management group.
  4. D
    Assign the Microsoft Entra ID Application Administrator role to mi-web-app at the scope of the Sub-AppServices subscription.

Answer

Assign the Storage Blob Data Contributor role to mi-web-app at the scope of the saproddata101 storage account.
The correct answer is to assign the Storage Blob Data Contributor role to the managed identity at the scope of the saproddata101 storage account. This role grants the specific permissions needed to read, write, and delete blobs using Microsoft Entra authentication. By scoping it to the storage account itself, the permissions are restricted to only this resource, meeting the requirement of least privilege. It also does not grant permissions to modify or delete the storage account resources, ensuring control plane actions are blocked.

Step-by-Step Solution

1
Identify the data plane requirements and authentication method.
The application requires read, write, and delete permissions on blobs using Microsoft Entra ID authentication.
Traditional control-plane roles like Contributor or Storage Account Contributor do not automatically grant direct Microsoft Entra ID-based data access (like Blob read/write) without using access keys.
2
Determine the role that aligns with the principle of least privilege.
The Storage Blob Data Contributor role is selected.
This role allows blob data operations but prevents control plane modifications like deleting or resizing the storage account.
3
Identify the correct scope to apply the role assignment.
The scope must be the storage account itself (saproddata101).
Assigning the role at the management group level (MG-Production) would inherit down and grant access to all storage accounts in the hierarchy, violating least privilege.

Key Concept

Azure RBAC Roles and Scopes for Data Plane Access
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic