Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization manages its Azure resources using a hierarchy that contains the Enterprise-MG management group, the Finance-Sub subscription, the Logs-RG resource group, and a storage account named financelogs2026.

An auditor named Jordan needs to view blob data stored in the containers of the financelogs2026 storage account to verify compliance. Jordan must not be able to modify the storage account configuration or view data in other storage accounts within the subscription.

Which role assignment meets this requirement while adhering to the principle of least privilege?

  1. Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage accountAnswer
  2. B
    Assign the Reader role at the scope of the Logs-RG resource group
  3. C
    Assign the Storage Blob Data Reader role at the scope of the Finance-Sub subscription
  4. D
    Assign the Global Reader directory role in Microsoft Entra ID

Answer

Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage account
Assigning the Storage Blob Data Reader role at the scope of the financelogs2026 storage account satisfies the requirement. It provides data-plane access to read container blobs for the specific storage account, while restricting the user from making modifications or accessing other storage accounts, thus adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the type of access required.
The requirement is to read blob data (data plane), not just manage the storage resource (control plane).
This determines whether a standard control-plane role (like Reader) or a data-plane role (like Storage Blob Data Reader) is needed.
2
Apply the principle of least privilege by targeting the correct scope.
The user only needs access to the financelogs2026 storage account, not the entire resource group or subscription.
Assigning the role at the storage account level prevents access to other storage accounts in the resource group or subscription.
3
Select the correct role type.
The Storage Blob Data Reader role grants the required data-plane read permissions, whereas Microsoft Entra ID roles do not apply to subscription resources.
This satisfies the technical requirement while keeping access restricted to the minimum permissions needed.

Key Concept

Azure RBAC roles separate control-plane and data-plane access, and should be assigned at the narrowest scope possible to enforce least privilege.
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic