Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription that contains a resource group named rg-finance. Within rg-finance, there is an Azure Storage account named stfinrecords that hosts a blob container named historical-data. A financial analyst named Taylor needs to read the blobs in the historical-data container. You must configure access to meet the following requirements:
- Taylor must authenticate by using Microsoft Entra ID.
- Taylor must be prevented from modifying any data or storage account configurations.
- The solution must follow the principle of least privilege.
Which role should you assign to Taylor?

  1. A
    Reader assigned at the stfinrecords storage account level
  2. B
    Storage Account Contributor assigned at the stfinrecords storage account level
  3. Storage Blob Data Reader assigned at the historical-data container levelAnswer
  4. D
    User Administrator assigned in Microsoft Entra ID

Answer

Storage Blob Data Reader assigned at the historical-data container level
Assigning the Storage Blob Data Reader role at the container level is correct because it grants read-only data plane access to the specific container using Microsoft Entra ID credentials. It ensures the user can read the blobs without granting control plane management permissions or key access, satisfying the principle of least privilege.

Step-by-Step Solution

1
Identify the authentication mechanism required for data access.
Microsoft Entra ID authentication is specified, meaning Azure RBAC roles governing the data plane must be used.
Traditional control plane roles (like Owner or Reader) do not automatically grant data plane permissions when authenticating with Entra ID.
2
Select the correct role that offers read-only access to the blobs.
The Storage Blob Data Reader role is identified as the standard role for reading blob content.
This role grants data-level read permissions while preventing any write or delete actions on the blobs.
3
Scope the role assignment to enforce the principle of least privilege.
Assign the role at the scope of the historical-data container rather than the storage account or resource group.
This limits Taylor's access to only the specific container required for the task, preventing access to other containers or storage resources.

Key Concept

Azure RBAC Control Plane versus Data Plane Roles for Storage
Estimated Time:1m 30s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic