Examkin

Question

Difficulty: HardConfigure Microsoft Entra ID Authentication for Storage

Your organization has an Azure subscription containing a resource group named rg-finance. The resource group contains an Azure Storage account named stfinance2026. Inside stfinance2026, there is a blob container named audits. A security auditor named User1 needs to use the Azure portal to navigate to the storage account, view its configurations, and download reports from the audits container. User1 must authenticate using Microsoft Entra ID. Access keys and Shared Access Signatures (SAS) must be disabled and not used. You need to grant User1 the necessary access using the principle of least privilege. Which combination of Azure role assignments should you configure?

  1. Assign the Reader role at the scope of the stfinance2026 storage account, and assign the Storage Blob Data Reader role at the scope of the audits container.Answer
  2. B
    Assign the Reader role at the scope of the rg-finance resource group, and assign the Reader role at the scope of the audits container.
  3. C
    Assign the Storage Blob Delegator role at the scope of the stfinance2026 storage account, and assign the Reader role at the scope of the rg-finance resource group.
  4. D
    Assign the Contributor role at the scope of the rg-finance resource group.

Answer

Assign the Reader role at the scope of the stfinance2026 storage account, and assign the Storage Blob Data Reader role at the scope of the audits container.
The correct configuration provides the minimum necessary permissions. Navigating the Azure portal to view the storage account configuration requires a control plane role, which is satisfied by the Reader role at the storage account scope. Downloading blobs requires data-plane access via Microsoft Entra ID, which is satisfied by the Storage Blob Data Reader role at the specific container scope.

Step-by-Step Solution

1
Determine the control plane access requirements.
User1 needs to navigate to the storage account in the Azure portal. This requires control plane access, which is provided by the Reader role at the storage account level.
Control plane roles are necessary to view Azure Resource Manager (ARM) resources in the portal.
2
Determine the data plane access requirements.
User1 needs to download reports from the audits container. Since Microsoft Entra ID authentication is required and access keys are disabled, User1 needs the Storage Blob Data Reader role at the audits container scope.
Data plane roles are required to access blob storage content when using Microsoft Entra ID authentication.
3
Apply the principle of least privilege.
Assign Reader at the storage account level (rather than the resource group level) and Storage Blob Data Reader at the container level (rather than the storage account level).
This restricts control and data plane permissions to the smallest possible scopes that satisfy the requirement.

Key Concept

Azure RBAC splits control plane (management) and data plane (content) access. Storage data access via Microsoft Entra ID requires data-plane roles like Storage Blob Data Reader, while navigating the portal requires control-plane roles like Reader.
Estimated Time:2m 30s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic