Examkin

Question

Difficulty: MediumManage Data Movement using AzCopy and Storage Explorer

An IT department implements a security policy that disables shared key access for all Azure Storage accounts. To upload log files to a blob container named `application-logs` in a storage account named `stdata2026`, an administrator runs the `azcopy login` command and authenticates using their Microsoft Entra ID credentials. The administrator is a member of a group assigned the Contributor role for the storage account. When attempting to run the copy command, the administrator receives a HTTP 403 error. Which role must be assigned to the administrator to resolve the issue?

  1. A
    Storage Account Contributor
  2. B
    Storage Blob Data Reader
  3. Storage Blob Data ContributorAnswer
  4. D
    A Shared Access Signature (SAS) token with write permissions

Answer

Storage Blob Data Contributor
The correct answer is the Storage Blob Data Contributor role. When shared key access is disabled on a storage account, authorization via access keys or SAS tokens is blocked. The administrator must authenticate using Microsoft Entra ID. The Contributor role only grants control plane management capabilities. To write blobs, the administrator must be assigned a data-plane role such as Storage Blob Data Contributor.

Step-by-Step Solution

1
Analyze the authentication context and constraints.
Shared key access is disabled on the storage account, preventing the use of standard SAS tokens or access keys. Microsoft Entra ID authentication via 'azcopy login' is used.
Security policies enforce identity-based access over shared keys.
2
Evaluate the current role assignment.
The Contributor role only provides Azure Resource Manager control plane permissions.
Control plane roles do not grant data plane access to blob content.
3
Determine the required data plane permissions for writing logs.
The Storage Blob Data Contributor role must be assigned to grant read and write access to the blob container.
This role enables the administrator to execute the AzCopy upload command successfully under the Entra ID security context.

Key Concept

Azure RBAC distinction between control plane (Contributor) and data plane (Storage Blob Data Contributor) roles when shared key access is disabled.
Estimated Time:1m 30s
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic