Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription containing a resource group named rg-prod-data. The resource group contains an Azure Storage account named stdataexchange.

You have a Microsoft Entra ID group named Finance-Analysts. A business analyst named Pat is a member of the Finance-Analysts group.

To comply with corporate security standards, access key authentication is disabled on stdataexchange.

You need to configure permissions so that the members of the Finance-Analysts group can perform the following actions:
- Search for and open the stdataexchange storage account in the Azure portal.
- View the networking and firewall settings of stdataexchange.
- Browse and download files from a blob container named incoming-transmissions within the storage account using the Azure portal.

The solution must follow the principle of least privilege.

Which two Azure Role-Based Access Control (RBAC) roles should you assign to the Finance-Analysts group?

  1. ReaderAnswer
  2. Storage Blob Data ReaderAnswer
  3. C
    Storage Account Contributor
  4. D
    Storage Blob Data Contributor
  5. E
    Reader and Data Access

Answer

Reader and Storage Blob Data Reader
To browse and download blobs in the Azure portal under the principle of least privilege, two roles are required. First, the control-plane Reader role must be assigned at the storage account level (or higher) to allow users to search for the storage account, open it in the Azure portal, and view its configuration settings (such as firewalls and networks). Second, the data-plane Storage Blob Data Reader role must be assigned to allow users to read and download the blobs using Microsoft Entra ID authentication, which is necessary since access keys are disabled.

Step-by-Step Solution

1
Determine the role required to navigate the Azure portal and view storage account configuration.
The control-plane Reader role allows group members to search for and view the storage account and its settings in the Azure portal.
Data-plane roles do not provide access to view the resource metadata or configuration settings in the Azure portal; a control-plane role is required.
2
Determine the role required to download files from the blob container using Entra ID authentication.
The Storage Blob Data Reader role grants read-only access to the blob data.
Since access key authentication is disabled, data access must be authenticated using Microsoft Entra ID. The Storage Blob Data Reader role provides the necessary data-plane access while adhering to the principle of least privilege.

Key Concept

Separation of control plane and data plane RBAC roles for Azure Storage authentication.
Estimated Time:1m 30s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic