Examkin

Question

Difficulty: MediumConfigure Microsoft Entra ID Authentication for Storage

An organization has an Azure subscription containing a resource group named rg-resources. The resource group contains a storage account named stcontentprod, which has a blob container named assets. A user named Alex needs to view and download blobs in the assets container using the Azure portal. Alex is already assigned the Reader role for the rg-resources resource group. When Alex attempts to view the blobs in the container, the Azure portal displays an authorization error. You need to resolve the access issue while following the principle of least privilege. Which action should you perform?

  1. A
    Assign the Storage Account Contributor role to Alex scoped to the stcontentprod storage account
  2. B
    Assign the Reader role to Alex scoped to the assets container
  3. Assign the Storage Blob Data Reader role to Alex scoped to the assets containerAnswer
  4. D
    Assign the Storage Blob Data Contributor role to Alex scoped to the stcontentprod storage account

Answer

Assign the Storage Blob Data Reader role to Alex scoped to the assets container
Assigning the Storage Blob Data Reader role to the user scoped to the container is the correct approach. The Reader role at the resource group level grants the necessary control plane permissions to navigate to the storage account in the Azure portal. However, data plane access to read blobs requires a specific data plane role, such as Storage Blob Data Reader. Scoping this role to the specific container instead of the entire storage account enforces the principle of least privilege.

Step-by-Step Solution

1
Analyze the user's current control plane permissions.
The user is already assigned the Reader role at the resource group level, which is inherited by the storage account and allows portal navigation.
To browse resources in the Azure portal, a user needs control plane read access.
2
Determine the required data plane permissions.
To view and download blobs using Microsoft Entra ID authentication, the user requires data plane read access.
Control plane roles like Reader or Contributor do not grant data plane access to blob contents.
3
Identify the role and scope that satisfies the principle of least privilege.
The Storage Blob Data Reader role provides read-only data access. Scoping it to the specific container rather than the storage account limits access to only the required resources.
Assigning permissions at the narrowest scope possible minimizes security risks.

Key Concept

Azure RBAC separation of control plane and data plane for Microsoft Entra ID authentication
Estimated Time:1m 30s
Rate this question

Topics

Configure Microsoft Entra ID Authentication for Storage

More questions from this topic