Examkin

Question

Difficulty: EasyAzure Role-Based Access Control (RBAC) Configuration and Roles

Consider the following Azure resource hierarchy:
- Tenant Root Group (Management Group)
- Corp-MG (Management Group)
- Subscription1 (Subscription)
- RG-Storage (Resource Group)

You are configuring access for a Microsoft Entra ID security group named Storage-Ops. The members of this group must be able to manage storage accounts inside RG-Storage, including the ability to rotate storage keys. Additionally, they must be able to view and download blobs in the containers. You need to assign the appropriate Azure RBAC roles at the RG-Storage level while following the principle of least privilege.

Which two roles should you assign? (Select two.)

  1. Storage Account ContributorAnswer
  2. Storage Blob Data ReaderAnswer
  3. C
    Contributor
  4. D
    Reader
  5. E
    User Administrator

Answer

Storage Account Contributor and Storage Blob Data Reader
To satisfy the requirements using the principle of least privilege, separate roles are needed for control plane management and data plane operations. The Storage Account Contributor role allows configuration management and access key rotation of storage accounts. The Storage Blob Data Reader role provides the necessary read-only permissions for blob data containers. Assigning both roles at the resource group scope ensures proper inheritance.

Step-by-Step Solution

1
Analyze control plane requirements.
The Storage-Ops group needs to manage storage accounts and rotate access keys. The Storage Account Contributor built-in role is the most restrictive role that allows these management actions.
This satisfies the control plane management requirement under the principle of least privilege.
2
Analyze data plane requirements.
The Storage-Ops group needs to view and download blobs. The Storage Blob Data Reader built-in role provides read-only access to blob containers and data.
This satisfies the data plane access requirement under the principle of least privilege.
3
Determine the scope of the assignments.
Both roles must be assigned at the RG-Storage resource group level.
Assigning the roles at the resource group level ensures the permissions inherit down to all storage accounts and blob containers within that resource group.

Key Concept

Azure RBAC Control Plane and Data Plane Separation for Storage Accounts
Estimated Time:1m 30s
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic