Examkin

Question

Difficulty: MediumAzure Role-Based Access Control (RBAC) Configuration and Roles

An organization manages its Azure resources using the following hierarchy:
- Management Group: `MG-Finance`
- Subscription: `Sub-Accounting`
- Resource Group: `RG-Audit`
- Storage Account: `saaudittemplates` (configured to use Microsoft Entra ID authorization for data plane access)

A user named Auditor1 is assigned the Reader role at the `Sub-Accounting` subscription level. Auditor1 is also assigned the Contributor role at the `RG-Audit` resource group level.

Auditor1 attempts to upload a spreadsheet to a blob container named `templates` in `saaudittemplates` using their Microsoft Entra ID credentials but receives an authorization error.

Which action should you perform to allow Auditor1 to upload the file to the container while adhering to the principle of least privilege?

  1. A
    Assign the Storage Account Contributor role to Auditor1 at the scope of the `RG-Audit` resource group.
  2. B
    Assign the Global Administrator directory role to Auditor1 in Microsoft Entra ID.
  3. Assign the Storage Blob Data Contributor role to Auditor1 at the scope of the `saaudittemplates` storage account.Answer
  4. D
    Assign the Owner role to Auditor1 at the subscription level, and then create an explicit Deny assignment for Auditor1 at the `RG-Audit` resource group scope.

Answer

Assign the Storage Blob Data Contributor role to Auditor1 at the scope of the `saaudittemplates` storage account.
To perform data operations such as uploading files to a blob container using Microsoft Entra ID authentication, the user requires data-plane permissions. Standard roles like Contributor only grant control-plane permissions. The built-in Storage Blob Data Contributor role provides the required read, write, and delete permissions for blob data. Assigning this role at the scope of the specific storage account ensures the user can upload the spreadsheet while adhering to the principle of least privilege.

Step-by-Step Solution

1
Determine the type of operation being performed.
Uploading a file to a blob container is a data-plane operation.
Azure RBAC separates control-plane (management) operations from data-plane (data access) operations for storage services.
2
Assess the user's existing permissions.
The Reader role at the subscription level and Contributor role at the resource group level only grant control-plane permissions.
Standard control-plane roles like Owner, Contributor, and Reader do not grant implicit data-plane access when Microsoft Entra ID authorization is enforced.
3
Select the correct role and scope matching the principle of least privilege.
Identify Storage Blob Data Contributor as the correct role and apply it at the storage account level.
The Storage Blob Data Contributor role grants the write permissions necessary to upload blobs, and restricting it to the storage account scope avoids over-provisioning access.

Key Concept

Separation of control plane and data plane RBAC roles for Azure Storage resources
Rate this question

Topics

Azure Role-Based Access Control (RBAC) Configuration and Roles

More questions from this topic