Examkin

Question

Difficulty: EasyData Storage Security and Access Control

You are designing access control for an Azure Storage account. You need to grant a team of five support engineers read access to a specific blob container. You want to minimize administrative overhead and follow the principle of least privilege.

How should you assign the required permissions?

  1. Assign the Storage Blob Data Reader role to a Microsoft Entra ID group that contains the support engineers.Answer
  2. B
    Assign the Storage Blob Data Reader role directly to the individual user accounts of each support engineer.
  3. C
    Generate a Shared Access Signature (SAS) token with a three-year lifetime and distribute it to the support engineers.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Storage Blob Data Reader role as permanently active for each engineer.

Answer

Assign the Storage Blob Data Reader role to a Microsoft Entra ID group that contains the support engineers.
Assigning RBAC roles to Microsoft Entra ID groups instead of individual users simplifies administration, reduces overhead, and aligns with security best practices for resource access.

Step-by-Step Solution

1
Identify the resource scope and the required level of access (read access to a specific blob container).
Determine that the Storage Blob Data Reader role provides the correct level of read-only access.
Aligns with the principle of least privilege.
2
Select the best practice for identity and access management.
Use a Microsoft Entra ID group to manage permissions collectively rather than assigning roles to individual user accounts.
Minimizes administrative overhead and follows scalable governance guidelines.

Key Concept

Azure RBAC group-based access control for storage accounts
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic