Examkin

Soru

Zorluk: KolayConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription containing a resource group named RG-Production. RG-Production contains an Azure Storage account named safiles2026. The storage account hosts a blob container named archives. You need to grant a Microsoft Entra ID group named AuditTeam the ability to read files in the archives container using Microsoft Entra ID authentication. You must follow the principle of least privilege. Which two role assignments can you use to achieve this goal? Each correct answer presents a complete solution.

  1. Storage Blob Data Reader assigned at the scope of the archives containerCevap
  2. Storage Blob Data Reader assigned at the scope of the safiles2026 storage accountCevap
  3. C
    Reader assigned at the scope of the safiles2026 storage account
  4. D
    Security Reader assigned at the Microsoft Entra ID tenant level

Cevap

Assigning the Storage Blob Data Reader role at either the archives container scope or the safiles2026 storage account scope.
To read blob data using Microsoft Entra ID authentication, the group must be assigned a data-plane role such as Storage Blob Data Reader. This role can be assigned at the individual container scope (least privilege) or at the storage account scope, which propagates permissions down to all containers in that storage account by inheritance.

Adım Adım Çözüm

1
Determine the data plane access requirements.
The requirement is to read blobs using Microsoft Entra ID authentication, which requires a role with data plane read permissions.
Control plane roles (like Reader or Contributor) do not grant direct access to blob data plane operations.
2
Identify the appropriate built-in role.
The Storage Blob Data Reader role is the built-in role that allows read access to blob data.
This role is designed specifically for reading blob data via Entra ID auth under the least privilege model.
3
Verify scope application and inheritance.
The role can be assigned at the container level or inherited from the parent storage account level.
Azure RBAC assignments flow down the resource hierarchy (Subscription -> Resource Group -> Storage Account -> Container).

Anahtar Kavram

Azure RBAC separates control plane and data plane permissions for storage accounts. Reading blob data via Entra ID authentication requires specific data plane roles applied at a valid scope.
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru