Examkin

Soru

Zorluk: OrtaConfigure Microsoft Entra ID Authentication for Storage

An administrator needs to configure secure data plane access to an Azure Storage Queue named incoming-orders-queue for an application registered as a service principal named OrderProcessorSP. The application must be able to read, peek, and delete messages from the queue during execution, but it must not be able to send new messages or manage the queue structure. Following the principle of least privilege, which Azure role-based access control (RBAC) role should the administrator assign to OrderProcessorSP?

  1. A
    Reader
  2. B
    Storage Queue Data Reader
  3. Storage Queue Data Message ProcessorCevap
  4. D
    Storage Queue Data Contributor

Cevap

Storage Queue Data Message Processor
The correct role is Storage Queue Data Message Processor. This built-in Azure RBAC role allows an identity to read, peek, and delete messages from a queue, which is exactly the set of permissions required for a message processor application. It adheres to the principle of least privilege by not permitting message generation (sending) or queue management operations.

Adım Adım Çözüm

1
Analyze the access requirement
The application needs to read, peek, and delete messages, but not send messages or manage queues.
This establishes the minimum permissions needed to comply with the principle of least privilege.
2
Differentiate control plane and data plane roles
Standard subscription or resource group roles like Reader do not grant data plane access to storage queue content.
Azure Storage separates control plane access (managing resources) from data plane access (accessing the data within the resources).
3
Evaluate storage-specific data plane roles
Storage Queue Data Message Processor grants read/peek/delete message permissions, which matches the processing needs perfectly without additional write or admin rights.
Matching the requirements to the most restrictive built-in role ensures least privilege access.

Anahtar Kavram

Selecting the least-privilege Azure built-in RBAC role for data plane operations in Azure Storage queues.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru