Examkin

Soru

Zorluk: KolayAzure Role-Based Access Control (RBAC) Configuration and Roles

Your organization manages its Azure resources using a hierarchy that contains the Enterprise-MG management group, the Finance-Sub subscription, the Logs-RG resource group, and a storage account named financelogs2026.

An auditor named Jordan needs to view blob data stored in the containers of the financelogs2026 storage account to verify compliance. Jordan must not be able to modify the storage account configuration or view data in other storage accounts within the subscription.

Which role assignment meets this requirement while adhering to the principle of least privilege?

  1. Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage accountCevap
  2. B
    Assign the Reader role at the scope of the Logs-RG resource group
  3. C
    Assign the Storage Blob Data Reader role at the scope of the Finance-Sub subscription
  4. D
    Assign the Global Reader directory role in Microsoft Entra ID

Cevap

Assign the Storage Blob Data Reader role at the scope of the financelogs2026 storage account
Assigning the Storage Blob Data Reader role at the scope of the financelogs2026 storage account satisfies the requirement. It provides data-plane access to read container blobs for the specific storage account, while restricting the user from making modifications or accessing other storage accounts, thus adhering to the principle of least privilege.

Adım Adım Çözüm

1
Identify the type of access required.
The requirement is to read blob data (data plane), not just manage the storage resource (control plane).
This determines whether a standard control-plane role (like Reader) or a data-plane role (like Storage Blob Data Reader) is needed.
2
Apply the principle of least privilege by targeting the correct scope.
The user only needs access to the financelogs2026 storage account, not the entire resource group or subscription.
Assigning the role at the storage account level prevents access to other storage accounts in the resource group or subscription.
3
Select the correct role type.
The Storage Blob Data Reader role grants the required data-plane read permissions, whereas Microsoft Entra ID roles do not apply to subscription resources.
This satisfies the technical requirement while keeping access restricted to the minimum permissions needed.

Anahtar Kavram

Azure RBAC roles separate control-plane and data-plane access, and should be assigned at the narrowest scope possible to enforce least privilege.
Bu soruyu puanla

Konular

Azure Role-Based Access Control (RBAC) Configuration and Roles

Bu konudan daha fazla soru