Examkin

Soru

Zorluk: ZorConfigure Microsoft Entra ID Authentication for Storage

Your company has an Azure subscription containing a resource group named rg-finance. Within rg-finance, you have a storage account named storefinprod that contains a blob container named confidential-reports. A user named User1 must be able to read and download the blobs within the confidential-reports container using the Azure portal. The user must authenticate by using their Microsoft Entra ID credentials. Your configuration must follow the principle of least privilege. Which configuration should you implement to meet these requirements?

  1. Assign User1 the Reader role at the storefinprod storage account level, and assign the Storage Blob Data Reader role at the confidential-reports container level.Cevap
  2. B
    Assign User1 the Storage Account Contributor role at the storefinprod storage account level.
  3. C
    Assign User1 the Directory Reader role in Microsoft Entra ID, and assign the Storage Blob Data Reader role at the confidential-reports container level.
  4. D
    Assign User1 the Storage Blob Data Reader role at the confidential-reports container level only.

Cevap

Assign User1 the Reader role at the storefinprod storage account level, and assign the Storage Blob Data Reader role at the confidential-reports container level.
The correct configuration requires both control plane and data plane roles. The Reader role (control plane) at the storage account level allows the user to find and list the storage account in the Azure portal. The Storage Blob Data Reader role (data plane) at the container level allows the user to read the blobs in the container while following the principle of least privilege by restricting data access to only that container.

Adım Adım Çözüm

1
Identify the access requirements
The user needs both portal navigation access (control plane) and blob read access (data plane) using Microsoft Entra ID credentials.
Azure portal navigation requires Resource Manager permissions, whereas blob container access requires data plane permissions.
2
Select the least privilege control plane role
Assign the Reader role at the storage account level.
This allows the user to see the storage account in the portal directory and list its properties, without granting write or administrative privileges.
3
Select the least privilege data plane role
Assign the Storage Blob Data Reader role at the container level.
This provides read access to the blobs inside the target container while restricting data access to only that container, following the least privilege principle.

Anahtar Kavram

To access blob container data using Microsoft Entra credentials in the Azure portal, a user requires a control-plane role (such as Reader) at the storage account level to navigate the portal, and a data-plane role (such as Storage Blob Data Reader) at the appropriate resource scope to read the blobs.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru