Examkin

Soru

Zorluk: OrtaConfigure Microsoft Entra ID Authentication for Storage

An enterprise manages cloud resources within a resource group named `rg-analytics`. The resource group contains a storage account named `stdatahub`, which hosts a private blob container named `raw-telemetry`. A Microsoft Entra ID security group named `Data-Auditors` is currently assigned the Reader role at the resource group level. A security policy requires that members of `Data-Auditors` must be able to view and download blobs inside the `raw-telemetry` container using their Microsoft Entra ID credentials. You need to implement the principle of least privilege to grant this access. Which action should you perform?

  1. Assign the Storage Blob Data Reader role to the `Data-Auditors` group at the container level.Cevap
  2. B
    Assign the Storage Account Contributor role to the `Data-Auditors` group at the storage account level.
  3. C
    Assign the Directory Readers role in Microsoft Entra ID to the `Data-Auditors` group.
  4. D
    Assign the Reader role to the `Data-Auditors` group at the container level.

Cevap

Assign the Storage Blob Data Reader role to the `Data-Auditors` group at the container level.
Assigning the Storage Blob Data Reader role to the `Data-Auditors` group at the container level is correct because it grants data-plane read permissions for Azure Blob storage. Scoping this assignment to the specific container restricts access only to that container, satisfying the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirement type
The requirement is to view and download blobs using Microsoft Entra ID credentials, which represents data plane access.
Control-plane roles (like Reader or Contributor) do not grant access to the underlying blob data when using Microsoft Entra ID authentication.
2
Determine the minimum privilege role for the data plane
The Storage Blob Data Reader role allows reading and downloading blob contents, which is the exact permission needed.
Other roles like Storage Blob Data Contributor or Storage Blob Data Owner grant write or delete permissions, which violates the principle of least privilege.
3
Identify the target scope for the assignment
The target scope is the container level (`raw-telemetry` container).
Assigning the role at the container level limits access to only the specific container, rather than the entire storage account or resource group.

Anahtar Kavram

Azure Storage data plane access requires dedicated Azure RBAC data roles (e.g., Storage Blob Data Reader) and should be scoped to the minimum level required (least privilege).
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru