Examkin

Soru

Zorluk: OrtaManage Data Movement using AzCopy and Storage Explorer

An administrator needs to upload files from an on-premises workstation to an Azure Storage account named stdata2026 using Azure Storage Explorer. The storage account has its firewall configured to restrict access to 'Selected networks'. The administrator's workstation public IP address has been added to the allowed IP ranges of the storage account. The administrator is assigned the Contributor role at the storage account scope. When attempting to upload blobs using Microsoft Entra ID authentication in Storage Explorer, the administrator receives an authorization error.

Which action should the administrator take to resolve this error?

  1. Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.Cevap
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' setting in the firewall configuration.
  3. C
    Create and connect using a Shared Access Signature (SAS) token that has its expiration date set to two years in the future.
  4. D
    Ensure that the administrator is assigned the Reader role at the subscription level.

Cevap

Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.
The administrator is attempting to access the storage account's data plane (uploading blobs) using Microsoft Entra ID authentication. Although they have the Contributor role at the storage account scope, this control-plane role does not grant data-plane read/write permissions for blobs. To resolve the authorization error, they must be assigned a data-plane role such as Storage Blob Data Contributor.

Adım Adım Çözüm

1
Identify the authentication method being used by the client.
The client is using Microsoft Entra ID authentication, which evaluates data-plane operations using Role-Based Access Control (RBAC).
Microsoft Entra ID authentication bypasses traditional storage account keys and relies entirely on Azure RBAC for authorizing read and write operations on container data.
2
Analyze the current role assignment of the administrator.
The administrator has the Contributor role, which is a control-plane role.
Control-plane roles (like Owner and Contributor) allow management of the storage account settings but do not grant data-plane access (reading/writing blobs) by default when using Entra ID authentication.
3
Assign the appropriate data-plane RBAC role.
Assign the Storage Blob Data Contributor role to the user's account.
The Storage Blob Data Contributor role provides read, write, and delete permissions to Azure Storage blob containers and data, which resolves the authorization error.

Anahtar Kavram

Data plane vs. control plane authorization in Azure Storage
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru