Examkin

Soru

Zorluk: OrtaConfigure Microsoft Entra ID Authentication for Storage

A company manages document storage in an Azure Storage account named stcorplegal. You need to allow members of a Microsoft Entra ID group named LegalAuditors to view and download blobs in a container named case-files. The auditors will navigate to the container using the Azure portal. The solution must follow the principle of least privilege.

Which two role assignments should you configure?

  1. Reader at the storage account scopeCevap
  2. Storage Blob Data Reader at the container scopeCevap
  3. C
    Storage Account Contributor at the storage account scope
  4. D
    Storage Blob Data Reader at the subscription scope

Cevap

Assign the Reader role at the storage account scope and the Storage Blob Data Reader role at the container scope.
To view and download blobs in a specific container using the Azure portal under the principle of least privilege, two permissions are required: first, the Reader role at the storage account scope to enable resource navigation in the portal; and second, the Storage Blob Data Reader role at the container scope to provide read access only to the necessary container.

Adım Adım Çözüm

1
Determine the portal navigation requirement
To access the storage container via the Azure portal, users must be able to navigate to the storage account resource itself. The Reader role at the storage account scope grants this control plane permission without exposing data.
Azure portal navigation requires control plane visibility at the resource level.
2
Determine the data access requirement
To view and download blobs, users need data plane permissions. The Storage Blob Data Reader role grants read and list capabilities.
Microsoft Entra ID authentication distinguishes between management operations and data operations.
3
Apply the least privilege principle to scope selection
Assigning Storage Blob Data Reader at the container scope limits the data access strictly to the target container, rather than the entire storage account or subscription.
Minimizing the scope of permissions prevents unauthorized access to other containers.

Anahtar Kavram

Configuring access to Azure Storage using Microsoft Entra ID requires separate control plane permissions (for portal navigation) and data plane permissions (for actual data access) scoped to the minimum level necessary.
Bu soruyu puanla

Konular

Configure Microsoft Entra ID Authentication for Storage

Bu konudan daha fazla soru