Hotspot Question You have an Azure AD user named User1 and a read-access geo-redundant storage (RA-GRS) account named contoso2023. You need to meet the following requirements: - User1 must be able…

Question

Exhibit

Answer Area

• Search (Ctrl+/)No
• Diagnose and solve problemsNo
• Access Control (IAM)Yes
• Data migrationNo
• EventsNo
• Storage browserNo
• ContainersNo
• File sharesNo
• QueuesNo
• TablesNo
• NetworkingNo
• Azure CDNNo
• Access keysNo
• Shared access signatureNo
• EncryptionNo
• Microsoft Defender for CloudNo
• Geo-replicationYes
• Data protectionNo
• Object replicationNo
• Blob inventoryNo
• Static websiteNo
• Lifecycle managementNo

Explanation

To enable a user to write blob data, configure permissions via Access Control (IAM); to initiate a storage account failover to a secondary endpoint, use the Geo-replication settings.

Approach. The question presents two requirements that need to be met by configuring settings within the 'contoso2023' storage account:

1. User1 must be able to write blob data to contoso2023.

   • To grant an Azure AD user (User1) specific permissions, such as writing blob data, you must use Azure Role-Based Access Control (RBAC). The interface for managing RBAC assignments, roles, and access policies is 'Access Control (IAM)'. Here, you would assign a role like 'Storage Blob Data Contributor' to User1 on the storage account or a container within it.
   • Therefore, selecting 'Access Control (IAM)' is the correct action for this requirement.

2. The contoso2023 account must fail over to its secondary endpoint.

   • The question specifies 'RA-GRS' (Read-Access Geo-Redundant Storage), which implies the storage account is geo-replicated across two Azure regions. The ability to fail over the primary endpoint to the secondary region is a disaster recovery mechanism associated with geo-redundancy. In the Azure portal, the settings related to replication type, redundancy, and initiating a failover (if supported for the replication type, e.g., GRS/RA-GRS) are found under 'Geo-replication' (or sometimes 'Redundancy' or 'Configuration' in newer portal versions, but 'Geo-replication' is explicitly shown and correct here).
   • Therefore, selecting 'Geo-replication' is the correct action for this requirement.

Both highlighted options directly address the stated requirements.

Common mistakes.

• common_mistake. Selecting other options would not fulfill the requirements:

• Containers: This setting manages the individual blob containers within the storage account but does not deal with user permissions at the account level or account-wide failover.
• Networking: Configures network access rules (firewalls, VNETs) for the storage account, not user access permissions or replication settings.
• Access keys / Shared access signature: These provide programmatic access credentials but are not used for granting Azure AD user permissions or initiating an account failover.
• Data protection: This manages soft delete, versioning, and point-in-time restore, which are data resilience features but distinct from user access and account failover.
• Object replication: Replicates specific blobs between two storage accounts, which is different from failing over the entire storage account from its primary region to its secondary region.

Concept tested. Azure Storage Account management, Azure Role-Based Access Control (RBAC) for granting permissions, and Azure Storage redundancy options including geo-redundancy (RA-GRS) and account failover mechanisms.

No community discussion yet for this question.