You have an Azure Storage account named storage1 that has a container named container1. You need to prevent the blobs in container1 from being modified. What should you do?

Question

Options

• AFrom container1, change the access level.
• BFrom container1, add an access policy.
• CFrom container1, modify the Access Control (IAM) settings.
• DFrom storage1, enable soft delete for blobs.

• B
  91% (31)
• C
  6% (2)
• D
  3% (1)

Explanation

Explanation

Adding an access policy (specifically an immutability policy or a Stored Access Policy with read-only permissions) to container1 directly controls what operations are permitted on the blobs within it, effectively preventing modifications while still allowing reads. This is the appropriate mechanism for locking down blob content at the container level through policy enforcement.

Why the other options are wrong:

• Option A – Changing the access level only controls public anonymous access (private, blob, or container), not whether authenticated users can modify blobs.
• Option C – Modifying IAM settings manages role-based access control at a broader scope, and while it could restrict users, it is not the targeted, container-level policy mechanism designed for this purpose - and it doesn't address immutability.
• Option D – Enabling soft delete doesn't prevent modification; it only allows you to recover blobs after accidental deletion or overwrite - a reactive measure, not a preventive one.

Memory Tip: Think of an "access policy" as a rulebook specifically written for the container - it defines exactly what's allowed or forbidden inside that container. If you want to lock the rules, write a policy. Soft delete is your "undo button," IAM is your "who's allowed in the building," and access level is just "who can see through the window."

No community discussion yet for this question.