DP-203 · Question #244
You have an Azure subscription that is linked to a tenant in Microsoft Azure Active Directory (Azure AD), part of Microsoft Entra. The tenant that contains a security group named Group1. The…
The correct answer is A. Storage Blob Data Reader for container1. Assigning Storage Blob Data Reader at the container1 scope grants Group1 exactly the read access needed - no more, no less - satisfying the principle of least privilege. Option B (Storage Table Data Reader) is wrong because Table Storage is a completely different service from…
Question
You have an Azure subscription that is linked to a tenant in Microsoft Azure Active Directory (Azure AD), part of Microsoft Entra. The tenant that contains a security group named Group1. The subscription contains an Azure Data Lake Storage account named myaccount1. The myaccount1 account contains two containers named container1 and container2. You need to grant Group1 read access to container1. The solution must use the principle of least privilege. Which role should you assign to Group1?
Options
- AStorage Blob Data Reader for container1
- BStorage Table Data Reader for container1
- CStorage Blob Data Reader for myaccount1
- DStorage Table Data Reader for myaccount1
How the community answered
(35 responses)- A77% (27)
- B3% (1)
- C6% (2)
- D14% (5)
Explanation
Assigning Storage Blob Data Reader at the container1 scope grants Group1 exactly the read access needed - no more, no less - satisfying the principle of least privilege. Option B (Storage Table Data Reader) is wrong because Table Storage is a completely different service from Blob/Data Lake Storage, so it wouldn't grant any access to a container at all. Option C fails the least-privilege requirement: applying the Blob Data Reader role at the storage account level gives read access to both containers, which exceeds what's needed. Option D combines both mistakes - wrong service (Table) and overly broad scope (account level).
Memory tip: Think "right role, tightest scope" - always match the role to the service (Blob, not Table) and narrow the scope to the smallest resource that satisfies the requirement (container, not account).
Topics
Community Discussion
No community discussion yet for this question.