DP-420 · Question #26
You have a container named container1 in an Azure Cosmos DB for NoSQL account. You need to provide a user named User1 with the ability to insert items into container1 by using role- based access…
The correct answer is D. Cosmos DB Built-in Data Contributor only. The correct answer is D: Cosmos DB Built-in Data Contributor only. This built-in role grants full data-plane access (read, write, delete items and execute queries) without any management-plane permissions. For inserting items into a container, this role is exactly sufficient…
Question
You have a container named container1 in an Azure Cosmos DB for NoSQL account. You need to provide a user named User1 with the ability to insert items into container1 by using role- based access control (RBAC). The solution must use the principle of least privilege. Which roles should you assign to User1?
Options
- ACosmosDB Operator only
- BDocumentDB Account Contributor and Cosmos DB Built-in Data Contributor
- CDocumentDB Account Contributor only
- DCosmos DB Built-in Data Contributor only
How the community answered
(52 responses)- A15% (8)
- B8% (4)
- C4% (2)
- D73% (38)
Explanation
The correct answer is D: Cosmos DB Built-in Data Contributor only. This built-in role grants full data-plane access (read, write, delete items and execute queries) without any management-plane permissions. For inserting items into a container, this role is exactly sufficient and follows the principle of least privilege. 'CosmosDB Operator' (A) grants management-plane access (scaling, configuration) but NO data-plane access - it cannot read or write items. 'DocumentDB Account Contributor' (C) also grants management-plane permissions to manage the account, which is excessive. Option B combines two roles unnecessarily; DocumentDB Account Contributor adds unneeded management rights beyond what data insertion requires.
Topics
Community Discussion
No community discussion yet for this question.