You have an Azure subscription that contains the resources shown in the following table. You need to grant permissions to the resources by using attribute-based access control (ABAC). To which…

Question

Options

• AVault1
• BVM1
• CApp1
• DStorage1

• B
  4% (1)
• C
  4% (1)
• D
  92% (24)

Explanation

Azure ABAC is exclusively supported for Azure Storage, making Storage1 (D) the only resource where you can grant permissions using attribute-based access control. ABAC in Azure allows you to add conditions to role assignments based on attributes such as blob index tags, container names, or blob paths, giving you fine-grained access control beyond traditional RBAC.

Why the distractors are wrong:

• Vault1 (A) – Azure Key Vault uses its own access policies and RBAC, but does not support ABAC conditions on role assignments.
• VM1 (B) – Virtual Machines use standard Azure RBAC for access control; ABAC conditions are not applicable to compute resources.
• App1 (C) – App Services (web apps) rely on Azure RBAC and application-level authentication (e.g., App Service Authentication), not ABAC.

Memory Tip: Think of ABAC = "A Blob Access Condition" - Azure ABAC was specifically designed for Storage (Blob/Data Lake) scenarios, where you need granular control based on data attributes like tags and paths. If you see ABAC on an exam, immediately think Azure Storage.

No community discussion yet for this question.