nerdexam
Microsoft

SC-300 · Question #425

Hotspot Question You have an Azure subscription named Sub1 that contains two storage accounts named storage1 and storage2 and the blob containers shown in the following table. Sub1 contains the…

The correct answer is User1 can read the contents of blob3. = No; User1 can read the contents of blob2. = Yes; User2 can read the contents of blob1. = Yes. User1 has a role assignment with Condition1 applied, which typically restricts blob access based on specific conditions (such as blob index tags or container names). User1 can read blob3 (Yes) because blob3 meets the condition criteria, but cannot read blob2 (No) because blob2…

Submitted by wei.xz· Mar 6, 2026Manage identities and governance in Azure - specifically configuring role-based access control (RBAC) with attribute-based conditions (ABAC) for Azure Storage, covering how conditional expressions on role assignments restrict or permit access to blob resources based on resource attributes or blob index tags.

Question

Hotspot Question You have an Azure subscription named Sub1 that contains two storage accounts named storage1 and storage2 and the blob containers shown in the following table. Sub1 contains the users shown in the following table. Condition1 has the following definition: NOTE: Each correct selection is worth one point. Answer:

Exhibits

SC-300 question #425 exhibit 1
SC-300 question #425 exhibit 2
SC-300 question #425 exhibit 3

Answer Area

  • User1 can read the contents of blob3.No
  • User1 can read the contents of blob2.Yes
  • User2 can read the contents of blob1.Yes

Explanation

User1 has a role assignment with Condition1 applied, which typically restricts blob access based on specific conditions (such as blob index tags or container names). User1 can read blob3 (Yes) because blob3 meets the condition criteria, but cannot read blob2 (No) because blob2 does not satisfy the condition. User2 can read blob1 (Yes) because User2 has an unconditional role assignment (such as Storage Blob Data Reader) on storage1 or its container, granting full read access without attribute-based restrictions.

Topics

#Azure RBAC#Attribute-Based Access Control (ABAC)#Azure Blob Storage#Conditional Role Assignments

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice