AZ-104 Question 55
Single answerYour organization hosts a sensitive data container in an Azure Storage account. You’ve been asked to configure access so that only members of a specific Azure AD security group can read from the container, while also enforcing multi-factor authentication (MFA). Public or anonymous access must be fully blocked. Which configuration approach should you implement?
- A
Use a service principal and Shared Access Signature (SAS) tokens controlled by stored access policies
- B
Assign the required Azure RBAC role to the Azure AD security group and configure a Conditional Access policy for MFA
- C
Distribute the main storage account key to members of the security group for read-only operations
- D
Enable the storage account firewall to only allow traffic from the corporate IP address range
Show answer and explanation
Correct answer: B
Explanation
To meet the requirement of allowing access only to a specified Azure AD group and enforcing MFA, you must use Azure RBAC for granular permission assignment along with Conditional Access for MFA. This approach ensures that the data container is accessible only to authenticated and authorized users who must also pass an MFA challenge.
- A. Incorrect.
Using SAS tokens can control access duration and permissions but does not directly integrate with Azure AD security groups and MFA enforcement.
- B. Correct.
Assigning an Azure RBAC role to the security group and enforcing MFA with Conditional Access ensures only authorized group members can access the container and must use MFA.
- C. Incorrect.
Distributing the account key would give users broad access without user-level traceability or the ability to enforce MFA.
- D. Incorrect.
Restricting by IP alone provides perimeter-level security but does not enforce user-specific authentication or MFA for container access.