AZ-104 Question 98
Single answerYour company needs a new container within an existing Azure Storage account to store sensitive logs. The container must not allow public access, but members of the IT Admin group must have permission to manage and upload logs. Which approach should you implement?
- A
Create the container with public read access and add the IT Admin group to the Storage Blob Data Reader role at the container level.
- B
Use the Azure portal or Azure CLI to create the container with public access disabled, then assign the Storage Blob Data Contributor role to the IT Admin group at the container scope.
- C
Create the container with container-level public access and add the IT Admin group to the Storage Blob Data Owner role at the storage account level.
- D
Enable anonymous access for the container and manage permissions for IT admins through shared access signatures.
Show answer and explanation
Correct answer: B
Explanation
To meet the requirement of preventing public access while granting the IT Admin group full manage and upload capabilities, you should create the container with public access disabled. Then, assign the Storage Blob Data Contributor role at the container scope for the IT Admin group, which aligns with best practices in Azure Role-Based Access Control.
- A. Incorrect.
This approach grants only read permissions to the IT Admin group and leaves the container exposed to anonymous read access, which does not satisfy the requirement to prevent public access.
- B. Correct.
Disabling public access ensures the container is secure, and assigning the Storage Blob Data Contributor role gives the IT Admin group permission to manage and upload logs without exposing the container publicly.
- C. Incorrect.
This approach allows anyone to list the container's contents, which violates the requirement to prevent public access.
- D. Incorrect.
Anonymous access would allow users without proper permissions to read data if they obtain the link, which is not acceptable for sensitive logs.