AZ-500 Question 148
Single answerYou manage an Azure Storage account hosting multiple containers for different departments. The AI research team requires read-only access to a container named 'mlmodels' while preventing them from viewing or modifying other containers. You want to adhere to the principle of least privilege using Azure role-based access control (RBAC). Which approach should you implement?
- A
Assign the Storage Blob Data Contributor role at the storage account scope.
- B
Assign the Storage Blob Data Reader role at the container level for 'mlmodels'.
- C
Enable public read access (anonymous access) on the 'mlmodels' container.
- D
Generate a user delegation SAS for the entire storage account and share it with the AI research team.
Show answer and explanation
Correct answer: B
Explanation
To satisfy the principle of least privilege, it is best to assign the Storage Blob Data Reader role solely at the scope of the required container, in this case, 'mlmodels'. This ensures that the AI research team can only read data from that container and does not have unnecessary or broader permissions. For further details, see Microsoft's documentation on assigning Azure roles for data access: https://learn.microsoft.com/azure/storage/blobs/authorize-data-operations.
- A. Incorrect.
Incorrect: Storage Blob Data Contributor at the account scope grants both read and write permissions for all containers. This violates the principle of least privilege by providing more access than necessary.
- B. Correct.
Correct: Assigning the Storage Blob Data Reader role specifically at the container level for 'mlmodels' enforces read-only access to that container alone, aligning with least privilege.
- C. Incorrect.
Incorrect: Enabling public read access makes the container accessible without any authentication. This approach undermines security and is not recommended for sensitive data scenarios.
- D. Incorrect.
Incorrect: Generating a user delegation SAS for the entire storage account allows the AI team to potentially access other containers, exceeding the intended read-only scope for just 'mlmodels'.