AZ-500 Question 149
Single answerYou manage an Azure Storage account named 'SecureDataStore' containing a private container called 'FinancialReports.' A security requirement states that a specific group of users must be able to list and download blobs from the container without having any permissions to upload, modify, or delete existing data. Which built-in Azure role assignment on this storage account should you configure to meet these requirements?
- A
Reader
- B
Storage Account Contributor
- C
Storage Blob Data Reader
- D
Storage Blob Data Contributor
Show answer and explanation
Correct answer: C
Explanation
To ensure limited access to browse and download from a specific container without modification privileges, the built-in 'Storage Blob Data Reader' role is the best choice. It grants read access to blob content without allowing create, write, or delete operations. Refer to Microsoft Azure documentation (https://learn.microsoft.com/azure/role-based-access-control/built-in-roles#storage-blob-data-reader) for additional details on built-in Azure roles for storage account data access.
- A. Incorrect.
Option A: Reader. This role allows read access to Azure resource configurations (like the storage account’s properties), but it does not provide access to the data within the containers. Hence, it does not fulfill the requirement to actually list and download blobs.
- B. Incorrect.
Option B: Storage Account Contributor. This role grants full management access to the storage account (excluding role assignments), including creating and deleting containers, which exceeds the minimal data reading need. Thus, it offers more permissions than required.
- C. Correct.
Option C: Storage Blob Data Reader. This built-in role allows reading and listing blobs in storage containers without write or delete permissions. This exactly meets the requirement of listing and downloading files without the ability to upload, modify, or delete data.
- D. Incorrect.
Option D: Storage Blob Data Contributor. This role provides both read and write permissions, enabling upload and delete operations. It goes beyond what is required for read-only access.