AZ-104 Certification Practice Question #102

Question

You have an Azure subscription that contains the resources shown in the following table.

You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.

Which role should you assign?

Accepted Answer

To allow read, write, and delete operations specifically for the data stored in the storage account containers (i.e. blob data actions), the built-in Azure RBAC role Storage Blob Data Contributor is the most appropriate and follows the principle of least privilege. In contrast, management-plane roles like Storage Account Contributor allow configuration changes but do not grant data plane permissions (e.g. read/write/delete blobs) unless using shared keys. Reader and Data Access is not a write/delete role. Thus, Storage Blob Data Contributor (C) is correct.

More AZ-104 practice questions