AZ-104 Certification Practice Question #147

Question

You have an Azure Storage account named contoso2024 that contains the resources shown in the following table.

You have users that have permissions for contoso2024 as shown in the following table.

The contoso2024 account is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Accepted Answer

- **User1 (Reader):** The Reader role only provides management plane read access (metadata). It does not provide data-plane access to Blobs. Since public access is only "allowed" at the storage account level but not configured on the container/blob level, public access is not enabled.
- **User2 (Storage Account Contributor):** While this role can manage the storage account and list keys, it does not have built-in data plane access actions (DataActions). Normally, users with this role can read files because the Azure portal falls back to using access keys. However, since **Allow storage account key access** is **Disabled**, Shared Key authentication is rejected, preventing User2 from accessing File2.
- **User3 (Access Keys):** Because **Allow storage account key access** is **Disabled**, all Shared Key authentication attempts are blocked. Thus, User3 cannot read either file.

More AZ-104 practice questions