SC-300 Certification Practice Question #140

Question

You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4.

You plan to assign the users the following roles for RG1:

•	User1: Reader
•	User2: Contributor
•	User3: Storage Blob Data Reader
•	User4: Virtual Machine Contributor

You are evaluating the use of attribute-based access control (ABAC).

Which user's role will support the use of ABAC?

Accepted Answer

Azure ABAC adds role-assignment conditions only to roles that contain Azure Blob Storage or Queue Storage data actions (DataActions). Of the four assigned roles, only Storage Blob Data Reader (User3) is on the supported list per MS Learn; Reader, Contributor, and Virtual Machine Contributor are management-plane roles without blob/queue data actions, so the portal's Conditions tab is unavailable for them. The official Suggested Answer, the 9-vote community Most Voted, and multiple high-vote comments (penatuna, klayytech, RemmyT) all converge on C, fully aligned with the documentation.

More SC-300 practice questions