Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Azure Administrator Associate · Microsoft
Step Sequence / Reordering Question
Add and arrange the steps in the correct execution order.
Hotspot Solution:
Storage Account Contributor does not follow the principle of least privilege. Storage Account Contributor would allow a user that is requested to ONLY have the ability to READ/VIEW the data in the storage account, to do many other things such as Write/List/Delete/Move the data in the storage accounts. They only need to be able to view/read. Therefore, Reader, and Data Access follow this principle. RBAC roles for Storage Accounts: Role: Read and Data Access - Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys. Please see reference documentation from MS Learn on Read and Data Access role:
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
User1: Assign the Reader and Data Access role. This role allows User1 to view all resources, including data in storage accounts, without granting permissions to modify or delete the data. User2: Assign the Owner role. This role allows User2 to manage all resources, including assigning roles to other users, which covers the requirement to assign the Contributor role for storage accounts. This ensures that User1 can view data in storage accounts and User2 can assign roles to other users, adhering to the principle of least privilege.
There is no role called read and data access. So it's contributor and Storage account contributor