Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Azure Administrator Associate · Microsoft
Hot Area / Sentence Completion
Select the appropriate option to complete the statement. Click Check Answer below to see the marked solution.
Hotspot Solution:
User1 has Reader role and Condition1 applied at the subscription level. RBAC roles are additive. In other words, it is the union of all the roles. This means that even if we have restricted to only cont1 in the Storage Blob Data Reader Role, User1 still has the original Reader role provided. The read access to cont2 and cont3 are not restricted at the Reader role and per the additive rule, this role is not negated. Thus, User1 can read all containers and their blobs per the Reader role at the sub1. So User1 can read both blob2 in cont2 and blob3 in cont3. User2 has the Reader role at the sub1 scope and the Storage Blob Data Owner with condition at the storage1 scope. Once again, both roles are additive. So, User2 can read all containers, and now additional, can write to storage1 containers so long as the blob path is like "2"
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
NNY Watch out >>> ! The key is in the ! exclamation mark - which is a logical NOT operator "ActionMatches.../read" is true if the permissions is read "!ActionMatches.../read" will be true if the permission is ANYTHING BUT read. So in User1's case - its false
Answer is YYY:
User1 has Reader role and Condition1 applied at the subscription level. RBAC roles are additive. In other words, it is the union of all the roles. This means that even if we have restricted to only cont1 in the Storage Blob Data Reader Role, User1 still has the original Reader role provided. The read access to cont2 and cont3 are not restricted at the Reader role and per the additive rule, this role is not negated. Thus, User1 can read all containers and their blobs per the Reader role at the sub1. So User1 can read both blob2 in cont2 and blob3 in cont3. User2 has the Reader role at the sub1 scope and the Storage Blob Data Owner with condition at the storage1 scope. Once again, both roles are additive. So, User2 can read all containers, and now additional, can write to storage1 containers so long as the blob path is like "*2*"