Managed Identities · AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security
A user-assigned managed identity must read blobs from a storage account. The identity's principal ID is <principal-id>, and the storage account resou…
Practice question from Managed Identities (AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security), with the correct answer and a step-by-step solution.
medium · MCQ · Q-504F33
A user-assigned managed identity must read blobs from a storage account. The identity's principal ID is <principal-id>, and the storage account resource ID is <storage-resource-id>. Which Azure CLI command grants the least-privilege data-plane permission?
- A.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal --role "Storage Blob Data Reader" --scope <storage-resource-id>Correct answer
- B.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type User --role "Reader" --scope <storage-resource-id>
- C.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal --role "Storage Blob Data Owner" --scope <storage-resource-id>
- D.az role assignment create --assignee <principal-id> --role "Contributor" --scope <storage-resource-id>
Solution
Storage Blob Data Reader grants read access to blob data and is appropriate for a read-only workload. The managed identity is represented by a service principal, and using the principal ID avoids ambiguity. The Reader role manages Azure resources but does not grant blob-data access.
More from Managed Identities
- An Azure Function must read secrets from an Azure Key Vault without storing credentials in application settings. The Key Vault uses Azure r…
- A company deploys several App Services and virtual machines that must access the same Azure Storage account. The identity must remain avail…
- An App Service has both a system-assigned managed identity and a user-assigned managed identity attached. The application must use the user…
- An Azure App Service uses a system-assigned managed identity to access an Azure Storage account. What happens to that identity when the App…
Practise more Implement Azure Security
Sign up free for adaptive practice on this chapter, with instant feedback and hints on every question.
Start practising freeFree to start · No credit card needed