Exam AZ-500 topic 2 question 105 discussion

Actual exam question from Microsoft's AZ-500

Question #: 105
Topic #: 2

HOTSPOT
-

You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.

User1 is assigned the following roles for storage1:

• Storage Blob Data Reader
• Storage Table Data Contributor
• Storage File Data SMB Share Reader

In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Show Suggested Answer

Suggested Answer:

by Hara at June 23, 2023, 7:20 p.m.

Comments

Submit Cancel

sigvast

Highly Voted 1 year, 5 months ago

RBAC roles only apply when connecting with AD credentials : 1. Y beacause SAS gives him File Delete permission 2. N because he has only SMB File Reader, he can't delete 3. N because SAS only gives File permission, not Table

upvoted 30 times

...

BigShot0

Highly Voted 1 year, 2 months ago

Y - The SAS permissions apply N - The RBAC permissions apply and only has Reader N - SAS only has File permission - not Table permission

upvoted 9 times

...

heatfan900

Most Recent 1 year, 3 months ago

Y, N, N SAS TOKENS ARE A SET OF SECURITY SPECIFICIATIONS AND PERMISSIONS WRAPPED INTO A TOKEN. THE SETTINGS AT THE VERY TOP DO NOT AFFECT THEM. User1 has access to delete the files in the FILE SHARE folder1 via the SAS TOKEN. User1 does not have access to do this, based on the very first permissions outlined separate from the token, I will not be allowed to delete. User1 cannot delete the rows in table1 of the TABLE SERVICE via the SAS TOKEN because the token does not include any permissions to work with the Storage Type Service.

upvoted 5 times

...

MoMoMoMo1

1 year, 3 months ago

1. Yes: User has Delete Permissions from SAS key. 2. No: RBAC does not apply to SMB NTFS shares, RBAC will be for connection and then NTFS for File permissions. Azure Files supports identity-based authentication over SMB through the following methods. a. On-premises AD DS authentication: b. Azure AD DS authentication: c. Azure AD Kerberos for hybrid identities: e. AD Kerberos authentication for Linux clients: 3. No: SAS only has File share selected.

upvoted 2 times

...