Exam AZ-104 topic 2 question 88 discussion

Storage Blob Data Contributor Read, write, and delete Azure Storage containers and blobs. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor

A : No has permissons to delete and is a general role ( ) B : Too general C : Apply requirement , Read , write and delete (https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor ) D : Impossible to delete

C is correct

C because Focus on the keyword *container* Storage Account Contributor: This role grants full management permissions to a storage account, including creating, updating, and deleting data, containers, and storage account settings. This is too broad for the scenario since the requirement is specific to container-level data operations. Contributor : Similar to A, it offers permissions beyond just the data-level operations. Storage Blob Data Contributor: This role allows read, write, and delete operations specifically for data in blob containers, without granting full management access to the storage account itself. Reader and Data Access: (The reason is obvious) This role grants read-only access to resources and data.

Storage Blob Data Contributor

C is correct

Question refers to data IN a container, so by proxy that means Storage BLOB Data Contributor is the best answer.

C:For the requirement to allow Workspace1 to perform read, write, and delete operations on the data within storage1, the Storage Blob Data Contributor role is the correct choice.

For ChatGPT: To allow read, write, and delete operations for the data stored in the containers of storage1 for Workspace1, you should assign the role: C. Storage Blob Data Contributor This role provides the necessary permissions for full access to the blobs, including read, write, and delete operations within Azure Storage Blob containers. Here’s a brief overview of why the other roles are not suitable: A. Storage Account Contributor: This role provides management access to the storage account, which includes operations such as creating and managing storage accounts and setting access policies, but it doesn't necessarily grant access to the data within the blobs. B. Contributor: This role has a wide scope and provides full access to manage all Azure resources but does not grant specific data access permissions for storage blobs. D. Reader and Data Access: This role allows read access to the storage account's data but does not include write or delete permissions. Therefore, the most appropriate role for the scenario is Storage Blob Data Contributor.

Storage Account Contributor : Permits management of storage accounts. Provides access to the account key, which can be used to access data via Shared Key authorization. Storage Blob Data Contributor : Read, write, and delete Azure Storage containers and blobs. To learn which actions are required for a given data operation https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor

Given that the requirement is to allow read, write, and delete operations for data stored in the containers of storage1, the correct role to assign is: C. Storage Blob Data Contributor This role specifically targets the data within the blob containers, providing the necessary permissions for read, write, and delete operations without extending unnecessary broader access to other aspects of the Azure environment.

Storage Blob Data Contributor https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor

I think the key of the answer is in the question "read, write and delete operations FOR THE DATA stored in the containers ...." So the mentioned operations are about the data.. and the Storage Account Contributor doesnt have permissions on the data, its permissions are about properties and metadata and not the data itself. So the answer is C https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-contributor https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-blob-data-contributor

C is correct

The required data actions / operations: for the data stored in the containers of storage1. (not the whole storage account) so, Storage Blob Data Contributor meet the goal

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor The "contributor" in option B is not specific too general . "Reader and Data Access" in option D is not a role. option A: Storage Account Contributor can't perform delete operation. option C: Storage Blob Data Contributor role can also perform data action in storage account.

Correct answer is C due to delete-operation