Exam AZ-304 topic 2 question 3 discussion

Actual exam question from Microsoft's AZ-304

Question #: 3
Topic #: 2

You have an Azure Active Directory (Azure AD) tenant.
You plan to provide users with access to shared files by using Azure Storage. The users will be provided with different levels of access to various Azure file shares based on their user account or their group membership.
You need to recommend which additional Azure services must be used to support the planned deployment.
What should you include in the recommendation?

A. an Azure AD enterprise application
B. Azure Information Protection
C. an Azure AD Domain Services (Azure AD DS) instance
D. an Azure Front Door instance

Show Suggested Answer

Suggested Answer: C 🗳️
Azure Filesג€‰supports identity-based authentication over Server Message Block (SMB) throughג€‰two types of Domain Services: on-premises Active Directory Domain
Services (AD DS) and Azure Active Directory Domain Services (Azure AD DS).
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable

by nlr at Oct. 1, 2020, 6:31 p.m.

Comments

Submit Cancel

nlr

Highly Voted 4 years, 8 months ago

Given answer is correct

upvoted 49 times

sanketshah

4 years, 5 months ago

given answer is correct.

upvoted 3 times

...

leo_az300

Highly Voted 3 years, 8 months ago

Answer is correct, There are 2 levels of permissions to assign to users, one is on file-share level, and another is on directory level Configure share-level permissions for Azure Files Once either Azure AD DS or on-premises AD DS authentication is enabled, you can use Azure built-in roles or configure custom roles for Azure AD identities and assign access rights to any file shares in your storage accounts. The assigned permission allows the granted identity to get access to the share only, nothing else, not even the root directory. You still need to separately configure directory or file-level permissions for Azure file shares. Configure directory or file-level permissions for Azure Files Azure file shares enforce standard Windows file permissions at both the directory and file level, including the root directory. Configuration of directory or file-level permissions is supported over both SMB and REST. Mount the target file share from your VM and configure permissions using Windows File Explorer, Windows icacls, or the Set-ACL command.

upvoted 19 times

4 years, 4 months ago

C. an Azure AD Domain Services (Azure AD DS) instance

upvoted 4 times

...

Jinder

4 years, 4 months ago

Can someone please explain where you get a clue to use Azure AD DS. Question statement never talked about hybrid/on-prem users and groups. Thanks

upvoted 3 times

fred00r

4 years, 4 months ago

I think the key here is: "Azure Files supports identity-based authentication over Server Message Block (SMB) through two types of Domain Services: on-premises Active Directory Domain Services (AD DS) and Azure Active Directory Domain Services (Azure AD DS)" - https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable?tabs=azure-portal So AZ DS is set.

upvoted 9 times

Jinder

4 years, 4 months ago

Thanks. That makes sense.

upvoted 5 times

...

Load full discussion...