For example, if you assign the Storage Blob Data Contributor role to user Mary at the level of a container named sample-container, then Mary is granted read, write, and delete access to all of the blobs in that container. However, if Mary wants to view a blob in the Azure portal, then the Storage Blob Data Contributor role by itself will not provide sufficient permissions to navigate through the portal to the blob in order to view it. The additional permissions are required to navigate through the portal and view the other resources that are visible there.

Storage Blob Data Contributor --> Read, write, and delete Azure Storage containers and blobs Reader --> View all resources, but does not allow you to make any changes Any permission has been granted at storage account level or file shares directly, so reading access to files share is not possible

Storage Blob Data Contributor role alone cannot access Azure portal. Hence we need the combination of Reader and Storage Blob Data Contributor role.

Not correct. This is the definition of the built-in Reader role (see https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader): { "assignableScopes": [ "/" ], "description": "View all resources, but does not allow you to make any changes.", "id": "/providers/Microsoft.Authorization/roleDefinitions/acdd72a7-3385-48ef-bd42-f606fba81ae7", "name": "acdd72a7-3385-48ef-bd42-f606fba81ae7", "permissions": [ { "actions": [ "*/read" ], "notActions": [], "dataActions": [], "notDataActions": [] } ], "roleName": "Reader", "roleType": "BuiltInRole", "type": "Microsoft.Authorization/roleDefinitions" } As zou can see, a Reader only has */read permissions in "Actions", which pertain to metadata about the file share. To read the actual data, the role would need */read permissions in DataActions - which the built-in Reader role doesn't have.

The Reader role is an Azure Resource Manager role that permits users to view storage account resources, but not modify them. "It does not provide read permissions to data in Azure Storage, but only to account management resources". https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access#:~:text=The%20Reader%20role%20is%20an,only%20to%20account%20management%20resources.

The Reader role is an Azure Resource Manager role that permits users to view storage account resources, but not modify them. "It does not provide read permissions to data in Azure Storage, but only to account management resources". https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access#:~:text=The%20Reader%20role%20is%20an,only%20to%20account%20management%20resources.

This makes no sense, otherwise one could choose all the answers to every question and ace the exam.

you're basically saying that whenever you have that kind of questions if you flag all the possible answers you still get the points?