Exam AZ-104 topic 2 question 55 discussion

A) " Enable Active Directory Domain Service (AD DS) authentication for storage1. " Reference: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable?tabs=azure-portal#overview-of-the-workflow

A. Enable Active Directory Domain Service (AD DS) authentication for storage1. To grant the Group1 the Storage File Data SMB Share Elevated Contributor role for share1, you need to enable Active Directory Domain Service (AD DS) authentication for the storage account. By enabling AD DS authentication, you allow Azure AD security groups to be used for granting access control to file shares in the storage account. This enables you to assign roles, such as the Storage File Data SMB Share Elevated Contributor role, to the security group Group1 for the specific file share share1. Once AD DS authentication is enabled and the security group is assigned the appropriate role, Group1 will have the necessary permissions to access and manage the file share. Therefore, enabling Active Directory Domain Service (AD DS) authentication for storage1 is the first step you should take to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.

The correct answer is: A. Enable Active Directory Domain Service (AD DS) authentication for storage1. Why not the others? B. Grant share-level permissions by using File Explorer ➤ That comes after AD authentication is enabled and is used for NTFS permissions, not RBAC assignment. C. Mount share1 by using File Explorer ➤ Mounting can only happen after authentication is enabled and permissions are in place. D. Create a private endpoint ➤ This is optional and only used to restrict access via a private network, not required for enabling AD-based authentication or RBAC.

A is correct

Answer: Enable Active Directory Domain Service (AD DS) authentication for storage1. "1. Enable Azure AD DS authentication over SMB for your storage account to register the storage account with the associated Azure AD DS deployment. 2. Assign share-level permissions to an Azure AD identity (a user, group, or service principal)." https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal#overview-of-the-workflow https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal#assign-share-level-permissions

A is the answer. https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable?tabs=azure-portal#assign-share-level-permissions Most users should assign share-level permissions to specific Azure AD users or groups, and then configure Windows ACLs for granular access control at the directory and file level. However, alternatively you can set a default share-level permission to allow contributor, elevated contributor, or reader access to all authenticated identities. We have introduced three Azure built-in roles for granting share-level permissions to users and groups: - Storage File Data SMB Share Elevated Contributor allows read, write, delete, and modify Windows ACLs in Azure file shares over SMB.

A) . Enable Active Directory Domain Service (AD DS) authentication for storage1. Reference: learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-enable

A is Correct

Correct

A is the right answer

Note: The Storage File Data SMB Share Elevated Contributor allows read, write, delete and modify NTFS permissions in Azure Storage file shares over SMB.