AZ-104 Implement and Manage Storage Practice Question
Exhibit
Azure portal role assignments for storage account appdata01: - John Doe: Contributor at storage account scope - Data access test from portal: You do not have permissions to list containers. - Requirement: John must read and download blobs from container invoices and nothing else.
Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?
⚠ Common exam trap
It's easy for candidates to confuse management-plane roles (like Reader or Contributor) with data-plane roles, assuming that any role with 'read' or 'contributor' in the name grants access to blob data, when in fact only specific data-plane roles (e.g., Storage Blob Data Reader) provide the necessary permissions for blob operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign Storage Blob Data Reader at the invoices container scope.
Assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign Reader at the storage account scope so John can view the storage account and its data.
Why it's wrong here
The Reader role is scoped to the management plane (Azure Resource Manager) and includes read permissions for storage account properties and configuration, but it does not include any Microsoft.Storage blob data-plane actions such as Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read. As a result, John would be able to view the storage account blade in the portal but could not download blob content from the invoices container. This option fails because it confuses management-plane visibility with data-plane access, and even at a broader account scope it still lacks the specific data action required.
When this WOULD be correct
This option would be correct if the question required John to view all storage account data (including blobs in all containers) and the role needed to be at the storage account level, with no restriction to a single container.
- ✓
Assign Storage Blob Data Reader at the invoices container scope.
Why this is correct
Blob downloads require a data-plane role, not the Contributor role on the storage account. Assigning Storage Blob Data Reader at the container scope gives John only the read permissions needed for invoices and avoids granting access to other containers or management operations.
- ✗
Assign Storage Account Contributor at the resource group scope.
Why it's wrong here
Storage Account Contributor is a management-plane role that grants full administrative control over the storage account's configuration, networking, encryption, and shared key management, but it deliberately excludes data-plane data access such as reading or writing blobs. By assigning at the resource group scope, John would inherit this role on every storage account in that group, dramatically expanding his blast radius beyond the single invoices container. Furthermore, this role still does not include Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, so John would remain unable to download the blob data despite having broad control-plane privileges.
When this WOULD be correct
This option would be correct if the question asked for a role that allows John to manage the storage account (e.g., update firewall rules, regenerate keys) at the resource group level, without needing data access. For example: 'John must be able to modify storage account settings for all storage accounts in the resource group.'
- ✗
Make the invoices container public and keep John's existing Contributor role.
Why it's wrong here
Making the invoices container public would bypass Azure AD authentication and authorize any anonymous user who knows the blob URL to read or download contents, far exceeding the least-privilege requirement for John alone. Additionally, John's existing Contributor role on the storage account is a management-plane role that does not include Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, so it would not grant the necessary data-plane authorization even if the container were private. The secure solution must use Azure RBAC with an identity that can be audited, not anonymous public access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign Storage Blob Data Reader at the invoices container scope.Correct answer▾
Why this is correct
Blob downloads require a data-plane role, not the Contributor role on the storage account. Assigning Storage Blob Data Reader at the container scope gives John only the read permissions needed for invoices and avoids granting access to other containers or management operations.
✗Assign Reader at the storage account scope so John can view the storage account and its data.Wrong answer — click to see why▾
Why this is wrong here
Assigning Reader at the storage account scope grants read access to all containers and blobs, not just the invoices container, violating the requirement for least privilege.
★ When this WOULD be the correct answer
This option would be correct if the question required John to view all storage account data (including blobs in all containers) and the role needed to be at the storage account level, with no restriction to a single container.
Why candidates choose this
Candidates may think Reader provides sufficient blob access, but Reader only allows viewing storage account properties and configuration, not data; they confuse management-plane read with data-plane read.
✗Assign Storage Account Contributor at the resource group scope.Wrong answer — click to see why▾
Why this is wrong here
Storage Account Contributor at the resource group scope grants full management access to the storage account, including the ability to delete or modify configurations, but does not grant data access (e.g., reading blobs). It would over-privilege John and fail to meet the requirement of read-only blob download from a specific container.
★ When this WOULD be the correct answer
This option would be correct if the question asked for a role that allows John to manage the storage account (e.g., update firewall rules, regenerate keys) at the resource group level, without needing data access. For example: 'John must be able to modify storage account settings for all storage accounts in the resource group.'
Why candidates choose this
Candidates may confuse management roles with data roles, assuming 'Contributor' includes data access, or think that a broader scope (resource group) is safer or simpler, not realizing it lacks blob read permissions.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Blob
A blob is a large piece of unstructured data, like a photo or video, stored in the cloud with a unique identifier.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.