AZ-204 Implement Azure security Practice Question
A company stores sensitive data in Azure Blob Storage. They require that all access to the storage account be authenticated via Microsoft Entra ID and that users must have the 'Storage Blob Data Reader' role assigned. A developer reports being unable to read blobs using the Azure portal despite having the role assigned. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse data-plane roles (like 'Storage Blob Data Reader') with control-plane roles (like 'Reader'), assuming the data role alone is sufficient for portal access, but the portal requires control-plane permissions to enumerate the resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have the Azure RBAC Reader role on the storage account's resource group to view the storage account in the portal.
The Azure portal requires the 'Reader' role on the storage account's resource group (or subscription) to list and navigate to the storage account in the portal UI. Even if a user has 'Storage Blob Data Reader' at the storage account scope, without the Azure RBAC 'Reader' role on the resource group, the portal cannot enumerate the storage account resource, preventing access via the portal. The 'Storage Blob Data Reader' role only grants data-plane permissions (read blobs), not control-plane permissions needed to see the resource in the portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account firewall is blocking the user's IP address.
Why it's wrong here
A storage account firewall operates at the network layer, restricting access to the storage account's public endpoint based on IP addresses or virtual networks. If the user's IP address were blocked, they would be unable to establish any connection to the storage account, including attempts to access its data plane or even some management plane operations that require direct network access. This would manifest as a connection error, not merely an inability to view the resource within the Azure portal's management interface.
- ✓
The user does not have the Azure RBAC Reader role on the storage account's resource group to view the storage account in the portal.
Why this is correct
The Azure portal interacts with the Azure Resource Manager (ARM) to display and manage resources. To view any resource, including a storage account, within the portal, a user must possess at least the Azure RBAC Reader role at the resource, resource group, or subscription scope. Without this management plane permission, the storage account will not be discoverable or visible in the portal, even if the user has separate data plane permissions (e.g., Storage Blob Data Contributor) to access the actual data.
- ✗
The storage account is using a system-assigned managed identity for authentication.
Why it's wrong here
System-assigned managed identities provide an Azure Active Directory identity for an Azure service itself, enabling it to authenticate to other Azure services securely without managing credentials. These identities are designed for service-to-service authentication and authorization, not for human users logging into the Azure portal. Human users authenticate to the portal using their individual Azure AD user accounts, making managed identities irrelevant for portal access issues.
- ✗
The role is assigned at the storage account scope but the user is trying to access a different storage account.
Why it's wrong here
Azure RBAC permissions are explicitly scoped. If a role, such as Reader, is assigned to a user at the scope of "StorageAccountA", those permissions apply only to "StorageAccountA" and any resources nested within it (if applicable). This assignment does not grant any access or visibility to a completely different resource like "StorageAccountB". Therefore, if the user is attempting to view "StorageAccountB", having a role on "StorageAccountA" provides no relevant permissions.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.