AZ-204 Develop for Azure storage Practice Question
Exhibit
{"role": "Storage Blob Data Contributor", "scope": "/subscriptions/12345/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/st1/blobServices/default/containers/c1"}Refer to the exhibit. You are reviewing a role assignment for a managed identity. The JSON shows the role and scope. What access does this assignment grant?
⚠ Common exam trap
It's easy for candidates to confuse the 'Storage Blob Data Contributor' role with read-only access (Option D) or assume it applies to the entire storage account (Option B), missing the critical scope restriction to container 'c1'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Read, write, and delete access to blobs in container c1.
The role assignment grants the 'Storage Blob Data Contributor' role at the scope of container 'c1'. This role provides read, write, and delete access to blob data within that specific container, but not management operations on the storage account itself. Option C correctly identifies this level of access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Full management access to the storage account.
Why it's wrong here
The Storage Blob Data Contributor role operates at the data plane level, granting permissions to interact with the actual blob data. It does not confer control plane permissions required for managing the storage account resource itself, such as creating or deleting containers, configuring networking rules, or managing access policies for the storage account. Therefore, it does not provide full management access to the storage account.
- ✗
Read access to all containers in the storage account.
Why it's wrong here
The scope of a role assignment is critical in Azure RBAC. If the Storage Blob Data Contributor role is assigned specifically to a single container, such as c1, its permissions are strictly confined to that particular container. This assignment does not extend to other containers within the same storage account, meaning the principal would not have read access to all containers.
- ✓
Read, write, and delete access to blobs in container c1.
Why this is correct
The Storage Blob Data Contributor role is designed to provide comprehensive data access for blobs. When this role is assigned at the scope of container c1, it grants the assigned principal the necessary permissions to perform read, write, and delete operations on blobs exclusively within that specific container. This aligns with the "Contributor" designation for blob data, enabling full manipulation of the blob contents.
- ✗
Read-only access to blobs in container c1.
Why it's wrong here
The Storage Blob Data Contributor role provides more extensive permissions than just read-only access. It explicitly includes the capabilities to write new blobs and delete existing blobs, in addition to reading them. If the intent were solely for read-only access to blobs in container c1, the Storage Blob Data Reader role would be the appropriate assignment, as it restricts permissions to viewing data only.
Go deeper
Related to this question
Learn chapter
Azure Blob Storage Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.