AZ-204 Implement Azure security Practice Question
Exhibit
Refer to the exhibit.
{
"type": "Microsoft.Authorization/roleDefinitions",
"name": "Custom Storage Blob Contributor",
"properties": {
"roleName": "Custom Storage Blob Contributor",
"description": "Grants full access to storage blob containers and data",
"type": "CustomRole",
"permissions": [
{
"actions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/delete"
],
"notActions": [],
"dataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
],
"notDataActions": []
}
],
"assignableScopes": [
"/subscriptions/12345678-1234-1234-1234-123456789abc"
]
}
}Refer to the exhibit. You have a custom RBAC role definition. A user assigned this role reports they can read, write, and delete blobs, but cannot list the containers in the storage account. What is the most likely reason?
⚠ Common exam trap
Watch out — candidates often assume blob read/write/delete permissions automatically include the ability to list containers, but Azure separates control plane and data plane permissions, and the portal specifically requires the Reader role for navigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have the Reader role on the storage account to navigate in the Azure portal.
The user can perform blob operations (read, write, delete) because the custom RBAC role includes the necessary data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/*). However, listing containers requires the control plane action Microsoft.Storage/storageAccounts/blobServices/containers/read, which is not included in the role. Without the Reader role on the storage account (which grants this action), the user cannot list containers in the Azure portal, even though they can interact with blobs directly via tools that bypass the portal's container enumeration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The role does not grant delete permissions on containers.
Why it's wrong here
This statement is incorrect because a properly defined custom role for container deletion would explicitly include the "Microsoft.Storage/storageAccounts/blobServices/containers/delete" action within its "actions" array. This control plane permission allows the principal to remove entire containers from the storage account, making the assertion that this capability is missing false if the role definition is structured to grant this specific capability.
- ✗
The role lacks dataActions for reading blobs.
Why it's wrong here
This option is incorrect as the custom role definition for reading blob data would contain the "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read" entry within its "dataActions" array. This specific data plane permission directly enables the principal to retrieve the content of blobs, thus contradicting the claim that the role lacks the necessary authorization for reading blobs.
- ✓
The user does not have the Reader role on the storage account to navigate in the Azure portal.
Why this is correct
This is the correct answer because, even with specific data plane permissions granted by the custom role, the Azure portal requires control plane permissions to list and navigate resources. Without the "Reader" role (or equivalent) assigned at the storage account scope, the user cannot even view the storage account in the portal, preventing them from accessing its containers or blobs, regardless of their data plane access.
- ✗
The role does not include the action to list containers.
Why it's wrong here
This statement is inaccurate because the custom role definition would typically include the "Microsoft.Storage/storageAccounts/blobServices/containers/read" action to enable listing containers. This control plane permission allows the principal to enumerate containers within a blob service and retrieve their metadata, directly providing the capability to list them, contrary to the option's claim.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.