Develop for Azure storage →hardMultiple ChoiceObjective-mapped

AZ-204 Develop for Azure storage Practice Question

Exhibit

{
  "version": "2019-04-01",
  "statement": [
    {
      "effect": "Allow",
      "principal": {
        "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
      },
      "action": [
        "Microsoft.Storage/storageAccounts/blobServices/containers/read"
      ],
      "resource": "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/stg1/blobServices/default/containers/container1",
      "condition": {
        "StringEquals": {
          "Microsoft.Storage/blob/publicAccess": "none"
        }
      }
    }
  ]
}

Refer to the exhibit. You have an Azure Storage account with a blob container named container1. The container's public access level is set to Blob (anonymous read access for blobs only). You attempt to assign the custom role defined in the JSON using Azure PowerShell. The role assignment fails. What is the most likely reason?

⚠ Common exam trap

The trap here is that candidates often overlook the condition in the custom role definition and focus on the action or scope, assuming the failure is due to a syntax error or invalid principal, rather than recognizing that Azure RBAC conditions are evaluated at assignment time and can block the assignment if the resource's current state does not satisfy the condition.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition StringEquals expects publicAccess to be 'none', but the container has Blob (anonymous) access.

C is correct because the custom role includes a condition that uses the `StringEquals` operator to check that the `publicAccess` property of the container is set to `'none'`. Since `container1` has public access level set to `Blob (anonymous read access for blobs only)`, the condition evaluates to false, causing the role assignment to fail. Azure role assignments with conditions require all specified conditions to be met; otherwise, the assignment is rejected.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is not a valid action.
Why it's wrong here
The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is a standard and valid data plane action within Azure Role-Based Access Control (RBAC) for storage accounts. This specific action permits principals to list containers, retrieve container properties, and read container metadata. Therefore, stating it is not a valid action is incorrect, as it is a fundamental permission for interacting with Azure Blob Storage containers.
✗
The principal ID is invalid.
Why it's wrong here
A principal ID in Azure RBAC refers to the unique GUID that identifies a user, group, service principal, or managed identity. The format of a GUID (Globally Unique Identifier) is a 32-character hexadecimal string, typically displayed in five groups separated by hyphens. Since the principal ID provided in the exhibit adheres to this standard GUID format, it is considered valid and correctly represents an Azure identity.
✓
The condition StringEquals expects publicAccess to be 'none', but the container has Blob (anonymous) access.
Why this is correct
The condition explicitly requires the `publicAccess` property of the container to be set to 'None' for the permission to be granted. However, if the container is configured with 'Blob' or 'Container' anonymous access, this condition evaluates to false. Consequently, the access request is denied because the container's actual public access setting does not match the 'None' value mandated by the RBAC condition.
✗
The resource scope is incorrectly formatted.
Why it's wrong here
The resource scope in Azure RBAC defines the hierarchy at which a role assignment or condition applies, typically following the Azure Resource Manager (ARM) path structure. A correctly formatted scope for a storage account would include the subscription, resource group, and storage account provider details, such as `/subscriptions/{subId}/resourceGroups/{rgName}/providers/Microsoft.Storage/storageAccounts/{accountName}`. The exhibit's resource scope adheres to this standard ARM path, making it syntactically valid and correctly targeted.

Go deeper

AZ-204 Develop for Azure storage Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question