AZ-204 Develop for Azure storage Practice Question
You are building a serverless application that processes images uploaded to an Azure Blob Storage container. When a new blob is added, an Azure Function (PowerShell) is triggered to generate a thumbnail and store it in a different container. The function must run with the least privilege necessary. The function uses a managed identity assigned to the function app. You need to grant the function access to read blobs from the source container and write blobs to the destination container. The storage account already has a private endpoint configured. What is the correct way to assign permissions?
⚠ Common exam trap
Test-takers frequently choose the overly broad 'Storage Blob Data Owner' role (Option B) because they think it's simpler, but the question explicitly requires 'least privilege necessary,' making container-scoped roles the correct answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.
It uses Azure RBAC roles scoped to individual containers, granting the function app's managed identity exactly the permissions needed: 'Storage Blob Data Reader' for reading from the source container and 'Storage Blob Data Contributor' for writing to the destination container. This follows the principle of least privilege, avoids over-permissioning, and works seamlessly with private endpoints since RBAC does not depend on network paths.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a SAS token for the source container with read permission and for the destination container with write permission, and store them in Key Vault for the function to retrieve.
Why it's wrong here
Using a SAS token contradicts the requirement for least privilege because the function would rely on a shared secret rather than the managed identity assigned to the function app. The stem explicitly mandates using that identity for access, which SAS tokens cannot utilise. This option is tempting because SAS tokens are a standard method for granting time-limited, granular access to specific containers, and they would be correct if the function lacked a managed identity or needed to authenticate without Microsoft Entra ID.
- ✗
Add the function app's managed identity to the storage account's Access Control (IAM) with the 'Storage Blob Data Owner' role on the entire storage account.
Why it's wrong here
Adding the 'Storage Blob Data Owner' role at the storage account level grants excessive permissions, violating the principle of least privilege. This role provides full control over all blob data, including the ability to delete containers and blobs across the entire storage account, which is far beyond what's required for merely processing images from specific containers. Best practices dictate assigning only the necessary permissions at the narrowest possible scope.
- ✓
Add the function app's managed identity to the source container's Access Control (IAM) with the 'Storage Blob Data Reader' role, and to the destination container with the 'Storage Blob Data Contributor' role.
Why this is correct
This option correctly implements the principle of least privilege by assigning specific roles at the container level. The 'Storage Blob Data Reader' role on the source container allows the function to retrieve images, while the 'Storage Blob Data Contributor' role on the destination container enables it to write processed images and potentially read/delete intermediate files. This granular access ensures the function has precisely the permissions needed without over-provisioning.
- ✗
Use the storage account connection string in the function app settings and access the blobs using the connection string.
Why it's wrong here
Using a storage account connection string is a security anti-pattern for Azure-to-Azure communication when managed identities are available. Connection strings contain storage account keys, which are highly privileged secrets granting full administrative access to all data within the entire storage account. This approach bypasses Microsoft Entra ID authentication and authorization, fails to leverage the function app's managed identity, and introduces a significant risk of credential compromise.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.