AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Network Topology
You are using Azure CLI to upload a blob using your Azure AD credentials (--auth-mode login). The command fails with an authorization error. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse management-plane roles (e.g., Contributor) with data-plane roles (e.g., Storage Blob Data Contributor), assuming any Azure AD user with access to the storage account can upload blobs, when in fact a specific data-plane RBAC role is required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user does not have the 'Storage Blob Data Contributor' role on the storage account
When using `--auth-mode login` with Azure CLI, the operation relies on Azure AD role-based access control (RBAC). The user must be assigned a built-in role like 'Storage Blob Data Contributor' or 'Storage Blob Data Owner' on the storage account to authorize blob uploads. Without this role, the request fails with an authorization error because Azure AD has no permissions to grant access to the blob data plane.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user does not have the 'Storage Blob Data Contributor' role on the storage account
Why this is correct
When using Azure AD for authentication with Azure Storage, authorization is managed through Azure Role-Based Access Control (RBAC). To upload blobs, the user's Azure AD identity must be assigned a data plane role that grants write permissions, such as 'Storage Blob Data Contributor'. Without this specific role, the Azure CLI command will fail with an authorization error, as the identity lacks the necessary permissions to perform the requested operation on the storage account's data plane. This is a fundamental security requirement for least privilege access.
- ✗
The Azure CLI version is outdated
Why it's wrong here
An outdated Azure CLI version typically results in errors related to command syntax, missing features, or compatibility issues with newer Azure APIs, rather than a specific authorization failure. For instance, it might produce a 'command not found' or 'invalid argument' error if the syntax has changed, or a generic connection error. It would not directly cause an 'authorization failed' message, as the CLI itself is just the client tool, not the arbiter of data plane permissions.
- ✗
The storage account key is not provided
Why it's wrong here
Azure AD authentication for Azure Storage is an identity-based security model that relies on OAuth 2.0 tokens and Azure RBAC for authorization, completely bypassing the need for storage account access keys. When authenticating with Azure AD, the CLI uses the user's identity to obtain a token, which is then presented to Azure Storage. Therefore, the absence of a storage account key is irrelevant and will not cause an authorization error when Azure AD authentication is explicitly being used.
- ✗
The container name does not exist
Why it's wrong here
If the specified container name does not exist, the Azure Storage service would return a 'ContainerNotFound' error (HTTP 404) rather than an authorization failure. An authorization error (HTTP 403) indicates that the identity attempting the operation lacks the necessary permissions to perform it, regardless of whether the target resource exists. The service first checks permissions, and only if authorized, proceeds to check resource existence.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.