Control Azure Data Lake Storage Gen2 Folder Permissions with ACLs
Your organization uses Azure Data Lake Storage Gen2 with hierarchical namespace enabled. You need to implement a security strategy that allows users to read only specific folders within a container. Which authorization method should you use?
Quick Answer
The correct answer is to use access control lists (ACLs) on the folder. ACLs in Azure Data Lake Storage Gen2 allow you to set granular, POSIX-compliant permissions at the directory level, enabling you to control exactly which users or groups can read specific folders within a container while blocking access to others. This is distinct from RBAC roles, which apply broadly to the entire container, and from SAS tokens or shared keys, which operate at the container, file, or account level and lack folder-level granularity. On the DP-203 exam, this question tests your understanding of the layered security model in ADLS Gen2, where RBAC controls high-level access (e.g., storage account or container) and ACLs provide fine-grained control over directories and files. A common trap is confusing container-level RBAC with folder-level ACLs—remember that RBAC is for the “big picture,” while ACLs handle the “small print.” Memory tip: think of ACLs as “directory door locks” that let you open only specific rooms, not the whole building.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access control lists (ACLs) on the folder
ACLs (Access Control Lists) in Azure Data Lake Storage Gen2 can be applied to individual folders, enabling granular read permissions. Option A is incorrect because a storage account shared key grants full access to the entire account. Option B is incorrect because Azure RBAC roles like Storage Blob Data Contributor apply at the container level, affecting all folders within. Option C is incorrect because shared access signatures (SAS) can be scoped to a container or a file, but not to a specific folder within a container.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage account shared key
Why it's wrong here
Account-level access, not granular
- ✗
Azure RBAC roles (e.g., Storage Blob Data Contributor) at the container level
Why it's wrong here
Applies to entire container, not folder-level
- ✗
Shared access signatures (SAS) with folder-level permissions
Why it's wrong here
SAS cannot scope to a folder in ADLS Gen2
- ✓
Access control lists (ACLs) on the folder
Why this is correct
ACLs allow granular permissions at directory level
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Introduction to Azure Data Engineering
Key term
Azure Data Lake Gen2
Azure Data Lake Gen2 is a cloud-based data storage service that combines the scalability and performance of a data lake with the hierarchical file system and security of a data warehouse, designed for big data analytics.
Key term
Azure RBAC for Data
Azure RBAC for Data is a security system that controls who can read, write, or manage data in Azure storage services using role-based permissions.
About these practice questions
This DP-203 question is part of Courseiva's 760-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You use Azure Data Lake Storage Gen2 with a hierarchical namespace. You need to delegate permissions to a group of data scientists so they can create folders and upload files only within a specific directory path. What is the best way to achieve this?
easy- A.Use a stored access policy to grant permissions to the directory.
- ✓ B.Set ACL entries on the specific directory path granting read, write, and execute permissions to the users.
- C.Generate a shared access signature (SAS) with permissions scoped to the specific directory.
- D.Assign the Storage Blob Data Contributor role to the users at the storage account level.
Why B: Azure Data Lake Storage Gen2 supports POSIX-like ACLs that can be set on directory paths to grant granular permissions. Option A is wrong because stored access policies are used to control permissions for shared access signatures (SAS), not to directly grant directory-level permissions. Option C is wrong because SAS tokens are scoped to the storage account or container level, not to subdirectories. Option D is wrong because assigning the Storage Blob Data Contributor role at the storage account level grants permissions to the entire account or container, which is too broad for the requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.