Develop data processing →mediumMultiple ChoiceObjective-mapped

DP-203 Develop data processing Practice Question

Exhibit

Refer to the exhibit. The following is a JSON policy for an Azure Data Lake Storage Gen2 storage account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "ManagedIdentity": "..."
      },
      "Action": [
        "Microsoft.Storage/storageAccounts/blobServices/containers/read"
      ],
      "Resource": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Storage/storageAccounts/.../blobServices/default/containers/data/...",
      "Condition": {
        "Bool": {
          "acs:RequestVersion": "2019-12-12"
        }
      }
    }
  ]
}

Refer to the exhibit. You have a managed identity that needs to read data from the 'data' container in Azure Data Lake Storage Gen2. The policy currently denies access. What is the most likely cause?

⚠ Common exam trap

The trap here is that candidates often overlook condition keys in Azure RBAC policies and focus only on the action or scope, assuming the deny is due to an incorrect role assignment or resource path, rather than a version-matching condition that blocks the request.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The condition on 'acs:RequestVersion' is preventing access because the request does not use the specified API version

The policy condition requires the request to include the API version '2021-06-08' via the `acs:RequestVersion` condition key. Managed identity requests to Azure Data Lake Storage Gen2 use a default API version that may not match this specific version, causing the deny. The condition explicitly checks the request's API version, and if it does not match, access is denied regardless of other permissions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The condition on 'acs:RequestVersion' is preventing access because the request does not use the specified API version
Why this is correct
The condition requires API version 2019-12-12, which may not be used.
✗
The resource path is malformed; it should include the blob path
Why it's wrong here
The resource path is valid for container-level operations.
✗
The action 'Microsoft.Storage/storageAccounts/blobServices/containers/read' is incorrect; it should be 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'
Why it's wrong here
The action is for listing containers, but reading blobs requires a different action.
✗
The principal is a managed identity, but the policy requires a user-assigned identity
Why it's wrong here
Managed identity is valid regardless of type.

Go deeper

DP-203 Develop data processing Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question