Secure, monitor, and optimize data storage and data processing →hardMultiple ChoiceObjective-mapped

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

{
  "roleName": "Custom Lake Reader",
  "assignableScopes": ["/subscriptions/.../resourceGroups/rg-data/providers/Microsoft.Storage/storageAccounts/datalake001"],
  "permissions": [
    {
      "actions": [
        "Microsoft.Storage/storageAccounts/blobServices/containers/read"
      ],
      "notActions": [],
      "dataActions": [
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"
      ],
      "notDataActions": []
    }
  ]
}

Refer to the exhibit. You have created the custom RBAC role shown and assigned it to a security group. Members of the group report that they can read blobs in the storage account but cannot list the contents of the container. What is the most likely reason for this issue?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The role does not include the permission to list blobs in a container.

The custom RBAC role includes the 'read' data action for blobs, which allows reading blob data, but it does not include the 'list' action for blobs. Without the 'list' permission, users cannot list the blobs within a container. In Azure RBAC for storage, the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' action permits reading blob content and properties, but listing blobs requires the 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/list' action (or equivalent at the container level). Therefore, the role lacks the necessary permission to list blobs. Option A is incorrect because custom RBAC roles are fully supported for Azure Data Lake Storage Gen2. Option B is incorrect because the scope of the role at the storage account level does not prevent listing blobs; the issue is missing data actions. Option D is incorrect because the role already includes the 'read' data action for blobs; the missing action is 'list'.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Custom roles are not supported for Azure Data Lake Storage Gen2.
Why it's wrong here
Custom roles are fully supported for ADLS Gen2.
✗
The role is scoped to the storage account but not to the container.
Why it's wrong here
The scope is on the storage account, which is correct for granting permissions to all containers.
✓
The role does not include the permission to list blobs in a container.
Why this is correct
To list blobs, the role needs 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' permission, but that only reads individual blobs. The 'list' action requires 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' with the 'list' permission, or the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/read' which allows listing container contents.
✗
The role lacks the 'read' data action for blobs.
Why it's wrong here
The role includes 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' which allows reading blobs.

Quick reference

Access Control Model Comparison

Model	Acronym	Who Controls Access?	Best For
Discretionary Access Control	DAC	Resource owner	Small teams, file shares
Mandatory Access Control	MAC	System / security labels	Classified govt / military
Role-Based Access Control	RBAC	Administrator (via roles)	Enterprise environments
Attribute-Based Access Control	ABAC	Policy engine (user + resource attributes)	Fine-grained, dynamic policies
Rule-Based Access Control	RuBAC	System rules / ACLs	Firewall rules, network ACLs

Go deeper

DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing

Exhibit

Why each option matters

Option-by-option breakdown

Access Control Model Comparison

Related to this question