DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
You are designing a data lake in Azure Data Lake Storage Gen2 for a large enterprise. You need to ensure that only authorized users can access the data, and you must implement the principle of least privilege. Which security mechanism should you use to grant fine-grained access to specific directories and files without modifying the underlying storage account firewall settings?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure RBAC roles combined with POSIX-like ACLs
Azure RBAC combined with POSIX-like ACLs allows fine-grained permissions at the directory and file level, supporting the principle of least privilege without modifying firewall settings. Option D is incorrect because shared access signatures (SAS) grant time-limited access but are not fine-grained at the directory/file level and can be complex to manage. Option B is incorrect because managed identities provide identity-based access but still require RBAC or ACLs for fine-grained control. Option C is incorrect because storage account firewall rules apply at the account level, not at the directory or file level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure RBAC roles combined with POSIX-like ACLs
Why this is correct
RBAC roles grant coarse permissions (e.g., Storage Blob Data Contributor) while ACLs provide fine-grained permissions on directories and files, enabling least privilege.
- ✗
Managed identities for Azure resources
Why it's wrong here
Managed identities provide identity-based access to storage but still need RBAC or ACLs for fine-grained permissions.
- ✗
Storage account firewall rules
Why it's wrong here
Firewall rules control network access at the account level, not at the directory or file level.
- ✗
Shared access signatures (SAS)
Why it's wrong here
SAS tokens provide time-limited access but are not suitable for fine-grained, role-based permissions at the directory/file level.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 760-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.