ACL Execute Permission on ADLS Gen2 Root Directory
Exhibit
Refer to the exhibit.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2021-02-01",
"name": "[parameters('storageAccountName')]",
"location": "[resourceGroup().location]",
"kind": "StorageV2",
"sku": {
"name": "Standard_LRS"
},
"properties": {
"isHnsEnabled": true
}
}
]
}You are reviewing the ARM template above. The storage account is created with hierarchical namespace enabled (isHnsEnabled: true). After deployment, you need to ensure that the 'data-engineers' group can execute but not read the contents of the root directory. What should you do?
Quick Answer
This scenario hinges on a subtlety of POSIX-style permissions that trips people up: execute permission on a directory is not about running anything, it is about being allowed to traverse into that directory to reach something inside it, while read permission is what lets you list the directory's actual contents. Granting only execute, without read, on the root directory means the data-engineers group can pass through it, for example to reach a subfolder they do have read access to, without being able to see what files or folders exist directly inside that root. Achieving this requires setting an ACL entry directly, because it is the only mechanism granular enough to separate execute from read; assigning a role like Storage Blob Data Reader would grant both read and list access together, which is more than what is needed here and defeats the purpose. Disabling hierarchical namespace is not an option either, since ACLs depend on that hierarchical structure existing in the first place, and firewall rules operate at the network level, controlling where requests can come from rather than what a given identity is allowed to do once connected. Whenever a question separates execute from read as distinct requirements on a directory, that is a strong signal it is testing POSIX ACL semantics specifically, not RBAC roles or network controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Azure portal to set ACLs on the root directory, granting execute permission to the data-engineers group without read permission
In Azure Data Lake Storage Gen2 (with hierarchical namespace enabled), ACLs are used to set granular permissions at the directory or file level. To grant only execute permission on the root directory without read, you must set an ACL entry that specifically grants execute (--x) to the 'data-engineers' group. Option A is incorrect because disabling hierarchical namespace would change the storage type and not achieve the desired ACL-based permission. Option B is incorrect because the Storage Blob Data Reader role grants read and list access, not just execute. Option C is incorrect because firewall rules control network access, not permissions on directories.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the ARM template to set the 'isHnsEnabled' property to false and redeploy
Why it's wrong here
Disabling hierarchical namespace would remove ACL capability, not help.
- ✗
Assign the Storage Blob Data Reader role to the data-engineers group at the storage account level
Why it's wrong here
This would grant read access to all containers, not just execute at root.
- ✗
Configure a firewall rule to allow only the data-engineers group's IP addresses
Why it's wrong here
Firewall rules control network access, not data permissions.
- ✓
Use the Azure portal to set ACLs on the root directory, granting execute permission to the data-engineers group without read permission
Why this is correct
ACLs allow granular permissions; execute alone allows traversal but not listing contents.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-203 question from scratch — 760 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-203
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing access control for Azure Data Lake Storage Gen2. You need to allow a group of data scientists to read and write files in the 'processed' directory but prevent them from deleting files. Which authorization method should you use?
medium- A.Assign the Storage Blob Data Contributor role at the container level
- B.Assign the Storage Blob Delegator role at the container level
- ✓ C.Assign the Storage Blob Data Contributor role at the container level and use ACLs to deny delete on the directory
- D.Assign the Storage Blob Data Reader role and use ACLs to grant write
Why C: Azure RBAC roles like Storage Blob Data Contributor grant read/write/delete permissions. To differentiate write and delete, you need ACLs that allow read/execute on the container and read/write on the directory, but not delete. Option A (Storage Blob Data Contributor) includes delete. Option B (Storage Blob Delegator) is not a built-in role for data operations. Option D (Storage Blob Data Reader) is read-only, and adding ACLs for write would be complex and not best practice. Option C correctly combines Storage Blob Data Contributor at the container level (which includes delete) but then uses ACLs to explicitly deny delete on the target directory, effectively preventing deletion while allowing read and write.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.