DP-203 Design and implement data storage Practice Question
Exhibit
Refer to the exhibit.
{
"RoleName": "Storage Blob Data Contributor",
"Type": "BuiltInRole",
"Description": "Allows for read, write, and delete access to Azure Storage containers and blobs.",
"Actions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/delete"
],
"NotActions": [],
"DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete"
],
"NotDataActions": [],
"AssignableScopes": ["/subscriptions/..."]
}You need to assign permissions to a service principal so that it can write data to a specific container in Azure Data Lake Storage Gen2, but not delete blobs. The above JSON shows the built-in role 'Storage Blob Data Contributor'. The role includes delete permission in DataActions. What should you do?
⚠ Common exam trap
The trap here is that candidates mistakenly believe you can modify a built-in role's permissions at assignment time (Option D) or that ACLs can override RBAC permissions (Option C), when in reality Azure requires a custom role for such granular control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom role that includes read and write DataActions but excludes the delete DataAction, then assign that custom role.
Azure RBAC roles are all-or-nothing at the permission level; you cannot selectively remove a single DataAction from a built-in role at assignment time. The only way to grant write access without delete is to create a custom role that explicitly includes the required read and write DataActions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write) and omits the delete DataAction (Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete). This custom role is then assigned to the service principal at the container scope, ensuring it can write data but never delete blobs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a custom role that includes read and write DataActions but excludes the delete DataAction, then assign that custom role.
Why this is correct
Storage Blob Data Contributor includes delete in its DataActions, so it cannot meet the no-delete constraint. A custom role defining only read and write DataActions, excluding delete, grants precisely the required container access without over-permissioning the service principal.
- ✗
Assign the Storage Blob Data Contributor role and create a deny assignment that denies delete.
Why it's wrong here
Deny assignments are created only by Azure Blueprints and managed applications; a customer cannot author one to subtract delete from a role assignment. They are tempting because they explicitly block actions, and a deny assignment would be correct where a blueprint or managed application must prevent modification of a deployed resource.
- ✗
Assign the Storage Blob Data Contributor role and use ACLs to deny delete on the container.
Why it's wrong here
ACLs cannot deny an action granted by a role assignment; permissions are additive, so the delete DataAction still applies. ACLs are the correct tool for granting POSIX-style access to individual directories or files for specific principals.
- ✗
Assign the Storage Blob Data Contributor role and remove the delete permission at the role assignment scope.
Why it's wrong here
Azure RBAC role assignments are additive; you cannot edit a built-in role's DataActions at a scope or subtract delete from an assignment. It is tempting because scoping permissions narrowly is sound practise, and a custom role would be correct when no built-in role matches the required action set.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-203 question from scratch — 509 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.