How to Control Access and Audit Azure Data Lake Storage Gen2?
A company uses Azure Data Lake Storage Gen2 for a data lake. They need to ensure that only authorized users can access files and that access is audited. Which two Azure services should they combine? (Choose two options that together form the solution.)
Quick Answer
The answer is Azure RBAC and Azure Monitor. Azure RBAC provides fine-grained access control for Azure Data Lake Storage Gen2 by assigning roles like Storage Blob Data Contributor to users or service principals, ensuring only authorized users can read, write, or delete files. Azure Monitor then collects and analyzes activity logs and diagnostic settings for the storage account, enabling full auditing of access events such as successful and failed authentication attempts. On the DP-900 exam, this pairing tests your understanding that access control and auditing are separate but complementary responsibilities—a common trap is choosing only one service, like Azure RBAC, and forgetting the auditing layer. Remember the memory tip: “RBAC locks the door, Monitor watches who knocks.”
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Entra ID (the identity provider) with the actual access control mechanism (RBAC) and auditing service (Monitor), thinking Entra ID alone handles both, but it only authenticates identities—RBAC authorizes them and Monitor audits the actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure RBAC
Azure RBAC (Role-Based Access Control) is correct because it provides fine-grained access management for Azure Data Lake Storage Gen2, allowing you to assign roles (e.g., Storage Blob Data Contributor) to users, groups, or service principals to control who can read, write, or delete files. Azure Monitor is correct because it can collect and analyze activity logs and diagnostic settings for the storage account, enabling auditing of access events such as successful and failed authentication attempts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Policy
Why it's wrong here
Policy enforces rules but does not provide access control.
- ✗
Azure Key Vault
Why it's wrong here
Key Vault manages secrets, not access control.
- ✓
Azure RBAC
Why this is correct
RBAC controls access to storage resources.
- ✓
Azure Monitor
Why this is correct
Azure Monitor collects audit logs for storage access.
- ✗
Microsoft Entra ID
Why it's wrong here
Entra ID provides identity, but RBAC is needed for authorization.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data Lake Storage Gen2
Data Lake Storage Gen2 is a cloud-based storage service that combines a scalable data lake with enterprise-grade file system capabilities for big data analytics.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DP-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Data Lake Storage Gen2 for a data lake. They implement a folder structure with access control lists (ACLs). A new data scientist needs to read data from a specific folder but not write to it. Which ACL permission should be assigned?
hard- ✓ A.Execute
- B.Modify
- C.Write
- D.Read
Why A: Execute (X) permission on a folder in Azure Data Lake Storage Gen2 is required to traverse the folder and access its contents. Without Execute, a user cannot list or read files inside the folder, even if Read permission is granted. Since the data scientist only needs to read data (not write), assigning Execute on the folder and Read on the files allows traversal and read access without write capability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.