Quick Answer
The answer is access control lists (ACLs). ACLs on Azure Data Lake Storage Gen2 provide POSIX-compliant, fine-grained permissions at the file and folder level, enabling you to grant read, write, or execute rights to specific users or groups based on identity. This is exactly what is needed for enforcing file-level permissions, as opposed to coarse role-based access control (RBAC) which applies at the storage account or container scope. On the Microsoft Azure Data Fundamentals DP-900 exam, this question tests your understanding of how to secure data at the object level within a data lake, often contrasting ACLs with RBAC or shared access signatures (SAS). A common trap is choosing RBAC because it controls access to the storage service itself, but RBAC cannot restrict access to individual files or folders. Remember the mnemonic: “ACLs for files, RBAC for piles”—ACLs drill down to the file level, while RBAC manages broader resource piles.
This DP-900 practice question tests your understanding of describe considerations for working with non-relational data on azure. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure Databricks to process data stored in Azure Data Lake Storage Gen2. They need to enforce fine-grained access control on files and folders based on user identity. Which security feature should they implement?
Storage account firewall rules
Why wrong: Firewall rules control network access, not file permissions.
Shared access signatures (SAS)
Why wrong: SAS tokens provide time-limited access but are not identity-based.
Access control lists (ACLs)
ACLs provide fine-grained POSIX permissions on files and folders.
Azure RBAC roles on the storage account
Why wrong: RBAC at account level is too coarse for file-level control.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Access control lists (ACLs)
Access control lists (ACLs) on Azure Data Lake Storage Gen2 provide POSIX-compliant, fine-grained permissions at the file and folder level. This allows you to grant read, write, or execute permissions to specific users or groups, which is exactly what is needed for enforcing identity-based access control on individual files and folders.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Storage account firewall rules
Why it's wrong here
Firewall rules control network access, not file permissions.
Shared access signatures (SAS)
Why it's wrong here
SAS tokens provide time-limited access but are not identity-based.
Access control lists (ACLs)
Why this is correct
ACLs provide fine-grained POSIX permissions on files and folders.
Related concept
Read the scenario before looking for a memorised answer.
Azure RBAC roles on the storage account
Why it's wrong here
RBAC at account level is too coarse for file-level control.
Common exam traps
The trap here is that candidates often confuse Azure RBAC (which controls management-plane access) with ACLs (which control data-plane access at the file/folder level), leading them to select RBAC when fine-grained data access is required.
Detailed technical explanation
Azure Data Lake Storage Gen2 implements ACLs using the POSIX model, supporting both access ACLs and default ACLs. Access ACLs control permissions on an existing file or folder, while default ACLs automatically apply to new child items. The effective permissions are evaluated using the POSIX algorithm, which considers the user, owning group, and named users/groups, with the mask limiting permissions for named entities. In a real-world scenario, a data lake with thousands of users might use ACLs to allow a data scientist read-only access to a specific folder while denying access to sensitive financial data in another folder.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Describe considerations for working with non-relational data on Azure — study guide chapter
Learn the concepts, then practise the questions
Describe considerations for working with non-relational data on Azure practice questions
Targeted practice on this topic area only
All DP-900 questions
982 questions across all exam domains
Microsoft Azure Data Fundamentals DP-900 study guide
Full concept coverage aligned to exam objectives
DP-900 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise DP-900 questions linked to Describe core data concepts.
Practise DP-900 questions linked to Describe an analytics workload on Azure.
Practise DP-900 questions linked to Identify considerations for relational data on Azure.
Practise DP-900 questions linked to Describe considerations for working with non-relational data on Azure.
Practise DP-900 questions linked to DP-900 fundamentals.
Practise DP-900 questions linked to DP-900 scenario.
Practise DP-900 questions linked to DP-900 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Describe considerations for working with non-relational data on Azure — This question tests Describe considerations for working with non-relational data on Azure — Read the scenario before looking for a memorised answer..
The correct answer is: Access control lists (ACLs) — Access control lists (ACLs) on Azure Data Lake Storage Gen2 provide POSIX-compliant, fine-grained permissions at the file and folder level. This allows you to grant read, write, or execute permissions to specific users or groups, which is exactly what is needed for enforcing identity-based access control on individual files and folders.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
Last reviewed: Jun 24, 2026
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.