DP-900 Describe core data concepts Practice Question
Exhibit
{
"role": "MyRole",
"permissions": ["Read", "List"],
"dataActions": ["Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"]
}Refer to the exhibit. You are configuring a custom role in Azure RBAC for a team that needs to read and list blobs in a storage account. The JSON snippet shows the permissions assigned. After assigning this role to a user, they report they cannot see the storage account in the Azure portal. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume dataActions alone are sufficient for portal visibility, but the portal requires control-plane read permissions to render the storage account in the resource list.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role does not include read permission on the storage account resource.
The custom role definition only includes dataActions for reading and listing blobs, but lacks any actions that grant read permission on the storage account resource itself. In Azure RBAC, viewing a storage account in the Azure portal requires the 'Microsoft.Storage/storageAccounts/read' action at the resource scope. Without this, the user cannot see the storage account in the portal, even though they can interact with blobs via APIs or tools that bypass the portal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The dataActions should be actions instead of dataActions.
Why it's wrong here
In Azure RBAC, `actions` are for control-plane operations, such as listing or managing the storage account itself, while `dataActions` are for data-plane operations, such as reading or writing blobs. Accessing blob content is a data-plane operation, so using `dataActions` for blob permissions is correct. Changing those entries to `actions` would cause Azure to reject the operation because blob data operations are not recognized in the control-plane actions list.
- ✓
The role does not include read permission on the storage account resource.
Why this is correct
The role definition is missing `Microsoft.Storage/storageAccounts/read`, which is the control-plane action required to see the storage account in the Azure portal and to list it with tools like ARM API or PowerShell. Even if `dataActions` grant blob read/write, the user cannot discover or view the storage account resource itself, resulting in an authorization failure when attempting to display the account. This missing read permission is the direct cause of the user's inability to see the storage account.
- ✗
The role is not assigned at the subscription scope.
Why it's wrong here
The role assignment scope determines where a role applies, not whether the role's permissions are sufficient. A custom role that includes the correct `Microsoft.Storage/storageAccounts/read` action can be assigned at the resource group or storage account scope and still allow the user to view that storage account. Assigning the same deficient role at a broader subscription scope would still fail because the role definition itself lacks the required read action, so scope is not the problem here.
- ✗
The user needs the Contributor role to view the storage account.
Why it's wrong here
Viewing a storage account requires only the `Microsoft.Storage/storageAccounts/read` action, which is part of the built-in Reader role. The Contributor role is a higher-privileged role that adds write, delete, and other management permissions beyond what reading and viewing require. The user does not need Contributor; simply adding the single read action to the custom role would let the user see the storage account while retaining least privilege.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure SQL Services
Key term
Report
A report in Azure data services is a structured output that summarizes, visualizes, or details data stored in cloud databases or data warehouses, often used for business intelligence and monitoring.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This DP-900 question is part of Courseiva's 820-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.