DP-900 Describe an analytics workload on Azure Practice Question
Your company uses Azure Data Lake Storage Gen2 and wants to grant a data scientist read-only access to a specific container. Which built-in RBAC role should you assign?
⚠ Common exam trap
Test-takers frequently confuse the ARM-level Reader role (which only allows viewing storage account metadata) with data plane roles like Storage Blob Data Reader, mistakenly thinking Reader grants data access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage Blob Data Reader
Storage Blob Data Reader (D) is the correct built-in RBAC role because it grants read-only access to Azure Storage blob containers and data, including Data Lake Storage Gen2. This role provides the necessary permissions for a data scientist to read data from a specific container without allowing write or delete operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storage Account Contributor
Why it's wrong here
Storage Account Contributor operates entirely at the control plane, granting full management over the storage account resource, including settings, networking, and shared keys. It does not assign any data plane permissions on the containers or blobs themselves, so it cannot list or read files in Azure Data Lake Storage Gen2. Additionally, because it can manage shared keys, this role carries a privilege escalation risk, making it an inappropriate choice for a read-only data access requirement.
- ✗
Reader
Why it's wrong here
Reader is a control-plane-only role that allows viewing the storage account's configuration, tags, and resource metadata, but it explicitly excludes data plane actions such as 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'. This role cannot access the actual blobs, directories, or file system entries in a data lake, even though it may show that the storage account exists. It is too narrow in the wrong dimension because it sees the account but cannot see any of the data within it.
- ✗
Storage Blob Data Contributor
Why it's wrong here
Storage Blob Data Contributor is a data plane role that permits not only reading but also creating, overwriting, and deleting blobs and directories in an ADLS Gen2 hierarchy. While it could technically satisfy the read requirement, it violates the principle of least privilege because the user only needs to consume data, not modify or remove it. Granting this role exposes source data to accidental or malicious alterations, making it a poor fit for a strictly read-only analytics scenario.
- ✓
Storage Blob Data Reader
Why this is correct
Storage Blob Data Reader is the correct role because it provides exactly the required read access to the data plane of Azure Data Lake Storage Gen2, including listing containers, reading blob properties, and reading blob content. It works with Azure AD authentication and is scoped to the 'read' data action, meaning the user cannot write, delete, or overwrite any data. For read-only workloads such as reporting and data analytics, this is the recommended, least-privilege role.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.