A blob reader has a condition restricting reads by blob index tag, plus an unconditional broader data-read assignment. What must be changed to enforce the intended restriction?

Choose the single best answer.

A.Assume the conditional assignment overrides every unconditional assignment.
B.Add management Reader, which explicitly denies broad data reads.
C.Replace the condition with an informational cost-center tag on the subscription.
D.Review and remove or constrain the broader grant as well as configuring the supported condition.

Show the answer and explanation

✓ Correct answer

Review and remove or constrain the broader grant as well as configuring the supported condition.

Conditions refine their own supported role assignments; an unconditional grant may still authorize access. Enforce the intent through the complete effective-access set. Cost-center tags alone are metadata, and Reader is an additive management grant rather than an explicit data denial. Source: AZ-305 Study Guide.pdf, PDF page(s) 16.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.