StudyByteLearn
← AZ-305: Azure Infrastructure Solutions
AZ-305 · Object, file, and NoSQL data

Practice question 140 of 400 · hard

An analyst has Storage Blob Data Reader on an entire ADLS account. A directory ACL omits that analyst, but reads still succeed. Why?

Choose the single best answer.

  1. A.The Reader management role and Blob Data Reader role always mean identical data permissions
  2. B.A sufficient data RBAC grant is evaluated before ACLs and cannot be narrowed by that ACL
  3. C.HNS disables Microsoft Entra authorization
  4. D.Every ACL automatically overrides every data-role grant, so the observed success is impossible
Show the answer and explanation

✓ Correct answer

  • A sufficient data RBAC grant is evaluated before ACLs and cannot be narrowed by that ACL

An ACL cannot remove access already sufficiently granted by data RBAC. HNS supports Entra/roles/ACLs, and management/data roles differ. Narrow the broad data-role scope if path isolation is required. Source guide: PDF page 27.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.