StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Data classification encryption databases and storage

Practice question 471 of 498 · medium

An Azure service uses a managed identity to read items in one Cosmos DB for NoSQL container. Which permission design fits?

Choose the single best answer.

  1. A.Embed the account's primary key in code to obtain finer scope
  2. B.Grant the service all directory administrator roles
  3. C.Assign a suitable native data-plane role at the needed scope
  4. D.Assume a resource Contributor role automatically grants the intended item access
Show the answer and explanation

✓ Correct answer

  • Assign a suitable native data-plane role at the needed scope

Cosmos DB for NoSQL data-plane roles authorize item operations with appropriate scope. Resource management roles have a different purpose, account keys are broad credentials, and directory administrator roles exceed the workload requirement.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.