Exam SC-500 Topic 1 Question 40 Discussion

Actual exam question for Microsoft's SC-500 exam
Question #: 40
Topic #: 1

You have an Azure Storage account named storage1 that hosts a blob container named container1.
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?

A. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1. B. Assign the Storage Blob Delegator role to the managed identity of app1 at the scope of container1. C. Assign the Owner role to the managed identity of app1 at the scope of container1. D. Assign the Storage Blob Data Contributor role to the managed identity of app1 at the scope of container1.

Suggested Answer: D Vote an answer

Read, write, and delete blob access is data-plane access, and Storage Blob Data Contributor is the least- privilege built-in role for that operation set. Assigning it at the container scope keeps App1 constrained to container1 instead of the entire account. Storage Account Contributor is a management-plane role and is too broad. Storage Blob Delegator is for user delegation keys, not direct blob CRUD. Owner is also unnecessarily privileged. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Storage access; Microsoft Learn > Storage Blob Data Contributor role.

by Marsh at Jul 31, 2026, 07:52 PM

Limited Time Offer

15%

Off

Get Premium SC-500 Questions as Interactive Self Test Engine or PDF

Comments

0 Community Members

0 Shares

0 Demo Downloads

10 Years in Business