Question 10 - Microsoft Identity SC-300 Real Exam Questions [July 2026 Update]

Q: 10

You have an Azure subscription that contains a resource group named RG1 and four users named User1, User2, User3, and User4. You plan to assign the users the following roles for RG1: • User1: Reader • User2: Contributor • User3: Storage Blob Data Reader • User4: Virtual Machine Contributor You are evaluating the use of attribute-based access control (ABAC). Which user's role will support the use of ABAC?

Options

Correct Answer:

Explanation

Azure attribute-based access control (ABAC) adds conditions to role assignments to provide more fine-grained access control. Currently, conditions are supported for built-in or custom role assignments that include storage data actions, specifically for Azure Blob Storage and Azure Queue Storage.

The Storage Blob Data Reader role is a data plane role with storage data actions, making it eligible for ABAC conditions. The other roles listed—Reader, Contributor, and Virtual Machine Contributor—are Azure Resource Manager (management plane) roles and do not currently support the addition of ABAC conditions.

Why Incorrect

A. User1: The Reader role is a management plane role that grants read access to management resources and does not support ABAC conditions.

B. User2: The Contributor role is a management plane role that grants full access to manage resources but does not support ABAC conditions.

D. User4: The Virtual Machine Contributor role is a management plane role for managing virtual machines and does not support ABAC conditions.

References

1. Microsoft Learn. "What is Azure attribute-based access control (Azure ABAC)?". Microsoft Docs. Accessed October 2023. In the section "Where can I add conditions?"

it states

"Currently

conditions can be added to built-in or custom role assignments that have storage blob data actions or storage queue data actions." This confirms that only storage data roles support ABAC.

2. Microsoft Learn. "Prerequisites for Azure role assignment conditions". Microsoft Docs. Accessed October 2023. This document outlines the requirements for using ABAC

emphasizing its application to storage accounts and roles with storage data actions

such as Storage Blob Data Reader

Storage Blob Data Contributor

and Storage Blob Data Owner.

3. Microsoft Learn. "Actions and attributes for Azure role assignment conditions for Azure Storage". Microsoft Docs. Accessed October 2023. This page provides a comprehensive list of the attributes and data actions (e.g.

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read) that can be used in conditions

all of which are specific to Azure Storage

thereby excluding management plane roles like Reader and Contributor.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE