AZ-104 Exam - Question 84

Question

HOTSPOT -You have an Azure subscription that contains a storage account named storage1. The subscription is linked to an Azure Active Directory (Azure AD) tenant named contoso. com that syncs to an on-premises Active Directory domain. The domain contains the security principals shown in the following table. In Azure AD, you create a user named User2. The storage1 account contains a file share named share1 and has the following configurations. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:.

Examice · Accepted Answer

Reference:https://docs. microsoft. com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal.

im82 · Answer

Was on exam today 19.11.2021. Passed with 920
Correct answer: Y-N-Y

ech · Answer

Yo cannot give share-level priviledges to a computer object. Ans is correct.

RandomNickname · Answer

Y,N,N
As per link:
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

1: Hybrid users are supported
2:Because computer accounts don't have an identity in Azure AD, you can't configure Azure role-based access control (RBAC) for them. However, computer accounts can access a file share by using a default share-level permission.
3: Authentication and authorization against identities that only exist in Azure AD, such as Azure Managed Identities (MSIs), aren't supported

31c21da · Answer

The key to whether you can assign user2 depends on whether user2 is a cloud-only identity. Initially, yes, as the user is created in Azure AD. However, the question also mentions an Azure AD 'contoso.com' syncs to an on-premises AD. Once user2 is synced, they become a hybrid identity. So, the crucial point here is what the question is aiming to test. If the question is testing whether a user created in Azure AD is initially a cloud-only identity, the answer will be 'N'. If it is testing whether the user will be synced, the answer is 'Y'. Since we don't know the intent of the question, we cannot definitively say whether the answer is N or Y...

Andy_S · Answer

Y-N-N
In JSON we can see parameter "directoryServiceOptions" has a value "AD" which means File Share is enabled for authentication to users having SESSION TICKET (Kerbeross) issued by LOCAL Domain Controller. It means that this file share can be accessed from computers JOINED to AD (OnPrem) and by Users created in OnPrem AD AND Synced to AAD (for RBAC).

Vanilla007 · Answer

Third option should be Y right? Because even tough user 2 is cloud user, file share is in AZ storage account so he must be able to access if given access??

tabauruguay · Answer

The problem is the question. It asks if you can assign the role to share1. It doesn't say if the user can authenticate from on-premise. You can assign the role to share1 just fine, you will not be able to login from on-premise because that user won't be sync'd. However, for the question itself the answer is "Y".

GoldenDisciple2 · Answer

Microsoft clearly states the user must have a hybrid identity therefor the 3rd one is a NO.

"If you intend to use a specific Azure AD user or group to access Azure file share resources, that identity must be a hybrid identity that exists in both on-premises AD DS and Azure AD."

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal#:~:text=If%20you%20intend%20to%20use%20a%20specific%20Azure%20AD%20user%20or%20group%20to%20access%20Azure%20file%20share%20resources%2C%20that%20identity%20must%20be%20a%20hybrid%20identity%20that%20exists%20in%20both%20on%2Dpremises%20AD%20DS%20and%20Azure%20AD.

AMEHAR · Answer

Y -N -N

GoldBear · Answer

Does this question represent the level of knowledge that you need to memorize to perform the role of System Admin?  Seems to have to much details to remember, on the job you would run test on these items to verify if it meets the requirement.

tashakori · Answer

Yes
No
No

Chris76 · Answer

YNY - The AAD is synced to onprem hence user2 will also be in AD

etanvandan7 · Answer

If you intend to use a specific Azure AD user or group to access Azure file share resources, that identity must be a hybrid identity that exists in both on-premises AD DS and Azure AD. For example, say you have a user in your AD that is [email protected] and you have synced to Azure AD as [email protected] using Azure AD Connect sync or Azure AD Connect cloud sync. For this user to access Azure Files, you must assign the share-level permissions to [email protected]. The same concept applies to groups and service principals.

https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

hence user2 is cloud only not present in the forest directory
ie user2 should be in either AD DS and Azure AD tenant (HYBRID) or onPREM AD and Azure AD tenant (HYBRID)

Y-N-N shd be the answer

897dd59 · Answer

should be Y-N-Y 
1/ you cannot assign for object: computer
2/ user2 is a cloud user => can fully managed on cloud

vsvaid · Answer

Y -N -N, 
Hybrid user will work
Computer and cloud users will not work

Amir1909 · Answer

Yes
No
No

OpOmOp · Answer

Pay attention to it:
contoso.com that syncs TO an on-premises Active Directory domain.

I have no idea how it was made, maybe with powershell scripts. But User2 will be synchronized to on-prem AD domain.

AZ-104 Exam - Question 84

Discussion