Exam AZ-104 Topic 3 Question 154 Discussion

Explanation:
CORRECTED ANSWER: User1 can read File1: No. User2 can read File2: Yes. User3 can read File1 and File2: Yes.
Detailed Explanation
The built-in Reader role only grants control-plane ' read ' actions (viewing resource properties); it contains no data-plane blob/file dataActions and does not include listKeys, so User1 cannot read blob or file data through RBAC alone - statement 1 is No. Storage Account Contributor lacks data-plane dataActions too, but it does include Microsoft.Storage/storageAccounts/listKeys/action, letting User2 retrieve the account ' s Shared Key and then authenticate directly to Blob and File data with it, bypassing RBAC entirely - statement 2 is Yes.
User3 already possesses an account access key, which grants full Shared Key access to all data services (blob, file, queue, table) in the account regardless of any RBAC role assignment; ' Secure transfer required ' only forces HTTPS/SMB3 encryption in transit, it doesn ' t block key-based auth - statement 3 is Yes. The ' Default to Azure AD authorization in the portal ' setting only changes the portal ' s default browsing experience, not actual authorization.
Official Reference
Authorize access to data in Azure Storage - https://learn.microsoft.com/en-us/azure/storage/common
/authorize-data-access