Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The Storage Blob Data Contributor built-in role grants read, write, and delete permissions for blob data without allowing management of the storage account or its keys. When the role is assigned at the container scope (in this case, the appdata container), the permissions apply only inside that container, so DevTeam members cannot view or access other containers in the same storage account.

Assigning the same role at the storage account scope would expose every container. The Storage Account Contributor role adds management capabilities and therefore exceeds the requirement. A stored access policy and user delegation SAS would work for granting data access but the scenario explicitly requires Azure RBAC, so it does not satisfy the condition.