Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Assigning the Storage Blob Data Reader role at the scope of the required container allows the principal to list and read blobs within that container while preventing any write or delete operations. Because the role assignment is scoped to the container, the developer cannot enumerate or access other containers in the storage account. Storage Blob Data Contributor would permit modification and deletion of blobs, which violates the requirement. Storage Account Contributor allows management of the storage account's configuration but does not grant data-plane access to blobs. The Reader role grants access only to the Azure Resource Manager metadata of the storage account, not to the blob data itself.