Exam AZ-104 topic 3 question 88 discussion

The correct answer should be: Allowed resource types: Container Allowed permissions: List and Read. Explanation: Container: "Grants access to the content and metadata of any blob in the container, and to the list of blobs in the container." Source: https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-the-signed-resource-field Specifying "Object" additionally would be redundant because it is a subset of "Container". List: "List blobs non-recursively." Source: https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-permissions Satisfies the requirement of enumeration. Read: "Read the content, blocklist, properties, and metadata of any blob in the container or directory. Use a blob as the source of a copy operation." Source: https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-permissions Satisfies the requirement of download.

I would go with "container, read, list" container: it's the resource type we want to generate SAS for read: this will allow download List: this will allow enumeration or count/listing object: is for when you want to target a specific blob. So it's not necessary for this scenario however it was required in the previous question.

WRONG Container Read + List

Correct: - Container - Read, List

- Container - Read - List

I would say container and object. You need container to list and you need the object to download. You need the list option because that's the actions you want to perform on the container and you need read to download the object. https://learn.microsoft.com/en-us/answers/questions/67751/azure-sas-terms

Why container? Only object should be sufficient as it is asked to enumerate all the blobs in the given container.

From the Internet: As far as I know, the resource type, you could regard as below: Service (s): Access to service-level APIs (e.g., Get/Set Service Properties, Get Service Stats, List Containers/Queues/Tables/Shares) Container (c): Access to container-level APIs (e.g., Create/Delete Container, Create/Delete Queue, Create/Delete Table, Create/Delete Share, List Blobs/Files and Directories) Object (o): Access to object-level APIs for blobs, queue messages, table entities, and files(e.g. Put Blob, Query Entity, Get Messages, Create File, etc.) therefore is the answer: Container, Object, Read correct