[&] Sue needs to download files stored across several blob containers within a storage account. What is the easiest way to grant Sue the permissions she needs without violating least rights policies?
- Assign Sue the storage blob data reader role on the resource group containing the storage account
- Assign Sue the reader role on the resource group containing the storage account
- Assign Sue the owner role one the storage account
- Assign Sue the storage blob data reader role on the storage account -- Correct

[&] Which of the following statements are true?
- Storage account keys provide more granularity than shared access signature
- Azure AD authentication improves security by reducing the number of security objects managed -- Correct
- Shared access signatures provide more granularity than storage account keys -- Correct
- Specific permissions can be assigned via shared access signature -- Correct
- Azure AD authentication provides more granularity that shared access signatures

[&] At what levels can you assign storage account data roles? (choose 2)
- Container -- Correct
- Subscription -- Correct
- Blob
- Management group

[&] Adam needs to be able to download files from an Azure blob container. What is the best way to meet this requirement? (choose the best answer)
- Assign the storage blob data reader on the container to Adam -- Correct
- Assign the owner role on the storage account to Adam
- Assign the reader role on the storage account to Adam
- Create a SAS token with read permissions for the container and do not assign an expiration date. Give Adam the SAS token to use with Azure storage explorer