Microsoft DP-420 Exam - Topic 4 Question 70 Discussion

Actual exam question for Microsoft's DP-420 exam

Question #: 70
Topic #: 4

You have a container named container! in an Azure Cosmos DB for NoSQL account.

You need to provide a user named User1 with the ability to insert items into container1 by using role-based access The solution must use the principle of least privilege.

Which roles should you assign to User1?

ACosmos DB Built-in Data Contributor only

BCosmos DB Operator only

CDocumentDB Account Contribute only

DDocumentDB Account Contributor and Cosmos DB Built-in Data Contributor

Show Suggested Answer

Suggested Answer: A

The Cosmos DB Built-in DataContributor roleprovides the necessary permissions to insert items into a container in an Azure Cosmos DB for NoSQL account. This role grants theminimum required privilegesfor the described task, adhering to the principle of least privilege.

by Alishia at Nov 25, 2025, 03:41 PM

Limited Time Offer

25%

Off

Get Premium DP-420 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Merlyn

2 months ago

Exactly, A is safer for just inserting items.

upvoted 0 times

...

Lorita

2 months ago

D might be too much access for User1.

upvoted 0 times

...

Alona

2 months ago

A gives the least privilege, so I support that.

upvoted 0 times

...

Mignon

2 months ago

I disagree, B seems more appropriate.

upvoted 0 times

...

Lamonica

2 months ago

I think A is the best choice.

upvoted 0 times

...

Truman

2 months ago

B) Cosmos DB Operator doesn't allow inserts, so it's not right.

upvoted 0 times

...

Gregg

3 months ago

Wait, can User1 really just use A) for that? Sounds too simple.

upvoted 0 times

...

Charlette

3 months ago

I think D) is overkill for just inserting items.

upvoted 0 times

...

Carmen

3 months ago

A) Cosmos DB Built-in Data Contributor only is the way to go!

upvoted 0 times

...

Lenna

4 months ago

Hmm, I'm torn between A and D. Guess I'll have to do some more research on Cosmos DB roles.

upvoted 0 times

...

Glenn

4 months ago

I'd go with A) Cosmos DB Built-in Data Contributor only - it's the principle of least privilege in action!

upvoted 0 times

...

Nu

4 months ago

C) DocumentDB Account Contribute only is not the right option, as it's not a valid role in Azure Cosmos DB.

upvoted 0 times

...

Jean

4 months ago

B) Cosmos DB Operator only is not the correct answer, as it doesn't provide the ability to insert items.

upvoted 0 times

...

Katie

4 months ago

D) DocumentDB Account Contributor and Cosmos DB Built-in Data Contributor would give User1 more permissions than necessary.

upvoted 0 times

...

Son

4 months ago

I’m leaning towards option A, but I wonder if User1 might need additional permissions for other operations later on.

upvoted 0 times

...

Aimee

5 months ago

I’m a bit confused about the difference between the roles. Would assigning both DocumentDB Account Contributor and Cosmos DB Built-in Data Contributor be overkill?

upvoted 0 times

...

Ronny

5 months ago

I remember practicing a similar question where we had to assign roles based on least privilege. I feel like the DocumentDB Account Contributor might be too broad for just inserting items.

upvoted 0 times

...

Aracelis

5 months ago

I'm a little unsure about the difference between the Cosmos DB and DocumentDB roles. I'll need to double-check the documentation to make sure I'm not missing anything important. But based on the information provided, option A does seem like the best choice.

upvoted 0 times

...

Pearly

5 months ago

I'm feeling pretty confident about this one. The question is pretty straightforward, and the principle of least privilege is a concept I'm familiar with. I'd go with option A as well.

upvoted 0 times

...

Tomoko

5 months ago

Okay, I think I've got this. The key is that User1 only needs to be able to insert items, not manage the entire account. So I'd go with option A, the Cosmos DB Built-in Data Contributor role, since that seems to be the most limited one that still covers the required functionality.

upvoted 0 times

...

Truman

5 months ago

I think the Cosmos DB Built-in Data Contributor role might be the right choice since it allows for data manipulation, but I'm not entirely sure if it's enough on its own.

upvoted 0 times

...

Quentin

6 months ago

A) Cosmos DB Built-in Data Contributor only seems like the right choice to me.

upvoted 0 times

...

William

6 months ago

Totally agree with A), it's the least privilege approach!

upvoted 0 times

...

Chantell

6 months ago

But what about D? It covers more roles.

upvoted 0 times

...

Marcos

6 months ago

Hmm, I'm a little confused about the difference between the Cosmos DB and DocumentDB roles. I'll need to review the documentation on those to make sure I understand what each one does.

upvoted 0 times

...

Carlee

6 months ago

I think I'd start by looking at the different role options and trying to understand what each one allows. The question mentions the principle of least privilege, so I'd want to choose the most limited role that still gives User1 the ability to insert items.

upvoted 0 times