You are implementing a data lake for analytics and must restrict a group named DataScientists to read-only access on the path /raw/sales within a single container. They must not see data in other folders. New files under /raw/sales should inherit the same permissions. What should you do?

To achieve granular, directory-level permissions and inheritance, Azure Data Lake Storage Gen2 (ADLS Gen2) is required, which necessitates enabling the hierarchical namespace feature on the storage account. Without a hierarchical namespace, ADLS Gen2 features like POSIX-style ACLs are not available. Once the hierarchical namespace is enabled, POSIX-style Access Control Lists (ACLs) can be applied directly to the /raw/sales directory. Granting r-x (read and execute) permissions to the DataScientists group on this directory provides read-only access. Configuring default ACLs on /raw/sales ensures that any new files or subdirectories created within it automatically inherit these r-x permissions, fulfilling the inheritance requirement. Assigning the Storage Blob Data Reader role at the storage account scope would grant read access to all data in the storage account, not just /raw/sales, violating the requirement to restrict access to other folders. Generating a container-level SAS token would also grant access to the entire container, not just a specific path, and SAS tokens do not support inherited permissions for new files. Enabling NFS protocol is for mounting the storage account as a network file system and doesn't directly address granular access control or inheritance for specific directories within the container.