You are designing a data lake for a financial institution using Azure Data Lake Storage Gen2.

The security team requires granular access control. Specifically, they need to grant a data science team read access to a specific sub-directory (/finance/2023/Q1/) without granting them access to the parent directory (/finance/) or any other sub-directories.

Which feature of ADLS Gen2 makes this possible?

Azure Data Lake Storage Gen2 implements a hierarchical namespace, which allows it to support POSIX-compliant Access Control Lists (ACLs). While Azure RBAC is used to grant broad access (e.g., Storage Blob Data Contributor on a container), ACLs are used to provide granular, directory-level or file-level access. To grant access to a specific sub-directory, you assign Execute (X) permissions on the parent directories to allow traversal, and Read (R) permissions on the target directory.