Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to configure temporary access to a container named reports-archive in an Azure Storage account named corpdatafiles2026. The access must be restricted to an on-premises application running on a server with the IP address 198.51.100.85198.51.100.85. The application only requires read access for a duration of exactly 4 hours, and the connection must be secured using HTTPS. The administrator must also ensure that access can be revoked immediately if a security compromise occurs, without impacting other applications that are currently using different SAS tokens. Which configuration should the administrator implement to meet these requirements?

  1. A
    Generate an Account SAS and set the expiration time directly in the token.
  2. Generate a Service SAS associated with a Stored Access Policy on the container.Answer
  3. C
    Assign the Contributor Azure RBAC role at the storage account level to the application.
  4. D
    Configure a Service SAS and enable the 'Allow trusted Microsoft services' firewall setting.

Answer

Generate a Service SAS associated with a Stored Access Policy on the container.
Generating a Service SAS associated with a Stored Access Policy is the correct approach. A Stored Access Policy allows you to define permissions and expiration times on the container level. If the SAS is compromised, the administrator can delete or modify the policy, which immediately invalidates all SAS tokens generated from it, without disrupting other SAS tokens or requiring storage account key rotation.

Step-by-Step Solution

1
Determine the type of Shared Access Signature (SAS) required for granular resource control and revocation.
A Service SAS is chosen because it targets a specific resource (the blob container) and supports Stored Access Policies, unlike an Account SAS.
An Account SAS cannot be associated with a Stored Access Policy, making individual revocation impossible without rotating the storage account access keys.
2
Configure a Stored Access Policy on the target container.
A Stored Access Policy is created on the container with the read permission and a 4-hour validity window.
By placing the constraints within the Stored Access Policy rather than directly on the token, the policy can be modified or deleted to immediately revoke access.
3
Generate the Service SAS token linked to the Stored Access Policy.
A Service SAS token is generated, incorporating the IP restriction to the specified address and requiring HTTPS connection.
Linking the SAS to the policy satisfies all security constraints while ensuring independent revocation capabilities.

Key Concept

Stored Access Policies allow control over Service SAS parameters, enabling instant revocation of specific tokens by deleting or altering the underlying policy without rotating the account access keys.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic