Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

A partner application requires temporary access to upload files to a container named 'incoming' within an Azure storage account. The partner must only be allowed to write data to this specific container for a period of two hours, without any permissions to access other services or containers.

What security configuration should be implemented to satisfy these requirements under the principle of least privilege?

  1. Generate a service SAS for the 'incoming' container and configure an expiration time of two hours.Answer
  2. B
    Generate an account SAS with write permissions and leave the expiration time blank to prevent access interruptions.
  3. C
    Assign the Contributor role at the resource group scope to the partner application's security principal.
  4. D
    Disable the option that allows trusted Microsoft services to bypass the storage firewall and provide the primary access key.

Answer

Generate a service SAS for the 'incoming' container and configure an expiration time of two hours.
Generating a service SAS for the specific container with a two-hour expiration window provides the narrowest resource scope (container-level) and respects the temporal requirement, fulfilling the principle of least privilege.

Step-by-Step Solution

1
Determine the required resource scope of the credential.
Since access is needed only for a single container named 'incoming', a service SAS is appropriate because it targets a specific resource inside a storage service, unlike an account SAS which is scoped to the entire account.
This enforces the resource boundary required by the principle of least privilege.
2
Determine the lifetime constraint of the credential.
The SAS token must have its expiry time configured to exactly two hours from generation.
This enforces the temporal boundary and prevents open-ended access.
3
Evaluate control plane vs data plane access.
Avoid using RBAC roles at the subscription or resource group scope (like Contributor) since they provide control plane permissions that are too broad and do not align with simple, temporary container data access.
This prevents over-privileging and ensures the credential is restricted to data operations only.

Key Concept

Shared Access Signatures (SAS) allow fine-grained, delegated access to Azure Storage resources by defining the scope, permissions, and duration of the access token.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic