Examkin

Question

Difficulty: Very hardManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to configure secure access to a blob container named confidential in an Azure Storage account named corpstore104 for an external partner application. The solution must meet the following requirements:
- The partner application must only be allowed to read and list blobs in the container.
- Access must be granted for a maximum of 8 hours.
- Access must be restricted to the partner application's public IP address range of 198.51.100.0/24198.51.100.0/24 using HTTPS only.
- In accordance with the least-privilege security policy, access must be authorized using a Microsoft Entra ID security principal rather than the storage account's shared access keys.

Which two actions should the administrator perform?

  1. Assign the Storage Blob Data Reader and Storage Blob Data Delegator roles to the Microsoft Entra ID security principal at the storage account level.Answer
  2. Generate a User Delegation SAS token using the credentials of the security principal, specifying the HTTPS protocol, the IP range 198.51.100.0/24198.51.100.0/24, and read/list permissions.Answer
  3. C
    Assign the Owner or Contributor role to the Microsoft Entra ID security principal at the resource group level to grant administrative control over the storage account data plane.
  4. D
    Generate an Account SAS token from the Azure portal using the storage account access keys, setting the expiration to 8 hours and restricting access to the specified IP range.
  5. E
    Create a stored access policy on the blob container, and then generate a Service SAS token using the storage account access keys without specifying an expiration time.

Answer

Assign the Storage Blob Data Reader and Storage Blob Data Delegator roles to the Microsoft Entra ID security principal at the storage account level, and generate a User Delegation SAS token using the credentials of the security principal, specifying the HTTPS protocol, the IP range 198.51.100.0/24198.51.100.0/24, and read/list permissions.
To satisfy the requirement of using a Microsoft Entra ID security principal rather than access keys, a User Delegation SAS must be used. Generating this type of SAS requires two main parts: first, the security principal must be assigned the Storage Blob Data Delegator role to retrieve the user delegation key, and the Storage Blob Data Reader role to allow data-plane read operations on the container. Second, the SAS token itself must be generated using these Entra ID credentials while enforcing the HTTPS, IP range, and read/list permissions constraints.

Step-by-Step Solution

1
Determine the SAS type required.
A User Delegation SAS is chosen.
The security requirements demand that access is authorized using a Microsoft Entra ID security principal instead of the storage account's shared access keys.
2
Assign the required role permissions to the Entra ID identity.
The Storage Blob Data Delegator role (to generate the user delegation key) and the Storage Blob Data Reader role (to read/list data plane blobs) are assigned.
User Delegation SAS validation checks the generator's RBAC roles at runtime, and the delegator role is needed to sign the token.
3
Generate the User Delegation SAS token.
A User Delegation SAS is created with HTTPS, IP constraint 198.51.100.0/24198.51.100.0/24, read/list permissions, and an expiration under 8 hours.
This directly meets the connection security, network isolation, and temporal constraints specified in the scenario.

Key Concept

Configuring secure container access via User Delegation SAS signed by a Microsoft Entra ID principal.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic