Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

A developer is configuring a CI/CD pipeline that uploads build artifacts to a private blob container in an Azure Storage account. The pipeline requires access to upload these files but should not have administrative control over the storage account. You decide to generate a Shared Access Signature (SAS) token for this purpose.

To adhere to the principle of least privilege and secure access, which two settings should you configure? (Select two.)

  1. Set the allowed protocol parameter to HTTPS onlyAnswer
  2. Configure the SAS permissions to include only WriteAnswer
  3. C
    Assign the Storage Blob Data Contributor RBAC role directly inside the SAS token configuration
  4. D
    Configure the SAS token with no expiration date to ensure uninterrupted pipeline runs

Answer

Enforce HTTPS only for the protocol and select only the Write permission.
Configuring the Shared Access Signature (SAS) token to allow only HTTPS ensures secure, encrypted data transmission. Restricting permissions to Write only satisfies the principle of least privilege, as the pipeline only needs to upload artifacts and does not require read or delete access.

Step-by-Step Solution

1
Analyze the CI/CD pipeline's requirements.
The pipeline only needs to upload files (Write permission) and requires secure communication.
To conform to the principle of least privilege and security best practices.
2
Identify the appropriate protocol setting in the SAS token configuration.
Restrict the allowed protocol to HTTPS only.
Enforcing HTTPS prevents unencrypted transit of sensitive build data.
3
Select the required permissions for the token.
Enable the Write permission and leave Read, List, and Delete unchecked.
Providing only the Write permission ensures the pipeline cannot read, list, or delete existing blobs in the container.

Key Concept

Configuring Shared Access Signatures (SAS) to enforce least privilege access and secure protocols.
Estimated Time:45s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic