Examkin

Question

Difficulty: HardManage Storage Access Keys and Shared Access Signatures (SAS)

An organization has an Azure Storage account named saassessmentlogs that contains a blob container named securityaudit. You need to grant an external application temporary read-only access to the blobs inside the securityaudit container. The solution must meet the following security requirements:

- The access must be temporary and expire in 33 hours.
- Access to other containers or storage services must be prevented.
- Access must be restricted to HTTPS traffic originating from the IP range 198.51.100.0/24198.51.100.0/24.
- The generation and usage of the token must be auditable to a specific Microsoft Entra ID security principal, without utilizing or exposing the storage account access keys.

Which access delegation configuration should you implement to meet the requirements?

  1. A
    Assign the Storage Blob Data Reader role directly to the external application in Microsoft Entra ID, and restrict the storage account control plane access using Azure RBAC.
  2. B
    Generate a Service SAS signed with Storage Account Key 1, configure a Stored Access Policy on the container with a 33-hour expiration, and rotate Key 1 immediately after the application finishes.
  3. Generate a User Delegation SAS using a security principal assigned the Storage Blob Delegator role at the storage account level and the Storage Blob Data Reader role at the container level.Answer
  4. D
    Enable the firewall bypass for trusted Microsoft services on the storage account, and generate an Account SAS signed with Storage Account Key 2 that has a 33-hour expiration.

Answer

Generate a User Delegation SAS using a security principal assigned the Storage Blob Delegator role at the storage account level and the Storage Blob Data Reader role at the container level.
The correct option satisfies the scenario because a User Delegation SAS is signed using Microsoft Entra ID credentials instead of the storage account key, satisfying the requirement to avoid exposing access keys. It uses the Storage Blob Delegator role to request the user delegation key and the Storage Blob Data Reader role to authorize container-level read operations. Furthermore, SAS tokens natively allow limiting access by IP address, restricting connections to HTTPS, and defining a specific expiration window.

Step-by-Step Solution

1
Identify the authentication method that avoids utilizing or exposing storage account keys while remaining auditable.
Determine that a User Delegation SAS must be used, which is signed using Microsoft Entra ID credentials.
Compliance requires that access keys are not used or exposed, and that token generation is auditable to a specific Entra ID identity.
2
Assign the necessary roles to the security principal that will generate the User Delegation SAS.
Assign the Storage Blob Delegator role at the storage account level (to generate the user delegation key) and the Storage Blob Data Reader role at the container level (to grant data plane read access).
A User Delegation SAS requires the signing principal to have control plane permissions to fetch the delegation key and data plane permissions corresponding to the target operations.
3
Generate the SAS token with the specified constraints.
Create the User Delegation SAS token specifying a 33-hour expiration, HTTPS-only protocol, and the allowed client IP range of 198.51.100.0/24198.51.100.0/24.
This ensures that access is tightly constrained to the required lifetime, network location, and secure transport channel.

Key Concept

User Delegation SAS utilizes Microsoft Entra ID credentials to secure the SAS, avoiding the exposure of storage account keys and providing auditability.
Estimated Time:2m 35s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic