Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

You manage an Azure Storage account named datashareprod that contains a blob container named exports. A partner company requires access to download files from the container. You must grant access that meets the following security requirements:
- The partner must only be allowed to read blobs.
- Access must be restricted to the public IP address 198.51.100.42198.51.100.42.
- You must be able to revoke the access immediately if needed, without rotating the storage account access keys and without affecting other applications that access the storage account.
Which configuration should you use to generate the shared access signature (SAS)?

  1. A service SAS associated with a stored access policy defined on the containerAnswer
  2. B
    An account SAS with the permissions and IP address restriction defined directly in the SAS token
  3. C
    A user delegation SAS signed using an Entra ID user account assigned the Storage Blob Data Reader role
  4. D
    A service SAS that relies on the 'Allow trusted Microsoft services to access this storage account' firewall bypass setting

Answer

A service SAS associated with a stored access policy defined on the container
A service SAS associated with a stored access policy is the correct choice because stored access policies allow you to manage the lifetime and permissions of the SAS. If the SAS needs to be revoked immediately, the administrator can simply delete or modify the stored access policy on the container. This invalidates the SAS without requiring a rotation of the storage account keys, thereby leaving other applications unaffected.

Step-by-Step Solution

1
Analyze the requirement for immediate revocation without rotating storage account keys.
Identify that the SAS must be manageable via a stored access policy, as deleting or modifying the policy immediately invalidates the associated SAS.
Ad-hoc SAS tokens (whether service or account SAS) cannot be revoked individually without rotating the storage account access keys used to sign them.
2
Determine the SAS type compatibility with stored access policies.
Stored access policies are supported only on resource-level service SAS (such as Blob containers or File shares), but not on account SAS or user delegation SAS.
This rules out using an account SAS or user delegation SAS for the revocation requirement.
3
Evaluate the IP security and permission constraints.
The service SAS can be generated with read-only permissions and restricted to the specified IP address (198.51.100.42198.51.100.42) while being bound to the stored access policy.
This satisfies all of the stated requirements under the principle of least privilege.

Key Concept

Stored access policies provide a way to group shared access signatures and provide additional lifecycle management, including immediate revocation, for service SAS tokens.
Estimated Time:1m 30s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic