Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to grant a partner application temporary read-only access to a blob container named reports-2026 in an Azure Storage account named datacorp2026. The access configuration must meet the following security requirements:
- The partner application must only connect from the IP address range 192.0.2.0/24.
- The connection must be restricted to HTTPS only.
- The credentials must expire automatically after 8 hours.
- The solution must not rely on storage account access keys to sign the token.

Which configuration should the administrator use?

  1. A
    An Azure role assignment granting the Reader role at the storage account scope to the partner application's Microsoft Entra ID identity.
  2. B
    A Service SAS configured with read permissions, allowed IP range 192.0.2.0/24, allowed HTTP and HTTPS, and an 8-hour expiration.
  3. A User Delegation SAS configured with read permissions, restricted to HTTPS, allowed IP range 192.0.2.0/24, and an 8-hour expiration.Answer
  4. D
    An Account SAS configured with read permissions, restricted to HTTPS, allowed IP range 192.0.2.0/24, and an 8-hour expiration.

Answer

A User Delegation SAS configured with read permissions, restricted to HTTPS, allowed IP range 192.0.2.0/24, and an 8-hour expiration.
A User Delegation SAS is signed using a user delegation key that is secured by Microsoft Entra ID credentials rather than the storage account access keys, satisfying the security requirement. It also supports granular restrictions such as HTTPS-only, allowed IP ranges, and expiration times to meet least privilege requirements.

Step-by-Step Solution

1
Analyze the access key requirement.
Identify that the solution must not rely on storage account access keys to sign the token, which eliminates the use of Account SAS and Service SAS.
Both Account SAS and Service SAS are signed directly with the storage account access keys (Key1 or Key2).
2
Evaluate the protocol and network requirements.
Confirm that the SAS token must enforce HTTPS-only and restrict client access to the IP range 192.0.2.0/24.
These constraints ensure compliance with network security and transmission policies.
3
Select the correct security credential type.
Choose a User Delegation SAS, which uses Microsoft Entra ID credentials to request a user delegation key to sign the SAS, and configure it with the required IP, protocol, and expiration settings.
This satisfies the requirement to avoid account keys while enforcing all required data-plane constraints.

Key Concept

A User Delegation SAS is secured using Microsoft Entra ID credentials rather than storage account access keys, allowing fine-grained access control with automatic revocation linked to the identity's permissions.
Estimated Time:1m 30s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic