Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to configure a Shared Access Signature (SAS) to grant a developer temporary access to upload logs to an Azure storage account. The configuration must follow the principle of least privilege and enforce security best practices. Which two settings should the administrator configure directly on the SAS token to minimize security risks?

  1. An expiration time set to a short duration, such as 2 hoursAnswer
  2. A restricted IP address or IP range from which the developer is allowed to connectAnswer
  3. C
    An expiration time set to 365 days to ensure uninterrupted access for the developer
  4. D
    The Storage Blob Data Contributor role assigned directly to the SAS token
  5. E
    The 'Allow trusted Microsoft services' exception setting

Answer

The correct options are configuring an expiration time set to a short duration, such as 2 hours, and a restricted IP address or IP range from which the developer is allowed to connect.
Enforcing a short validity window (such as 2 hours) and limiting access to a specific public IP range are standard security configurations directly supported in the Shared Access Signature parameters. These restrict both the temporal and network bounds of the delegation.

Step-by-Step Solution

1
Determine how to limit the validity duration of the temporary access token.
Define a short expiration window (e.g., 2 hours) to minimize the risk window if the token is leaked.
Security best practices dictate that temporary access signatures must have a short, defined lifespan to prevent persistent unauthorized access.
2
Determine how to enforce network-level restrictions on the token request origin.
Specify the client IP address or CIDR range in the SAS parameters.
Restricting allowed IP addresses prevents the token from being used from unauthorized networks even if it is intercepted.

Key Concept

Applying the principle of least privilege to Shared Access Signatures (SAS) by restricting duration and network origin.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic