Examkin

Question

Difficulty: Very hardManage Storage Access Keys and Shared Access Signatures (SAS)

An organization has an Azure Storage account named corpstorage that contains a blob container named auditlogs. The storage account network firewall is enabled and configured to allow access only from selected networks.

An external auditing application, running on an on-premises server with the public IP address 198.51.100.45, requires read-only access to the auditlogs container for a period of 90 days. The external application does not support Microsoft Entra ID authentication.

You need to configure access for the auditing application to meet the following requirements:
1. The application must only be allowed to access blobs within the auditlogs container.
2. Access must be limited to HTTPS traffic originating from the server's public IP address.
3. You must be able to revoke the access token immediately at any time during the 90-day period without affecting other clients or rotating the storage account access keys.
4. The configuration must follow the principle of least privilege.

Which configuration should you implement?

  1. A
    Generate a Service SAS directly on the auditlogs container with an expiration of 90 days, specifying HTTPS-only and the allowed IP address 198.51.100.45. Add 198.51.100.45 to the firewall rules of the storage account.
  2. B
    Generate an Account SAS for the storage account with read permissions, setting the validity to 90 days, specifying HTTPS-only and the allowed IP address 198.51.100.45. Enable 'Allow trusted Microsoft services to access this storage account' in the storage account firewall settings.
  3. Create a stored access policy on the auditlogs container. Generate a Service SAS for the container that references this policy, specifying HTTPS-only and the allowed IP address 198.51.100.45. Add 198.51.100.45 to the firewall rules of the storage account.Answer
  4. D
    Assign the Storage Blob Data Reader role to the auditing application's identity at the storage account scope. Enable 'Allow trusted Microsoft services to access this storage account' in the storage account firewall settings, and generate a User Delegation SAS.

Answer

Create a stored access policy on the auditlogs container, generate a Service SAS for the container referencing this policy with HTTPS-only and the allowed IP address set to 198.51.100.45, and add the server's IP address to the storage account firewall rules.
The correct configuration is to create a stored access policy on the specific container (auditlogs) and reference it in a Service SAS. A stored access policy allows the administrator to revoke the SAS immediately by deleting or modifying the policy, satisfying the revocation requirement without rotating the account access keys. Restricting the SAS parameters to HTTPS-only and the allowed IP (198.51.100.45), combined with adding the IP address to the storage account firewall rules, satisfies the network and transport layer security requirements while adhering to the principle of least privilege.

Step-by-Step Solution

1
Create a stored access policy on the auditlogs container.
A policy is defined at the container level, which can control permissions and expiry, and can be modified or deleted to instantly revoke access.
Stored access policies allow granular revocation of Service SAS tokens without rotating storage account keys.
2
Generate a Service SAS for the container that references the stored access policy.
A SAS token is generated that inherits its permissions and lifecycle from the policy and is restricted only to the auditlogs container.
A Service SAS is required to restrict access to a specific container and to support the stored access policy. User Delegation SAS cannot be used because the client does not support Entra ID authentication, and Account SAS does not support stored access policies.
3
Apply the HTTPS-only protocol constraint and restrict the allowed IP address range to 198.51.100.45 in the SAS token parameters.
The SAS token enforces security constraints at the token level, rejecting HTTP requests or requests from unauthorized IPs.
This satisfies the security requirement to restrict transit protocol and source IP at the authentication layer.
4
Add the public IP address 198.51.100.45 to the storage account firewall rules.
The network-level firewall allows traffic from the external server to reach the storage endpoint.
A SAS token with IP restrictions cannot bypass the storage network firewall; the firewall must be configured to allow the client's public IP address explicitly.

Key Concept

Stored Access Policies and Service SAS Revocation
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic