Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to grant a temporary contractor read-only access to a specific blob container in an Azure storage account. The contractor requires access for exactly two hours. To follow the principle of least privilege, which action should the administrator take?

  1. Generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours.Answer
  2. B
    Generate an account-level Shared Access Signature (SAS) with no expiration time to ensure the contractor has continuous access.
  3. C
    Assign the Storage Account Contributor Azure Role-Based Access Control (RBAC) role to the contractor's Microsoft Entra ID account.
  4. D
    Configure the storage firewall to allow trusted Microsoft services to bypass network restrictions for the contractor.

Answer

Generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours.
The correct action is to generate a service Shared Access Signature (SAS) for the blob container and set its expiration time to two hours. A service SAS restricts access to a specific resource (the blob container), and the two-hour expiration ensures that access is revoked automatically when no longer needed, following the principle of least privilege.

Step-by-Step Solution

1
Determine the resource scope required for access.
The contractor only needs access to a specific blob container, indicating a service-level SAS is appropriate rather than an account-level SAS or broad RBAC roles.
Restricting access to the specific resource minimizes security exposure.
2
Determine the required access duration.
The contractor needs access for two hours, so the SAS token expiration must be set to exactly two hours.
Setting an expiration time limits the lifetime of the delegated credentials, reducing the risk of abuse if the token is compromised.
3
Select the correct credential mechanism.
A service SAS with read permissions and a two-hour expiration window satisfies all constraints.
It fulfills the access requirement without exposing administrative keys or over-provisioning permissions.

Key Concept

Using service Shared Access Signatures (SAS) with minimum scope and short-lived expiration to implement the principle of least privilege.
Estimated Time:45s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic