Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

You are configuring a web application hosted on an Azure Virtual Machine to upload user profile images to a blob container named `profile-images` in an Azure Storage account named `webappassets2026`.

The application has the following requirements:
* Access must be limited exclusively to the `profile-images` container.
* Access must be restricted to HTTPS connections originating from the virtual machine's public IP address (`198.51.100.12`).
* Access credentials must automatically expire after 8 hours.
* The storage account access keys must not be used or exposed to sign the token.

Which configuration should you implement to meet the requirements under the principle of least privilege?

  1. Generate a User Delegation SAS scoped to the profile-images container by using a security principal assigned the Storage Blob Data Delegator role, restricted to HTTPS and the IP address 198.51.100.12.Answer
  2. B
    Generate a Service SAS scoped to the profile-images container signed with the storage account access key, restricted to HTTPS and the IP address 198.51.100.12.
  3. C
    Generate an Account SAS scoped to the Blob service signed with the storage account access key, with a validity period of 30 days, restricted to HTTPS.
  4. D
    Assign the virtual machine's managed identity the Storage Blob Data Contributor role, disable public access on the storage account firewall, and enable the 'Allow trusted Microsoft services to access this storage account' bypass.

Answer

Generate a User Delegation SAS scoped to the profile-images container by using a security principal assigned the Storage Blob Data Delegator role, restricted to HTTPS and the IP address 198.51.100.12.
A User Delegation SAS is the only option that satisfies the requirement to avoid using or exposing the storage account access keys, as it is signed with a user delegation key acquired via Microsoft Entra ID authentication. To generate this key, the security principal requires the Storage Blob Data Delegator role. Scoping the SAS token to the container level with HTTPS-only and IP address constraints enforces the principle of least privilege.

Step-by-Step Solution

1
Identify the authentication method that avoids using storage account access keys.
Determine that a User Delegation SAS must be used, which is signed by a user delegation key obtained using Microsoft Entra ID credentials.
This avoids exposing or using the storage account access keys, satisfying the organization's security policy.
2
Identify the required RBAC role to generate a User Delegation SAS.
Determine that the security principal generating the SAS must be assigned the Storage Blob Data Delegator role.
The Storage Blob Data Delegator role contains the control plane permission (Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action) required to obtain the delegation key.
3
Apply the requested scope and network/protocol constraints to the SAS token.
Configure the SAS to target only the 'profile-images' container, restrict the protocol to HTTPS-only, and limit the allowed IP addresses to the virtual machine's public IP (198.51.100.12) with an 8-hour expiration.
This satisfies the remaining least-privilege requirements for scope, transit encryption, IP filtering, and duration.

Key Concept

User Delegation SAS and RBAC
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic