Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to generate a Shared Access Signature (SAS) token to grant an external application access to a blob container. The administrator wants to secure the SAS token by limiting access to a specific network range and ensuring encrypted transit.

Which two settings should the administrator configure directly on the SAS token to meet these requirements?

  1. Allowed IP addressesAnswer
  2. Allowed protocols set to HTTPS onlyAnswer
  3. C
    Storage Blob Data Reader Azure role-based access control (RBAC) role
  4. D
    An expiration time set to five years

Answer

The correct settings to configure on the SAS token are 'Allowed IP addresses' and 'Allowed protocols set to HTTPS only'.
To restrict access to a specific network range, the 'Allowed IP addresses' parameter can be set when generating the SAS token. To ensure encrypted transit, the 'Allowed protocols set to HTTPS only' parameter must be configured. These settings are applied directly to the SAS token to enforce network and protocol security constraints.

Step-by-Step Solution

1
Identify the network restriction requirement.
The administrator must restrict access to a specific network range, which is achieved by specifying the Allowed IP addresses range.
This restricts the SAS token usage to client requests originating from designated IP addresses.
2
Identify the transit encryption requirement.
The administrator must ensure secure, encrypted transport, which is achieved by setting Allowed protocols to HTTPS only.
This prevents the token from being used over unencrypted HTTP connections.

Key Concept

Shared Access Signatures (SAS) allow delegation of access to Azure Storage resources with specific restrictions, such as IP constraints and protocol requirements.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic