Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to configure temporary access for a partner application to download blobs from a container named incoming-transfers in an Azure Storage account named partnerdataretrieval. The access configuration must meet the following security requirements:
- The partner application must only connect from the public IP address 198.51.100.55.
- The connection must be restricted to HTTPS.
- Access must automatically expire after 8 hours.
- The administrator must be able to revoke this access immediately before the 8-hour period expires without affecting other active SAS tokens or rotating the storage account access keys.

Which two actions should the administrator perform to meet these requirements?

  1. Create a stored access policy on the incoming-transfers container.Answer
  2. Generate a Service SAS for the container that references the stored access policy, specifying the allowed IP address and requiring HTTPS.Answer
  3. C
    Assign the Reader Azure RBAC role to the partner application at the resource group level.
  4. D
    Generate an Account SAS that specifies the allowed IP address, HTTPS protocol, and expiration time.

Answer

Create a stored access policy on the container and generate a Service SAS for the container that references the stored access policy while specifying the allowed IP address and requiring HTTPS.
To support immediate revocation of the Shared Access Signature (SAS) without affecting other tokens, you must associate the SAS with a stored access policy on the container. A Service SAS supports association with stored access policies, allowing revocation by simply deleting or modifying the policy. The specific constraints for the client IP address and HTTPS protocol are specified when generating the SAS token.

Step-by-Step Solution

1
Determine the type of SAS required for immediate revocation without key rotation.
Identify that a Service SAS is required because it supports stored access policies, whereas an Account SAS does not.
Stored access policies allow immediate revocation by deleting or changing the policy, which meets the security requirement.
2
Create the stored access policy on the target container.
A stored access policy is created directly on the incoming-transfers container.
Stored access policies are defined at the container or resource level, not at the storage account level.
3
Generate the Service SAS token referencing the policy and applying network/protocol constraints.
The Service SAS is generated with the client IP address restricted to 198.51.100.55 and protocol restricted to HTTPS.
Constraints like allowed IP addresses and protocols must be defined on the SAS token itself during generation.

Key Concept

Manage Storage Access Keys and Shared Access Signatures (SAS)
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic