Examkin

Question

Difficulty: HardManage Storage Access Keys and Shared Access Signatures (SAS)

You manage an Azure Storage account named storagedata. An external partner application requires temporary access to read and write blobs in a container named incoming. You must generate a Shared Access Signature (SAS) that meets the following security requirements:

- The access token must be immediately revoked if the primary storage access key (key1) is rotated.
- The access token must remain valid if the secondary storage access key (key2) is rotated.
- The partner application must only be allowed to connect from the public IP address 192.0.2.55192.0.2.55.

In the Azure portal, you set the allowed protocols to HTTPS only. Which two configurations should you select to generate the SAS? (Select two.)

  1. Signing key set to Key 1Answer
  2. B
    Signing key set to Key 2
  3. Allowed IP addresses set to 192.0.2.55192.0.2.55Answer
  4. D
    Assign the Storage Blob Data Contributor role to the partner application

Answer

Select Key 1 as the signing key and set the allowed IP addresses to the specific IP address 192.0.2.55192.0.2.55.
The correct configurations are setting the signing key to Key 1 and setting the allowed IP addresses to the single IP address 192.0.2.55192.0.2.55. Setting the signing key to Key 1 ensures that the SAS is invalidated when Key 1 is rotated but remains valid if Key 2 is rotated. Restricting the allowed IP addresses to the specific IP address limits access to only the partner application.

Step-by-Step Solution

1
Determine the correct signing key that binds the SAS token's lifetime to Key 1.
Select Key 1 as the signing key.
A Service or Account SAS is signed using one of the storage account keys. Rotating the key used to sign the SAS immediately invalidates it.
2
Configure the IP access restriction to match the partner's single IP address.
Set the Allowed IP addresses field to 192.0.2.55192.0.2.55.
Specifying the exact IP address ensures that only traffic originating from that IP can access the container using the SAS token, adhering to the least privilege principle.

Key Concept

Shared Access Signature (SAS) token configuration, key rotation binding, and network access restrictions.
Estimated Time:2m 0s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic