Examkin

Question

Difficulty: EasyManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to grant an external partner application read-only access to a specific blob container in an Azure storage account for exactly two hours. The access must be restricted to that container only, without granting access to other services in the storage account or requiring Microsoft Entra ID authentication.

Which action should the administrator perform?

  1. Generate a service Shared Access Signature (SAS) for the blob service, scoped to the specific container, with Read permission and an expiration time of two hours.Answer
  2. B
    Assign the Storage Blob Data Reader role to the application's service principal at the storage account scope.
  3. C
    Regenerate the primary storage access key and provide the connection string to the external partner.
  4. D
    Enable the 'Allow trusted Microsoft services' option in the storage account firewall settings.

Answer

Generate a service Shared Access Signature (SAS) for the blob service, scoped to the specific container, with Read permission and an expiration time of two hours.
The correct action is to generate a service Shared Access Signature (SAS) scoped to the container. A service SAS is designed to delegate access to a specific resource (such as a blob container) within a single storage service. Specifying Read permission and an expiration window of two hours ensures the token complies with the principles of least privilege and limited duration, without requiring Microsoft Entra ID authentication.

Step-by-Step Solution

1
Determine the scope and duration required for access.
Access must be limited to a single container, expire in two hours, and not require Microsoft Entra ID.
This establishes that we need a scoped, time-bound credential rather than a broad or permanent key, and eliminates Entra ID RBAC solutions.
2
Choose between account SAS, service SAS, and access keys.
A service SAS is chosen because it can target a specific resource (a blob container) under the blob service.
A service SAS targets only one storage service (Blob service in this case) and can be restricted to a specific container, unlike account SAS which is broader, or access keys which grant full control.
3
Configure the token parameters.
Generate the token with 'Read' permission, start time, and expiry set to two hours from now.
This satisfies the temporal restriction and permission constraints.

Key Concept

Shared Access Signatures (SAS) allow administrators to delegate fine-grained, temporary access to storage account resources with specific permissions and expiration times without exposing the account access keys.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic