Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

You are configuring access to a blob container named `telemetry-upload` in an Azure Storage account named `iotmetrics2026` for a third-party application. The application requires permissions to upload files to the container under the following constraints:
- Access must be limited solely to the `telemetry-upload` container.
- The token must become invalid after 8 hours.
- Requests must be accepted only from the public IP address 198.51.100.88198.51.100.88.
- You must have the ability to invalidate the token immediately if a leak occurs, without rotating the storage account's primary or secondary keys or impacting other applications.

Which two actions should you perform to meet these requirements? (Select two.)

  1. Create a stored access policy on the telemetry-upload container.Answer
  2. Generate a service SAS for the container that references the stored access policy and specifies the allowed IP address.Answer
  3. C
    Generate an account SAS that specifies container permissions, the allowed IP address, and an 8-hour expiration.
  4. D
    Assign the Storage Blob Data Contributor role to the application's service principal and enable the storage firewall to allow the IP address.

Answer

To meet the requirements, you must create a stored access policy on the target container and generate a service SAS that references this policy while specifying the allowed client IP address.
To fulfill the requirements of container-specific scope, IP restriction, and immediate revocation without affecting other tokens or rotating storage keys, you must use a service SAS associated with a stored access policy. Creating a stored access policy on the container provides a central management point for the token's lifetime and permissions. When you generate a service SAS that references this policy and includes the client's public IP address, the token inherits the constraints. If the token is compromised, deleting or modifying the stored access policy immediately invalidates the SAS without impacting storage keys or other independent SAS tokens.

Step-by-Step Solution

1
Create a stored access policy on the container level.
A stored access policy is established on the telemetry-upload container, specifying the write permissions and the 8-hour expiration timeline.
Stored access policies provide the ability to group constraints and revoke service SAS tokens immediately by deleting or altering the policy.
2
Generate a service SAS that references the policy and includes the client IP restriction.
A service SAS token is generated, bound to the stored access policy, and restricted to the client's public IP address.
The service SAS targets only the specific container (least privilege) and inherits the policy's lifetime, allowing revocation while enforcing IP-level security.

Key Concept

Using Stored Access Policies with Service SAS to enable revocation without rotating storage keys.
Estimated Time:2m 0s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic