Examkin

Question

Difficulty: HardManage Storage Access Keys and Shared Access Signatures (SAS)

A security audit requires an external analytics platform to pull diagnostic reports from a container named `audit-reports` in an Azure Storage account named `corpsecuredatalake`.

The following security policy rules must be enforced:
- The access credentials must be tied to a Microsoft Entra ID security principal to track token generation in activity logs.
- The connection must be restricted to the analytics platform's public IP address of `198.200.150.12`.
- The connection must enforce HTTPS-only traffic.
- The token's validity must not exceed 24 hours.
- The platform must only be permitted to view the list of files and download them.

Which two of the following actions are required to configure and authorize this access?

  1. Grant the security principal used to sign the token the Storage Blob Delegator and Storage Blob Data Reader roles.Answer
  2. Create a User Delegation SAS token with read (r) and list (l) permissions, HTTPS-only protocol, and the allowed IP address of `198.200.150.12`.Answer
  3. C
    Grant the security principal the Storage Operator and Reader roles on the storage account to authorize data-plane access.
  4. D
    Generate a SAS token at the service level using the primary access key of the storage account, configured with a validity period of 10 days.

Answer

To configure and authorize the required access, you must grant the security principal the Storage Blob Delegator and Storage Blob Data Reader roles, and create a User Delegation SAS token with read and list permissions, HTTPS-only protocol, and the allowed IP address.
To satisfy the auditing requirement, the Shared Access Signature must be signed using Microsoft Entra ID credentials, which necessitates a User Delegation SAS. This requires granting the security principal both the Storage Blob Delegator role (to generate the user delegation key) and the Storage Blob Data Reader role (since the client's access is checked against the signing user's active RBAC permissions at the time of the request). The SAS token itself must then be generated with the appropriate constraints including read and list permissions, the allowed public IP, and HTTPS-only protocol.

Step-by-Step Solution

1
Determine the SAS type that supports Microsoft Entra ID user identity tracking.
A User Delegation SAS is selected.
Only a User Delegation SAS is signed using a user delegation key acquired via Microsoft Entra ID, allowing the token creation and data access to be associated with an Entra ID security principal.
2
Assign the necessary Azure RBAC roles to the security principal.
The principal is granted the Storage Blob Delegator and Storage Blob Data Reader roles.
The Storage Blob Delegator role allows the principal to obtain the user delegation key, while the Storage Blob Data Reader role grants the required data-plane permission (read/list) which is evaluated when the SAS is used.
3
Generate the User Delegation SAS token with the specified constraints.
The token is configured with read and list permissions, HTTPS-only protocol, allowed IP range, and a 24-hour expiration.
These constraints ensure compliance with the lease-privilege policy, secure communications, and validity limits.

Key Concept

Authorization and configuration of User Delegation Shared Access Signatures (SAS) using Microsoft Entra ID.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic