Examkin

Question

Difficulty: HardManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator needs to configure temporary access to a blob container named invoices within an Azure Storage account named corpfinance2026. The configuration must satisfy the following security requirements:

- Prevent exposure of the storage account's primary and secondary access keys.
- Authenticate the client using a Microsoft Entra ID security principal.
- Limit the validity of the temporary access to exactly two hours.
- Enforce the use of the HTTPS protocol only.

Which two actions should the administrator perform to meet these requirements? (Select two.)

  1. Assign the Storage Blob Delegator role at the storage account level to the security principal generating the SAS.Answer
  2. Generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.Answer
  3. C
    Generate an Account SAS signed with the storage account access key and restrict the permissions to the container level.
  4. D
    Assign the Reader role at the storage account level to the security principal generating the SAS.
  5. E
    Configure the SAS token with a validity period of 10 days to allow for client retries.

Answer

Assign the Storage Blob Delegator role to the security principal generating the SAS at the storage account level, and generate a User Delegation SAS token using the Microsoft Entra ID credentials of the authorized security principal.
To secure access without exposing account access keys and to authenticate via Microsoft Entra ID, a User Delegation SAS should be generated. To generate a User Delegation SAS, the identity requesting the user delegation key must be assigned the Storage Blob Delegator role at the storage account scope.

Step-by-Step Solution

1
Identify the mechanism to prevent storage account key exposure.
Determine that a User Delegation SAS must be used, which is secured using Microsoft Entra ID credentials instead of storage account access keys.
User Delegation SAS relies on a user delegation key obtained via Microsoft Entra ID credentials, keeping access keys hidden.
2
Determine the RBAC roles required to generate the delegation key.
Select the Storage Blob Delegator role for the generating principal.
Generating a User Delegation SAS requires the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is granted by the Storage Blob Delegator role.
3
Validate the expiration and protocol constraints.
Configure the SAS with a 2-hour duration and HTTPS-only protocol.
This satisfies the security requirements and fits within the 7-day maximum lifespan of a user delegation key.

Key Concept

User Delegation SAS and the required RBAC roles for generation.
Estimated Time:2m 0s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic