Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

You have an Azure Storage account named `datashareeast` that contains a blob container named `reports`.

You need to grant an external partner read-only access to the `reports` container. The access must meet the following requirements:
- Allow access only from the IP address range 203.0.113.0/24203.0.113.0/24.
- Allow access only via HTTPS.
- Expire in 1414 days.
- Support the ability to immediately revoke access to the partner without rotating the storage account access keys or impacting other active SAS tokens.

Which configuration should you use?

  1. A service SAS associated with a stored access policy on the containerAnswer
  2. B
    An account SAS signed with the storage account access key
  3. C
    A user delegation SAS signed with Microsoft Entra ID credentials
  4. D
    A service SAS signed with the storage account access key directly on the container

Answer

A service SAS associated with a stored access policy on the container
The correct option is a service SAS associated with a stored access policy on the container. A service SAS delegates access to a resource in just one of the storage services, such as Blob storage. By associating the service SAS with a stored access policy on the container, you can revoke the SAS token immediately by modifying or deleting the policy, without having to rotate the storage account access keys or impacting other active SAS tokens.

Step-by-Step Solution

1
Analyze the scope of the required access.
Access is needed for a single container ('reports'), which can be accomplished using either a service SAS or a user delegation SAS. An account SAS has a broader scope (account-level) but is not required here.
Least privilege principles dictate targeting the narrowest scope possible.
2
Evaluate the revocation requirement.
The SAS must be immediately revocable without rotating storage account keys or affecting other SAS tokens. Only a service SAS associated with a Stored Access Policy (SAP) on the container supports this capability.
Stored access policies allow changing constraints or deleting the policy to invalidate associated SAS tokens instantly.
3
Verify IP and protocol constraints configuration.
The service SAS and stored access policy support specifying allowed IP ranges (203.0.113.0/24203.0.113.0/24) and HTTPS-only protocols.
These constraints must be embedded in the SAS token definition to enforce the security requirements.

Key Concept

Shared Access Signature (SAS) types and revocation mechanisms using Stored Access Policies
Estimated Time:1m 30s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic