An administrator needs to configure temporary access for an external application to upload… — Microsoft Azure Administrator (AZ-104)

An administrator needs to configure temporary access for an external application to upload and read blobs in a container named incoming in an Azure Storage account named corpstore2026. The configuration must meet the following security and access requirements:
- The external application must only be allowed to read and write blobs in the incoming container.
- The external application's access must be restricted to the IP range $198.51.100.0/24$ .
- The access token must remain valid for a maximum of $48$ hours.
- Access must not be interrupted when the storage account access keys ( $key1$ and $key2$ ) are rotated.
- The administrator must adhere to the principle of least privilege for their own administrative account when generating the SAS.

Which two actions should the administrator perform? (Select two.)

Assign the Storage Blob Data Delegator role to the administrator's Microsoft Entra ID account.Answer
Generate a User Delegation SAS scoped to the container level.Answer
C
Assign the Storage Account Contributor role to the administrator's Microsoft Entra ID account.
D
Generate an Account SAS signed with the storage account access keys.
E
Generate a Service SAS and set the validity duration of the token to $7$ days.

Answer

To meet the requirements, the administrator must assign the Storage Blob Data Delegator role to their account and generate a User Delegation SAS scoped to the container.

Using a User Delegation SAS satisfies the requirement to maintain access during storage account key rotation, as it is signed using Microsoft Entra ID credentials rather than the storage account keys. The Storage Blob Data Delegator role is the least-privilege role that grants the administrative account the ability to generate the user delegation key.

Step-by-Step Solution

Identify the correct Shared Access Signature (SAS) type to prevent access disruption during storage account key rotation.

Determine that a User Delegation SAS must be used because it is signed using Microsoft Entra ID credentials and is independent of the storage account access keys.

Rotating storage account access keys (

key1

and

key2

) immediately invalidates any Service or Account SAS tokens that were signed with those keys.

Identify the minimum required RBAC role for the administrator's account to generate the user delegation key.

Assign the Storage Blob Data Delegator role to the administrator's Microsoft Entra ID account.

To create a User Delegation SAS, the administrator must request a user delegation key. The Storage Blob Data Delegator role provides the minimum control plane permission for this action without granting data plane read or write permissions to the data itself.

Configure the SAS parameters to restrict access based on the specified security constraints.

Generate the SAS token at the container level (incoming) with an expiration time of less than

48

hours, HTTPS-only protocol, and the allowed IP range set to

198.51.100.0/24

This configuration enforces the least privilege principle and respects the strict connectivity and validity duration limits specified in the scenario.

Key Concept

User Delegation SAS allows securing storage access using Microsoft Entra ID credentials, offering independence from account key rotation and requiring specific data-plane RBAC delegation permissions.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic