Examkin

Question

Difficulty: HardManage Storage Access Keys and Shared Access Signatures (SAS)

An organization needs to grant a third-party application read-only access to a specific private blob container named compliance-records in an Azure Storage account named corpdata104. The access configuration must meet the following requirements:
- Access must be limited to a maximum duration of 4 hours.
- Access must be restricted to the client IP address range 198.51.100.0/24.
- Only HTTPS connections are allowed.
- The security team mandates that storage account access keys must not be used or exposed to sign the token, ensuring all access is tied to and authorized by a specific Microsoft Entra ID identity.

Which configuration should you implement to meet these requirements?

  1. Assign the Storage Blob Delegator and Storage Blob Data Reader roles to the administrator, then generate a User Delegation SAS for the container that specifies the client IP range, HTTPS-only protocol, and a 4-hour expiration.Answer
  2. B
    Assign the Reader and Storage Blob Delegator roles to the administrator, then generate a User Delegation SAS for the container that specifies the client IP range, HTTPS-only protocol, and a 4-hour expiration.
  3. C
    Create a Stored Access Policy on the container, then generate a Service SAS signed with the primary storage account key that specifies the client IP range, HTTPS-only protocol, and a 4-hour expiration.
  4. D
    Generate a Service SAS signed with the primary storage account key, and disable the 'Allow trusted Microsoft services to access this storage account' setting in the storage firewall configuration.

Answer

Assign the Storage Blob Delegator and Storage Blob Data Reader roles to the administrator, then generate a User Delegation SAS for the container that specifies the client IP range, HTTPS-only protocol, and a 4-hour expiration.
To satisfy the security requirement of avoiding storage account access keys and ensuring access is tied to a specific Microsoft Entra ID identity, a User Delegation SAS must be generated. Generating a User Delegation SAS requires a User Delegation Key, which is acquired using Microsoft Entra ID credentials. The administrator generating the token must have the Storage Blob Delegator role to request the key, and the Storage Blob Data Reader role to delegate read permissions to the container. The SAS parameters then enforce the IP address range, HTTPS-only, and 4-hour expiration constraints.

Step-by-Step Solution

1
Determine the required SAS type based on security mandates.
Since the security team prohibits using storage account access keys and requires Microsoft Entra ID identity correlation, a User Delegation SAS must be used.
User Delegation SAS tokens are signed with a User Delegation Key acquired using Microsoft Entra ID credentials.
2
Identify the required control plane roles for key generation.
The identity must be assigned the Storage Blob Delegator role.
Generating a User Delegation Key requires the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action permission, which is included in the Storage Blob Delegator role.
3
Identify the required data plane roles for object access.
The identity must be assigned the Storage Blob Data Reader role at the container or storage account scope.
To delegate read permissions to a client, the generating identity must possess those data plane read permissions itself.
4
Apply token-level constraints during generation.
Generate the SAS token with the IP range set to 198.51.100.0/24, protocol set to HTTPS-only, and validity duration set to 4 hours.
These parameters restrict the execution environment of the SAS to satisfy the remaining security rules.

Key Concept

Generating a User Delegation SAS requires combining control plane delegation permissions (Storage Blob Delegator) with data plane access permissions (Storage Blob Data Reader) to authorize access via Microsoft Entra ID credentials instead of account keys.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic