Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

Your company has an Azure Storage account named corpstorage2026 that contains a blob container named uploads. The storage account network firewall is enabled. You need to grant a partner application access to upload blobs to the uploads container. The access configuration must meet the following security requirements:
- The partner application must only be allowed to access the uploads container.
- The partner application must only connect from the public IP address 198.51.100.45 over HTTPS.
- The authorization credentials must automatically expire after 4 days.
- The token must be signed using Microsoft Entra ID credentials instead of the storage account access keys.

Which of the following actions should you perform?

  1. Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 4 days.Answer
  2. B
    Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 10 days.
  3. C
    Assign the partner application's service principal the Contributor role on the storage account to authorize the direct upload of blobs, and avoid generating a SAS token.
  4. D
    Generate a Service SAS for the uploads container with an expiration of 4 days, and enable the 'Allow trusted Microsoft services to access this storage account' firewall exception to permit the partner application's connection.

Answer

Generate a User Delegation SAS for the uploads container, configured with Write permissions, HTTPS-only protocol, the allowed IP address 198.51.100.45, and an expiration of 4 days.
A User Delegation SAS meets the requirement to sign access using Microsoft Entra ID credentials instead of storage account keys. Because the validity period of 4 days is within the maximum 7-day threshold for a user delegation key, this SAS is valid. The token is correctly scoped at the container level and enforces the HTTPS-only protocol and the client IP address restriction.

Step-by-Step Solution

1
Determine the SAS signing mechanism.
Since the security requirement states that the token must be signed using Microsoft Entra ID credentials instead of the storage account access keys, a User Delegation SAS must be used rather than a Service SAS or Account SAS.
User Delegation SAS is the only SAS type that is signed using a user delegation key acquired with Microsoft Entra ID credentials.
2
Evaluate the validity duration constraint.
The validity duration must be 4 days, which is less than the maximum limit of 7 days.
A User Delegation SAS key is valid for a maximum of 7 days; a 10-day request would be rejected.
3
Verify scope, protocol, and network restrictions.
Scope the SAS to the uploads container, set allowed protocol to HTTPS, set allowed IP to 198.51.100.45, and set permissions to Write.
This configuration satisfies the container-level scope, protocol, and IP filtering restrictions while granting the minimum required permissions.

Key Concept

Selecting and configuring a User Delegation SAS to enforce least privilege access, protocol restrictions, IP filters, and validity duration limits.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic