Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

Your company has an Azure Storage account named storagecorp2026 that contains a blob container named software-deployments. You need to grant a partner company temporary read access to the software-deployments container for 7 days. The solution must meet the following requirements:
- The partner company must only have access to the software-deployments container.
- You must be able to revoke the access immediately before the 7-day period ends, without affecting other applications or rotating the storage account access keys.

Which two actions should you perform?

  1. Create a stored access policy on the container.Answer
  2. Generate a service SAS that references the stored access policy.Answer
  3. C
    Generate an account SAS that has an expiration of 7 days.
  4. D
    Generate a user delegation SAS that references the stored access policy.
  5. E
    Configure a storage account firewall rule to block access to the container after 7 days.

Answer

Create a stored access policy on the container and generate a service SAS that references the stored access policy.
To grant granular, temporary access that can be revoked immediately without affecting other applications, you must use a service SAS associated with a stored access policy on the container. Modifying or deleting the stored access policy instantly invalidates any service SAS tokens referencing it.

Step-by-Step Solution

1
Create a stored access policy on the target blob container.
A policy is defined at the container level containing permissions and expiration settings.
Stored access policies provide the ability to group parameters and revoke or modify SAS tokens that reference them.
2
Generate a service SAS for the container and associate it with the stored access policy.
A service SAS token is generated that delegates access to the container.
A service SAS supports stored access policies and is scoped to a single resource type (the container), fulfilling the least privilege and revocation requirements.

Key Concept

Using stored access policies with service SAS tokens to enable revocation without rotating account keys.
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic