Examkin

Question

Difficulty: MediumManage Storage Access Keys and Shared Access Signatures (SAS)

A company needs to grant a partner application temporary read-only access to a specific queue named incoming-orders in an Azure Storage account. The access configuration must meet the following security requirements:
- The partner application must only be able to read messages from the incoming-orders queue.
- Access must be restricted to the partner's IP address range of 198.51.100.0/24.
- The access credentials must automatically expire after 24 hours.
- Access to all other queues, blob containers, and tables in the storage account must be prevented.
- The connection protocol must be restricted to HTTPS.
Which configuration should you use to meet these requirements with the least privilege?

  1. A
    Generate an Account SAS for the Queue service, specifying the read permission, HTTPS only, and no expiration time.
  2. B
    Assign the partner application's service principal the Storage Queue Data Reader role at the storage account scope and generate a User Delegation SAS.
  3. Generate a Service SAS for the incoming-orders queue, specifying the read permission, the IP address range 198.51.100.0/24, HTTPS only, and a 24-hour expiration.Answer
  4. D
    Generate a Service SAS for the queue, disable the storage account firewall bypass for trusted Microsoft services, and allow public access from any network.

Answer

Generate a Service SAS for the incoming-orders queue, specifying the read permission, the IP address range 198.51.100.0/24, HTTPS only, and a 24-hour expiration.
Generating a Service SAS for the queue is the correct approach because it delegates access to a specific resource (the incoming-orders queue) rather than all queues in the storage account. It natively supports all requested security constraints, including the read-only permission, client IP address range restriction (198.51.100.0/24), HTTPS-only protocol, and a 24-hour expiration duration.

Step-by-Step Solution

1
Determine the required Shared Access Signature (SAS) type based on the resource scope.
Since access is needed for a single queue ('incoming-orders') rather than all queues in the storage account, a Service SAS must be used instead of an Account SAS to adhere to the principle of least privilege.
A Service SAS targets a specific resource (such as a single container, blob, queue, or table), whereas an Account SAS delegates access at the service level (e.g., all queues or blobs).
2
Evaluate identity and authentication type requirements.
A User Delegation SAS is ruled out because it is only supported for Blob storage and Azure Data Lake Storage Gen2, not for Queue storage.
User Delegation SAS requires Microsoft Entra ID credentials and is structurally limited to Blob service resources.
3
Apply the requested security constraints to the Service SAS configuration.
Configure the Service SAS with read permissions, HTTPS-only protocol, the client IP range '198.51.100.0/24', and a validity duration of 24 hours.
This enforces the required network, protocol, and temporal constraints directly on the token.

Key Concept

Selecting the least-privilege SAS type (Service SAS vs. Account SAS) and applying security constraints (IP range, HTTPS, expiration) for non-blob storage resources.
Estimated Time:1m 30s
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic