An organization has an Azure Storage account named `medicalrecords2026` containing a blob container named `scans`. An on-premises clinical analysis application needs to upload files directly to the `scans` container. The connection must be secure, restricted to the on-premises public IP address range of , and valid only for hours. You need to create a Shared Access Signature (SAS) that adheres to the principle of least privilege. Which two configurations should you apply to meet the security requirements?
- Generate a Service SAS scoped to the scans container rather than an Account SAS.Answer
- Configure the allowed IP address range to and set the allowed protocol to HTTPS only.Answer
- CAssign the Contributor role at the storage account level to the application.
- DDisable the storage account firewall bypass for trusted Microsoft services.
- EConfigure the SAS token with a validity period of 365 days to prevent token expiration issues.
Answer
To secure the data transmission and apply the principle of least privilege, you must generate a Service SAS scoped to the scans container, and restrict the allowed IP range to 198.51.100.0/24 while enforcing HTTPS only.
Generating a Service SAS is the correct approach to scope permissions specifically to the scans container without exposing other services or resources in the storage account. Restricting the SAS to the public IP subnet and requiring HTTPS ensures that data is transmitted securely and only from the authorized corporate network.
Step-by-Step Solution
Key Concept
Configuring Shared Access Signatures (SAS) with constrained scope, secure network/protocol parameters, and minimum lifetime to enforce least privilege.
Estimated Time:2m 0s