Examkin

Question

Difficulty: EasyShared Access Signatures and Token-based Storage Security

You are developing a web application that retrieves reports from Azure Blob Storage. You need to generate a Service Shared Access Signature (SAS) token to allow an external partner to download a specific report file. To meet security guidelines, you must restrict access to a specific client IP address and enforce the use of HTTPS. Which two configurations must you define in the SAS token to meet these requirements? (Select TWO.)

  1. An IP address filter restricting access to the partner's public IP addressAnswer
  2. An HTTPS-only protocol restrictionAnswer
  3. C
    Full write and delete permissions on the entire storage container
  4. D
    The storage account's root credentials embedded directly within the SAS payload

Answer

The correct options are the IP address filter restricting access to the partner's public IP address, and the HTTPS-only protocol restriction.
The correct configurations are the IP address filter and the HTTPS-only protocol restriction. An IP address filter limits the client source IP, and the protocol parameter ensures secure transit over HTTPS.

Step-by-Step Solution

1
Analyze the security requirements specified in the scenario.
The requirements are: download a specific report file (Read access), restrict access to a specific client IP address, and enforce HTTPS.
This establishes the constraints needed to select the correct configurations.
2
Determine the SAS configurations that implement IP filtering and protocol enforcement.
Defining the allowed IP address or range limits source access, and setting the protocol parameter to HTTPS only secures transit.
These parameters directly correspond to standard Azure Storage SAS token properties.
3
Evaluate the incorrect options against security best practices.
Granting full container-level write/delete permissions violates least-privilege, and embedding root credentials compromises account security.
This rules out the distractors.

Key Concept

Configuring security constraints on Azure Storage Shared Access Signatures (SAS) to enforce least privilege, specific IP access, and secure protocols.
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic