Examkin

Question

Difficulty: EasyShared Access Signatures and Token-based Storage Security

You are developing a client-side application that needs to upload temporary log files to a specific container named 'logs' in an Azure Blob Storage account. You need to generate a Shared Access Signature (SAS) token for the client. The solution must adhere to the principle of least privilege, allow access only from the IP address range 198.51.100.0/24, restrict communication to HTTPS, and expire in 2 hours. Which of the following configurations should you implement?

  1. A
    An Account SAS scoped to the storage account with Read, Write, and List permissions across all services, protocol set to HTTP and HTTPS, and no IP address restrictions.
  2. A Service SAS scoped only to the 'logs' container with Write-only permission, protocol restricted to HTTPS-only, IP address range restricted to 198.51.100.0/24, and a 2-hour expiration time.Answer
  3. C
    A Service SAS scoped to the 'logs' container with Read, Write, and Delete permissions, protocol restricted to HTTPS-only, and a 24-hour expiration time.
  4. D
    An Account SAS scoped to the Blob service with Write and Delete permissions, protocol set to HTTP and HTTPS, and no IP address restrictions.

Answer

A Service SAS scoped only to the 'logs' container with Write-only permission, protocol restricted to HTTPS-only, IP address range restricted to 198.51.100.0/24, and a 2-hour expiration time.
The correct configuration is a Service SAS scoped to the 'logs' container with Write-only permission, HTTPS-only protocol, the specific client IP address range, and a 2-hour expiration time. This ensures that the client has only the necessary access permissions, is constrained to a secure protocol and IP range, and that the token expires as soon as possible.

Step-by-Step Solution

1
Identify the required scope for the SAS token.
The application only needs to write to a specific container ('logs'), so a Service SAS scoped to that container should be used rather than an Account SAS.
A Service SAS delegates access to a resource in a single storage service, enforcing the principle of least privilege.
2
Determine the required permissions for the scenario.
The application only needs to upload log files, which requires Write permission.
Granting Read or Delete permissions would violate the principle of least privilege.
3
Identify the security constraints required.
The protocol must be HTTPS-only, the allowed IP address range must be restricted to 198.51.100.0/24, and the token expiration must be set to 2 hours.
These constraints restrict the protocol, source networks, and temporal validity of the SAS token to minimize the risk of unauthorized access.

Key Concept

Shared Access Signatures (SAS) Principle of Least Privilege
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic