Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

You are developing a secure backend service in C# using the Azure.Storage.Blobs SDK (v12) to grant temporary access for clients to upload diagnostic files to a private Azure Blob Storage container.

Your company enforces the following security requirements:
- Storage account access keys must not be used or loaded by the application; access must be authenticated via Microsoft Entra ID.
- Clients must only be permitted to write new files; they must not be allowed to read, list, or delete existing files.
- All client connections must be encrypted using HTTPS.
- The SAS token must be valid immediately upon generation, accounting for potential clock synchronization differences between the server and clients.

You write the following code segment:

csharp
// blobServiceClient is an authenticated BlobServiceClient using DefaultAzureCredential
var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(
DateTimeOffset.UtcNow.AddMinutes(-15),
DateTimeOffset.UtcNow.AddHours(2)
);

var sasBuilder = new BlobSasBuilder
{
BlobContainerName = "diagnostics",
BlobName = "log.txt",
Resource = "b"
};

Which code segment should you use to complete the SAS configuration and token generation?

  1. A
    sasBuilder.StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15);
    sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
    sasBuilder.Protocol = SasProtocol.HttpsAndHttp;
    sasBuilder.SetPermissions(BlobSasPermissions.Write);

    string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();
  2. sasBuilder.StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15);
    sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
    sasBuilder.Protocol = SasProtocol.Https;
    sasBuilder.SetPermissions(BlobSasPermissions.Write);

    string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();    Answer
  3. C
    sasBuilder.StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15);
    sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
    sasBuilder.Protocol = SasProtocol.Https;
    sasBuilder.SetPermissions(BlobSasPermissions.Write);

    var credential = new StorageSharedKeyCredential(blobServiceClient.AccountName, "accountKey");
    string sasToken = sasBuilder.ToSasQueryParameters(credential).ToString();
  4. D
    sasBuilder.StartsOn = DateTimeOffset.UtcNow;
    sasBuilder.ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(45);
    sasBuilder.Protocol = SasProtocol.Https;
    sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);

    string sasToken = sasBuilder.ToSasQueryParameters(userDelegationKey, blobServiceClient.AccountName).ToString();

Answer

The correct code segment configures the SAS token for HTTPS only, grants Write permission, adjusts the start time backwards to account for clock skew, and uses the User Delegation Key signed with Microsoft Entra ID to generate the query parameters.
The correct segment sets the protocol strictly to HTTPS, restricts access to write-only permissions, applies a negative offset to the start time to mitigate clock skew, and signs the token with the User Delegation Key to satisfy the Microsoft Entra ID requirement.

Step-by-Step Solution

1
Ensure keyless authentication using Microsoft Entra ID.
Obtained a UserDelegationKey using GetUserDelegationKeyAsync, and signed the SAS parameters using ToSasQueryParameters with the delegation key and the account name instead of StorageSharedKeyCredential.
Security policy forbids storing or utilizing storage account access keys in application code.
2
Configure the SAS permissions and protocols.
Set permissions strictly to BlobSasPermissions.Write and protocol to SasProtocol.Https.
Least-privilege policy mandates write-only access, and data in transit must be encrypted using HTTPS.
3
Adjust token lifetime constraints for clock skew.
Set StartsOn to 15 minutes in the past.
Prevents immediate authorization failures if the client clock is slightly ahead of the Azure Storage server clock.

Key Concept

Generating a User Delegation SAS token using Azure.Storage.Blobs .NET SDK with security configurations.
Estimated Time:1m 30s
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic