Examkin

Question

Difficulty: MediumManage Properties, Metadata, and Access Tiers for Azure Blob Storage

You are designing a C# backend service to update a custom metadata tag on a blob in Azure Blob Storage. The target blob is currently protected by an active write lease. The operation must be authenticated using a Shared Access Signature (SAS) token adhering to the principle of least privilege, and the updated metadata value must be verified immediately after. Which C# code segment should you use to successfully perform this operation?

  1. var sas = new BlobSasBuilder { ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(15) };
    sas.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
    var client = new BlobClient(blobUri, sas.ToSasQueryParameters(credential));
    await client.SetMetadataAsync(new Dictionary<string, string> { { "Department", "Finance" } }, new BlobRequestConditions { LeaseId = leaseId });
    var dept = (await client.GetPropertiesAsync()).Value.Metadata["department"];    Answer
  2. B
    var sas = new BlobSasBuilder { ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(15) };
    sas.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
    var client = new BlobClient(blobUri, sas.ToSasQueryParameters(credential));
    await client.SetMetadataAsync(new Dictionary<string, string> { { "Department", "Finance" } });
    var dept = (await client.GetPropertiesAsync()).Value.Metadata["department"];
  3. C
    var sas = new BlobSasBuilder { ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(15) };
    sas.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
    var client = new BlobClient(blobUri, sas.ToSasQueryParameters(credential));
    await client.SetMetadataAsync(new Dictionary<string, string> { { "Department", "Finance" } }, new BlobRequestConditions { LeaseId = leaseId });
    var dept = (await client.GetPropertiesAsync()).Value.Metadata["Department"];
  4. D
    var sas = new BlobSasBuilder { ExpiresOn = DateTimeOffset.UtcNow.AddDays(30) };
    sas.SetPermissions(BlobSasPermissions.All);
    var client = new BlobClient(blobUri, sas.ToSasQueryParameters(credential));
    await client.SetMetadataAsync(new Dictionary<string, string> { { "Department", "Finance" } }, new BlobRequestConditions { LeaseId = leaseId });
    var dept = (await client.GetPropertiesAsync()).Value.Metadata["department"];

Answer

The C# code segment that configures a SAS token with 15 minutes expiration and Read/Write permissions, includes the active Lease ID in the request conditions when calling SetMetadataAsync, and retrieves the metadata value using the lowercase key "department".
The correct implementation creates a SAS token with the minimum required permissions (Read and Write) and a short duration (15 minutes). When calling SetMetadataAsync, the active lease ID must be passed via the BlobRequestConditions parameter to prevent a lease-conflict failure. Finally, because Azure Blob Storage stores and returns metadata keys in lowercase, retrieving the value requires querying the Metadata dictionary with the lowercase key 'department'.

Step-by-Step Solution

1
Configure a SAS token with the minimum required permissions.
A SAS token is built with only Read and Write permissions, expiring in 15 minutes to follow least-privilege principles.
The client must write metadata and read it back, meaning both Read and Write permissions are required, while longer expiries or extra permissions like Delete must be avoided.
2
Call SetMetadataAsync with the active Lease ID.
The metadata dictionary is updated on the Azure Storage service successfully.
Since the blob has an active write lease, any attempt to modify its properties or metadata without passing the active Lease ID in the BlobRequestConditions object will fail with a 412 Precondition Failed status code.
3
Retrieve the metadata properties using a lowercase lookup key.
The string 'Finance' is correctly returned without throwing a KeyNotFoundException.
Azure Blob Storage converts all custom metadata keys to lowercase upon storage. Even if they are uploaded with uppercase characters, they must be accessed via lowercase keys when retrieving them from the SDK metadata dictionary.

Key Concept

Managing Blob Metadata, Lease Handling, and SAS Authorization in C#
Estimated Time:1m 30s
Rate this question

Topics

Manage Properties, Metadata, and Access Tiers for Azure Blob Storage

More questions from this topic