Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

You are designing a secure backend service that provides external audit applications with temporary access to read audit logs stored in a specific Azure Blob Storage container. You decide to generate a Shared Access Signature (SAS) token.

The solution must meet the following security requirements:
- Minimize the risk of compromising the storage account's root access keys.
- Prevent the external application from listing other blobs or deleting logs.
- Enforce secure transmission protocols.
- Restrict access to a specific external IP range: 198.51.100.0/24.

Which two of the following configuration options should you implement to meet the requirements?

  1. Generate a User Delegation SAS using a Microsoft Entra ID user principal or managed identity that has the Storage Blob Data Reader role on the container.Answer
  2. Set the SAS protocol constraint to HTTPS only and restrict the allowed IP range to 198.51.100.0/24.Answer
  3. C
    Generate an Account SAS signed with the primary storage account key, granting Read, Write, and List permissions.
  4. D
    Generate a Service SAS and retrieve the storage account access key from Azure Key Vault using a managed identity without configuring Key Vault access policies.

Answer

The correct options are generating a User Delegation SAS using a Microsoft Entra ID principal with the Storage Blob Data Reader role, and setting the protocol to HTTPS only with the specified IP range restriction.
Generating a User Delegation SAS secured by Microsoft Entra ID prevents exposure of the storage account key. Restricting the SAS to HTTPS only and scoping the IP address range ensures encrypted data transmission and boundaries to the client's network.

Step-by-Step Solution

1
Determine the authentication mechanism that avoids exposing primary or secondary storage account keys.
Identify that User Delegation SAS, which is secured by Microsoft Entra ID credentials, meets the key protection requirement.
Using Account or Service SAS relies on access keys, which introduces security risks if exposed.
2
Select the appropriate RBAC role and scope for the identity generating the User Delegation SAS.
Assign Storage Blob Data Reader to the generating identity at the container level.
This restricts the generated SAS token to read-only permissions on a specific container, following the least privilege principle.
3
Configure the network and transport constraints on the SAS token builder.
Enforce HTTPS protocol and restrict the allowed IP range to the auditor's IP block (198.51.100.0/24).
Enforcing HTTPS secures the channel, and IP restriction limits access origin, reinforcing the perimeter defense.

Key Concept

Shared Access Signatures and Token-based Storage Security
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic