Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

You are implementing a method in a C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary upload URI for a client. The client must be allowed to upload a single blob named `report.pdf` to a container named `documents`.

The implementation must meet the following security requirements:
- Limit permissions strictly to uploading the specified blob.
- Enforce the HTTPS protocol for the upload request.
- Sign the SAS using Microsoft Entra ID credentials rather than the storage account's shared access key.
- Prevent authentication failures due to clock skew between the client and Azure Storage.

You have the following code segment:

csharp
var credential = new DefaultAzureCredential();
var blobServiceClient = new BlobServiceClient(
new Uri("https://mystorage.blob.core.windows.net"),
credential
);

// [Block 1]

var sasBuilder = new BlobSasBuilder()
{
BlobContainerName = "documents",
BlobName = "report.pdf",
Resource = "b",
// [Block 2]
};
sasBuilder.SetPermissions(BlobSasPermissions.Write);

Which of the following code segments should you use to complete the implementation? (Select two.)

  1. For [Block 1]:
    csharp
    var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(
    DateTimeOffset.UtcNow.AddMinutes(-15),
    DateTimeOffset.UtcNow.AddHours(2)
    );
    Answer
  2. For [Block 2]:
    csharp
    StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
    ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
    Protocol = SasProtocol.Https
    Answer
  3. C
    For [Block 1]:
    csharp
    var userDelegationKey = await blobServiceClient.GetUserDelegationKeyAsync(
    DateTimeOffset.UtcNow,
    DateTimeOffset.UtcNow.AddDays(30)
    );
  4. D
    For [Block 2]:
    csharp
    StartsOn = DateTimeOffset.UtcNow,
    ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
    Protocol = SasProtocol.HttpsAndHttp

Answer

To generate a secure SAS using Microsoft Entra ID with clock skew allowance and HTTPS enforcement, you should obtain a User Delegation Key with a 15-minute start buffer and a 2-hour duration, and configure the BlobSasBuilder with corresponding start/expiration bounds and the HTTPS-only protocol option.
The correct implementation requires obtaining a User Delegation Key and setting up a BlobSasBuilder. To sign with Microsoft Entra ID, the application must use `GetUserDelegationKeyAsync` with a start time that accounts for clock skew (e.g., subtracting 15 minutes) and a duration matching the lifetime requirements. Similarly, the SAS builder must be configured to start 15 minutes prior to the current time, expire in 2 hours, and enforce HTTPS-only connections using `SasProtocol.Https`.

Step-by-Step Solution

1
Obtain a User Delegation Key using Microsoft Entra ID credentials
The application calls GetUserDelegationKeyAsync on the BlobServiceClient.
Signing a SAS with Microsoft Entra ID (User Delegation SAS) is more secure than using the storage account key, as it respects Azure RBAC permissions and avoids exposing account access keys.
2
Account for potential clock skew during key generation
Set the start time of the User Delegation Key to 15 minutes in the past.
If the client's system clock is slightly ahead of the Azure Storage server clock, a token starting exactly at UtcNow will be rejected as not yet valid. A clock skew buffer prevents this.
3
Configure the BlobSasBuilder properties to restrict protocol and set correct lifetime limits
Assign StartsOn, ExpiresOn, and set Protocol to SasProtocol.Https.
This enforces HTTPS-only communication and ensures the token lifetime matches the 2-hour constraint while preserving the clock skew buffer.

Key Concept

Generating a User Delegation SAS token using Azure.Storage.Blobs SDK in .NET, applying least privilege, HTTPS enforcement, and clock skew mitigation.
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic