Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

You are developing a secure C# application using the Azure.Storage.Blobs SDK (v12) to generate a User Delegation SAS token. An external client requires temporary, read-only access to a specific blob named "backup.bak" in a container named "db-backups".

The security requirements are as follows:
- Access must be restricted to HTTPS only.
- Access must be restricted to the client's IP address "203.0.113.88".
- The token must account for potential client-server clock desynchronization (clock skew).
- The token must grant only the minimum necessary permissions.

You write the following code:

csharp
var sasBuilder = new BlobSasBuilder
{
BlobContainerName = "db-backups",
BlobName = "backup.bak",
Resource = [PLACEHOLDER_RESOURCE],
StartsOn = [PLACEHOLDER_START],
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
Protocol = [PLACEHOLDER_PROTOCOL],
IPRange = [PLACEHOLDER_IP]
};
sasBuilder.SetPermissions([PLACEHOLDER_PERMISSIONS]);

Which set of properties correctly configures the BlobSasBuilder to meet the security requirements?

  1. Resource = "b", StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15), Protocol = SasProtocol.Https, IPRange = SasIPRange.Parse("203.0.113.88"), and Permissions = BlobSasPermissions.ReadAnswer
  2. B
    Resource = "c", StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15), Protocol = SasProtocol.Https, IPRange = SasIPRange.Parse("203.0.113.88"), and Permissions = BlobSasPermissions.Read
  3. C
    Resource = "b", StartsOn = DateTimeOffset.UtcNow, Protocol = SasProtocol.HttpsAndHttp, IPRange = SasIPRange.Parse("203.0.113.88"), and Permissions = BlobSasPermissions.Read
  4. D
    Resource = "b", StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15), Protocol = SasProtocol.Https, IPRange = SasIPRange.Parse("203.0.113.88"), and Permissions = BlobSasPermissions.All

Answer

The correct configuration is the one that sets Resource to "b", StartsOn with a 15-minute clock skew buffer, Protocol to HTTPS, specifies the exact client IP address, and grants Read permissions.
The correct configuration specifies Resource = "b" (which scopes the token to a single blob rather than the entire container), subtracts 15 minutes from UtcNow to handle potential client-server clock desynchronization (clock skew), sets the protocol to HTTPS only, restricts the IP range to the client's IP, and limits permissions to Read only, satisfying all security constraints.

Step-by-Step Solution

1
Determine the correct resource scope and permissions for the BlobSasBuilder.
Because access is restricted to a single blob named 'backup.bak', the Resource property must be set to 'b' (blob) rather than 'c' (container). The permissions must be limited strictly to BlobSasPermissions.Read to maintain least privilege.
Setting Resource to 'c' would grant access to all blobs in the container, violating the least privilege rule.
2
Configure the security protocol and network constraints on the builder.
The Protocol property must be set to SasProtocol.Https, and the IPRange must be configured to SasIPRange.Parse("203.0.113.88") to restrict operations to the designated client.
This guarantees that client requests are encrypted in transit over HTTPS and originate only from the specified partner IP address.
3
Provide a buffer for clock synchronization issues between client and server.
Set the StartsOn property to a time slightly in the past, such as DateTimeOffset.UtcNow.AddMinutes(-15).
Without a buffer, if the client's clock is slightly ahead of the Azure storage server, the token will be rejected as not yet valid.

Key Concept

Configuring a secure User Delegation Shared Access Signature (SAS) token using the Azure Storage .NET SDK (Azure.Storage.Blobs) to enforce least-privilege, clock skew handling, protocol restrictions, and IP restrictions.
Estimated Time:1m 30s
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic