Examkin

Question

Difficulty: MediumImplement Azure Queue Storage Solutions

An organization operates a logistics portal where external partner drivers submit location updates. You are configuring an Azure Queue Storage queue named `fleet-updates` to receive these updates. You need to provide the partner application with a Shared Access Signature (SAS) token that allows it to submit new location update messages. The partner application must not be able to view, modify, or delete any other messages in the queue. Which queue permission should you assign to the SAS token to meet this requirement?

  1. A
    Write
  2. AddAnswer
  3. C
    Update
  4. D
    Process

Answer

The Add permission is the correct choice because it allows the partner application to submit new messages to the queue without granting permissions to read, update, or delete existing messages.
The Add permission allows a client to add messages to the queue. This is the least privilege permission that fulfills the requirement to submit new messages while restricting the client from reading or deleting existing messages.

Step-by-Step Solution

1
Identify the operation needed by the partner application.
The application needs to submit (enqueue) new location updates.
This determines the minimal functional capability required.
2
Determine least privilege constraints.
The application must not read (dequeue or peek) or modify existing messages in the queue.
This rules out permissions like Read, Update, and Process.
3
Map the requirement to Azure Queue Storage SAS permissions.
The 'Add' permission allows writing new messages. 'Write' is not a valid permission for Queue Storage, and other permissions grant excessive rights.
Selecting the correct permission ensures security compliance and functional correctness.

Key Concept

Azure Queue Storage SAS Permissions
Rate this question

Topics

Implement Azure Queue Storage Solutions