Examkin

Question

Difficulty: HardShared Access Signatures and Token-based Storage Security

You are developing a secure .NET web application using the `Azure.Storage.Blobs` SDK (v12). The application must generate a Shared Access Signature (SAS) token for an Azure Blob Storage container named `invoices`.

The security requirements are as follows:
- The token must be signed using Microsoft Entra ID credentials (a User Delegation SAS) instead of the storage account key.
- The client must only be allowed to read and list the contents of the container.
- The SAS must restrict access to requests originating from the client IP address range `198.51.100.0/24`.
- The token must enforce the use of HTTPS only.
- The token must account for potential clock skew by setting the start time to 15 minutes before the current time.

You write the following method to generate the SAS token:

csharp
public async Task<string> GenerateContainerSasUriAsync(BlobServiceClient client, string containerName, string accountName)
{
UserDelegationKey delegationKey = await client.GetUserDelegationKeyAsync(
DateTimeOffset.UtcNow.AddMinutes(-15),
DateTimeOffset.UtcNow.AddHours(2)
);

BlobSasBuilder builder = new BlobSasBuilder()
{
BlobContainerName = containerName,
Resource = "c",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2)
};

// INSERT CODE HERE

BlobSasQueryParameters sasParams = builder.ToSasQueryParameters(delegationKey, accountName);
return $"{client.Uri}{containerName}?{sasParams}";
}

Which code segment should you insert to complete the method and meet the requirements?

  1. A
    builder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.List);
    builder.Protocol = SasProtocol.Https;
    builder.IPRange = IPAddressRange.Parse("198.51.100.0/24");
  2. B
    builder.SetPermissions(BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List);
    builder.Protocol = SasProtocol.HttpsAndHttp;
    builder.IPRange = IPAddressRange.Parse("198.51.100.0/24");
  3. builder.SetPermissions(BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List);
    builder.Protocol = SasProtocol.Https;
    builder.IPRange = IPAddressRange.Parse("198.51.100.0/24");    Answer
  4. D
    builder.SetPermissions(BlobAccountSasPermissions.Read | BlobAccountSasPermissions.List);
    builder.Protocol = SasProtocol.Https;
    builder.IPRange = IPAddressRange.Parse("198.51.100.0/24");

Answer

The code segment that calls builder.SetPermissions with BlobContainerSasPermissions.Read and BlobContainerSasPermissions.List, configures builder.Protocol to SasProtocol.Https, and parses the correct IP range.
The correct option properly uses BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List to grant both read and list permissions at the container level. It also restricts the communication to HTTPS-only using SasProtocol.Https and parses the IP range correctly using IPAddressRange.Parse.

Step-by-Step Solution

1
Select the correct permission enum class for the target resource level.
BlobContainerSasPermissions must be used because the SAS applies to a container (Resource = "c") and requires the List permission, which is not available in the blob-specific BlobSasPermissions class.
Ensures compilation succeeds and scope constraints match the container level.
2
Enforce the security protocol configuration.
builder.Protocol must be explicitly set to SasProtocol.Https.
By default, a SAS might allow both HTTP and HTTPS (HttpsAndHttp). Enforcing HTTPS-only mitigates data transit intercept risks.
3
Restrict request origins using IP filtering.
Assign IPAddressRange.Parse("198.51.100.0/24") to builder.IPRange.
This limits token usage strictly to the defined client subnet.

Key Concept

Configuring Container-scoped User Delegation Shared Access Signatures using Azure.Storage.Blobs SDK
Estimated Time:2m 30s
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic