Examkin

Question

Difficulty: EasyShared Access Signatures and Token-based Storage Security

A developer is configuring a Shared Access Signature (SAS) token to allow an external application to download diagnostic reports from a specific Azure Blob Storage container. The token must be valid for 24 hours, enforce HTTPS-only access, and restrict operations to downloading blobs. Which two configurations should the developer apply to the SAS token to meet these requirements?

  1. Set the permissions parameter to Read (r) only.Answer
  2. Set the allowed protocols parameter to HTTPS only.Answer
  3. C
    Set the permissions parameter to Read and Write (rw) to allow metadata reading.
  4. D
    Set the allowed protocols parameter to HTTP and HTTPS to ensure compatibility.
  5. E
    Generate an Account-level SAS with access to Blob, File, and Queue services.

Answer

To meet the requirements, the developer must set the permissions parameter to Read (r) only and set the allowed protocols parameter to HTTPS only.
The correct configurations restrict the SAS token permissions to Read (r) only, which is sufficient for downloading files, and enforce HTTPS-only access to prevent cleartext transmission of data, aligning with security requirements.

Step-by-Step Solution

1
Determine the minimum required permissions for downloading files.
Only Read (r) permission is needed.
Granting additional permissions like Write (w) violates the principle of least privilege.
2
Determine the allowed protocol constraint.
HTTPS-only parameter configuration.
This enforces transport-level security and prevents unencrypted HTTP connections.

Key Concept

Configuring least-privilege permissions and protocol constraints on a Shared Access Signature (SAS) token.
Estimated Time:1m 0s
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic