Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

An internal audit team requires temporary, read-only access to log files stored in a private blob container named `applogs`. You are writing the C# backend code to generate a Shared Access Signature (SAS) token for their client software.

The security policy dictates the following constraints:
- The token must be signed using Microsoft Entra ID credentials, avoiding the use of storage account keys.
- Connections must be restricted to HTTPS.
- Access must be limited specifically to the client software's outbound IP address of `203.0.113.88`.

Which of the following configurations or code steps are required to generate this SAS token? (Select TWO).

  1. Generate a User Delegation SAS by retrieving a User Delegation Key using a BlobServiceClient authenticated with Microsoft Entra ID credentials.Answer
  2. Set the Protocols property of the BlobSasBuilder instance to SasProtocol.HttpsOnly.Answer
  3. C
    Generate a Service SAS signed with the Storage Account access key and configure a Stored Access Policy on the container.
  4. D
    Set the IPRange property of the BlobSasBuilder instance to a SasIPRange that includes the range 203.0.113.0/24 with both HTTP and HTTPS allowed.

Answer

Generating a User Delegation SAS using a User Delegation Key and configuring the BlobSasBuilder's Protocols property to HttpsOnly are both required.
Generating a User Delegation SAS signed with Microsoft Entra ID credentials meets the requirement to avoid storage account keys, and setting the Protocols property to HttpsOnly enforces secure connections.

Step-by-Step Solution

1
Select the correct SAS type based on the identity requirement.
A User Delegation SAS is chosen because it is signed using Microsoft Entra ID credentials rather than the account keys.
This aligns with security best practices and meets the specific requirement to sign using Entra ID credentials.
2
Configure connection protocol constraints on the SAS builder.
Set the Protocols property of the BlobSasBuilder to SasProtocol.HttpsOnly.
This guarantees that the generated SAS token will reject non-HTTPS requests, ensuring data in transit is encrypted.
3
Apply client IP restrictions to the SAS builder.
Assign a SasIPRange containing only the single IP address 203.0.113.88 to the IPRange property of the BlobSasBuilder.
This enforces least privilege by ensuring only the specific client IP can use the token.

Key Concept

Shared Access Signatures (SAS) security configurations including User Delegation SAS, HTTPS protocol enforcement, and client IP constraints.
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic