Examkin

Question

Difficulty: EasyShared Access Signatures and Token-based Storage Security

An organization needs to allow a partner application to read data from a specific Azure Blob Storage container named `reports`. You must configure a Shared Access Signature (SAS) token that meets the following security requirements:

- Allows read-only (least-privilege) access to the `reports` container only.
- Restricts access to a specific external IP address range: 198.51.100.0/24198.51.100.0/24.
- Restricts communication to the HTTPS protocol only.
- Begins validity immediately and expires in exactly 22 hours.
- Uses Microsoft Entra ID credentials to secure and sign the token, avoiding the use of the storage account key.

Which type of Shared Access Signature (SAS) must you generate?

  1. User Delegation SASAnswer
  2. B
    Service SAS
  3. C
    Account SAS
  4. D
    Stored Access Policy

Answer

User Delegation SAS
The correct answer is the User Delegation SAS. A User Delegation SAS is signed with Microsoft Entra ID credentials rather than the storage account key. It utilizes a user delegation key obtained from the Microsoft Entra ID token to sign the SAS, providing enhanced security and auditing capability while satisfying the constraint to restrict access to a single container with specific IP ranges, protocols, and lifetime bounds.

Step-by-Step Solution

1
Identify the signing credential constraint from the requirements.
The SAS token must be secured and signed using Microsoft Entra ID credentials instead of the storage account access key.
This is a key security differentiator among Azure Storage SAS types.
2
Evaluate the signing mechanism for each SAS type.
Service SAS and Account SAS are signed using storage account access keys. User Delegation SAS is signed using a user delegation key acquired via Microsoft Entra ID.
To determine which token type matches the signing constraint.
3
Select the token type that matches all requirements, including container-level scope.
A User Delegation SAS supports container-level scope, HTTPS restriction, IP filters, and is signed using Microsoft Entra ID credentials.
It fulfills all the specified security and protocol requirements.

Key Concept

Selecting the correct type of Shared Access Signature based on credentials and scope requirements
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic