Examkin

Question

Difficulty: Very hardData Storage Security and Access Control

A manufacturing corporation uses an Azure Storage account to store telemetry logs from industrial IoT devices. You are designing a security and access control strategy that meets the following requirements:
1. External maintenance technicians require read-only access to a specific blob container for a 24-hour maintenance window.
2. The access must be immediately revocable at any time without rotating the storage account access keys or impacting other active applications.
3. Internal security administrators responsible for configuring storage access must use Microsoft Entra Privileged Identity Management (PIM) to activate their privileges on a just-in-time (JIT) basis.
4. All administrative assignments and roles must be scalable and avoid direct assignment to individual user identities.

Which of the following designs should you recommend?

  1. A
    Generate an ad-hoc service Shared Access Signature (SAS) token with a 24-hour expiration window for the external technicians. For the internal administrators, create a Microsoft Entra ID security group, assign the Storage Blob Data Owner role to this group, and configure the administrators as eligible members of the group in PIM.
  2. B
    Configure a Stored Access Policy on the blob container and generate a service Shared Access Signature (SAS) token linked to this policy for the external technicians. For the internal administrators, configure them as eligible for the Storage Blob Data Owner role directly assigned to their individual user accounts in PIM.
  3. Configure a Stored Access Policy on the blob container and generate a service Shared Access Signature (SAS) token linked to this policy for the external technicians. For the internal administrators, create a Microsoft Entra ID security group, assign the Storage Blob Data Owner role to this group, and configure the administrators as eligible members of the group in PIM.Answer
  4. D
    Configure a Stored Access Policy on the blob container and generate a service Shared Access Signature (SAS) token linked to this policy for the external technicians. For the internal administrators, create a Microsoft Entra ID security group, assign the Storage Blob Data Owner role to this group, and configure the administrators as active members of the group in PIM.

Answer

Configure a Stored Access Policy on the blob container and generate a service Shared Access Signature (SAS) token linked to this policy for the external technicians. For the internal administrators, create a Microsoft Entra ID security group, assign the Storage Blob Data Owner role to this group, and configure the administrators as eligible members of the group in PIM.
The correct design secures the external technician access by creating a Stored Access Policy on the blob container and generating a service SAS token associated with it. This satisfies the requirement of immediate revocability without rotating the storage keys. Furthermore, it ensures administrative scalability and compliance with the principle of least privilege by assigning the Storage Blob Data Owner RBAC role to a Microsoft Entra ID security group and configuring the administrators as eligible members of this group in PIM, enforcing just-in-time access.

Step-by-Step Solution

1
Select the correct mechanism for temporary external access that supports immediate revocation.
Implement a service Shared Access Signature (SAS) associated with a Stored Access Policy on the container.
An ad-hoc SAS cannot be revoked without rotating storage account keys, which would impact other applications. A Stored Access Policy allows revocation by deleting or modifying the policy directly.
2
Design a scalable role assignment mechanism for internal administrators.
Create a Microsoft Entra ID security group and assign the Storage Blob Data Owner role to this group.
Assigning RBAC roles to security groups rather than individual user accounts aligns with the principle of administrative scalability and simplifies identity management.
3
Apply the principle of least privilege and just-in-time (JIT) access control.
Configure administrators as eligible (rather than active) members of the Entra ID security group in PIM.
Eligible status requires administrators to explicitly activate their role when needed, providing JIT access and ensuring that administrative privileges are not permanently active.

Key Concept

Delegating storage access securely using Stored Access Policies and automating identity lifecycle governance using Microsoft Entra PIM groups.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic