Examkin

Question

Difficulty: EasyData Storage Security and Access Control

You are designing a secure data storage solution in Azure. A partner organization requires read-only access to a specific Azure Blob Storage container for a period of 30 days. The security policy mandates that you must be able to revoke this access immediately if a security breach occurs, without rotating the storage account access keys.

Which of the following access control strategies should you recommend?

  1. A
    Assign the Storage Blob Data Reader role directly to the external developer's Microsoft Entra ID user account.
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token with a validity period of one year.
  3. Generate a Shared Access Signature (SAS) token that is associated with a stored access policy.Answer
  4. D
    Configure a permanently active Storage Blob Data Reader role assignment in Microsoft Entra Privileged Identity Management (PIM) for the external developer.

Answer

Generate a Shared Access Signature (SAS) token that is associated with a stored access policy.
Associating a Shared Access Signature (SAS) with a stored access policy allows you to manage the lifetime and permissions of the SAS dynamically. If you need to revoke access, you can delete or modify the stored access policy on the container. This immediately invalidates any SAS tokens generated from that policy without needing to rotate the storage account's primary or secondary access keys, minimizing disruption to other services.

Step-by-Step Solution

1
Analyze the requirement for temporary, revocable access to a blob container without key rotation.
Identified that rotating storage account keys is unacceptable for revocation.
Rotating keys would disrupt other clients and applications using the same storage account.
2
Evaluate how to revoke a Shared Access Signature (SAS) token.
Found that an ad-hoc SAS cannot be revoked without key rotation, whereas a SAS associated with a stored access policy can be revoked by modifying or deleting the policy.
Stored access policies bind the SAS validation to the policy's state in Azure Storage.
3
Select the security control that matches the scenario requirements.
Recommend generating a SAS token associated with a stored access policy.
This fulfills the 30-day access, read-only permissions, and instant revocation requirements without rotating storage account keys.

Key Concept

Using stored access policies to manage and revoke Shared Access Signatures (SAS) without rotating storage account keys.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic