Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A manufacturing company is designing a storage solution for archiving smart factory telemetry files in an Azure Blob Storage container. The solution must meet the following security and administrative requirements:

- Internal data analysts must have read access to the container. Access permissions must scale automatically when analysts join or leave the organization without modifying individual resource permissions.
- External manufacturing partners require read access to specific telemetry files for a maximum duration of 8 hours. The company must be able to immediately revoke this access at any time without rotating the primary or secondary storage account keys.
- Storage administrators must only obtain permission to manage the storage account settings on-demand after an approval process, and the permission must automatically expire after 2 hours.

Which combination of security controls should you recommend to meet these requirements?

  1. Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the data analysts. Use a Stored Access Policy on the container to generate Shared Access Signatures (SAS) for the external partners. Configure eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrators.Answer
  2. B
    Assign the Storage Blob Data Reader role directly to each data analyst's user account in Microsoft Entra ID. Use a Stored Access Policy on the container to generate Shared Access Signatures (SAS) for the external partners. Configure eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrators.
  3. C
    Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the data analysts. Use a Stored Access Policy on the container to generate Shared Access Signatures (SAS) for the external partners. Configure active role assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrators.
  4. D
    Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the data analysts. Generate ad-hoc Shared Access Signatures (SAS) with an 8-hour expiration for the external partners without using a stored access policy. Configure eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrators.

Answer

Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the data analysts, use a Stored Access Policy on the container to generate Shared Access Signatures (SAS) for the external partners, and configure eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrators.
The correct recommendation incorporates three primary security principles: administrative scalability via Entra ID group assignments, granular time-bound external delegation via Stored Access Policies, and just-in-time access via PIM eligible assignments. Group-based RBAC ensures that permissions update dynamically without manual database or resource-level configuration changes. A Stored Access Policy binds the SAS token's lifecycle, enabling instant revocation. Eligible roles in PIM require administrators to request activation and justify access when performing tasks, fulfilling the 2-hour window requirement with approval.

Step-by-Step Solution

1
Select the appropriate access control method for data analysts.
Use a Microsoft Entra ID security group and assign the Storage Blob Data Reader role to the group rather than individual users.
This allows user permissions to scale automatically as analysts join or leave the group, reducing administrative overhead.
2
Select the appropriate mechanism for external partner access.
Create a Stored Access Policy on the Blob container and generate the Shared Access Signature (SAS) token from this policy.
A Stored Access Policy provides a way to immediately revoke the generated SAS tokens by deleting or modifying the policy, avoiding the need to rotate storage account keys.
3
Select the administrative access governance control.
Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments.
This enforces the principle of least privilege, requiring administrators to request activation (just-in-time) rather than having standing active access.

Key Concept

Data Storage Security and Access Control
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic