Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A healthcare organization is designing a cloud-based clinical trial platform. Patient health records are stored in an Azure Blob Storage container named `trials`. A third-party auditing firm requires read-only access to this container for a period of 120120 days. The security architecture must ensure that the access can be immediately revoked at any time without rotating the storage account access keys or impacting other applications. Additionally, all access requests must originate from the auditing firm's public IP range of 198.51.100.0/24198.51.100.0/24.

Which access control strategy should you recommend to meet these requirements?

  1. Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.Answer
  2. B
    Generate an ad-hoc service Shared Access Signature (SAS) token for the container with an expiry of 120120 days and the IP address constraint.
  3. C
    Assign the Storage Blob Data Reader role directly to each auditor's Microsoft Entra ID user account and configure a storage firewall rule targeting the IP address range.
  4. D
    Create a Microsoft Entra ID group for the auditors, assign the Storage Blob Data Reader role to the group, and configure a Privileged Identity Management (PIM) active role assignment for the group.

Answer

Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.
The correct option recommends creating a stored access policy on the container and generating a service SAS token referencing it. A stored access policy provides a way to manage SAS tokens on the server side, allowing revocation by simply deleting or modifying the policy without rotating the storage account keys. It also supports specifying IP address constraints directly in the SAS token parameters.

Step-by-Step Solution

1
Analyze the access scope and revocation requirements.
Identify that the access is limited to a single container for a specific duration, and must be immediately revokable without rotating the storage account keys.
This determines that an ad-hoc SAS token is unsuitable, and a mechanism linked to a stored access policy is required.
2
Compare SAS implementation options.
Confirm that a service SAS referencing a stored access policy allows revocation on the server side by deleting or updating the policy.
This meets the key requirement of revocation without rotating the primary or secondary storage account keys.
3
Apply additional network security controls to the SAS parameter definition.
Verify that the service SAS token can restrict access to the specific external IP address range.
This satisfies the requirement that all requests must originate from the auditing firm's public IP range.

Key Concept

Stored Access Policies and Shared Access Signatures
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic