Examkin

Question

Difficulty: MediumBlob, File, and Disk Storage Solutions

An enterprise is designing a backup storage solution for a critical financial application. The backup files will be stored in Azure Blob Storage. The storage solution must satisfy the following requirements:

* The data must be protected against a regional disaster where the primary region becomes completely unavailable.
* External auditors must be granted temporary access to the backups via Shared Access Signatures (SAS).
* The security team must be able to immediately revoke access to the SAS tokens at any time without changing the storage account keys.

Which storage redundancy configuration and access control mechanism should you recommend?

  1. A
    Locally redundant storage (LRS) and SAS tokens associated with a stored access policy
  2. B
    Geo-redundant storage (GRS) and ad-hoc SAS tokens with a short validity period
  3. Geo-redundant storage (GRS) and SAS tokens associated with a stored access policyAnswer
  4. D
    Locally redundant storage (LRS) and ad-hoc SAS tokens with a short validity period

Answer

Geo-redundant storage (GRS) and SAS tokens associated with a stored access policy
Geo-redundant storage (GRS) replicates data to a secondary Azure region, ensuring that backups are protected against a regional disaster. Associating SAS tokens with a stored access policy provides a mechanism to change the permissions, start time, or expiry time, or to revoke the SAS immediately by deleting the policy, all without rotating the primary storage account keys.

Step-by-Step Solution

1
Evaluate the redundancy requirements for regional disaster recovery.
Determine that Geo-redundant storage (GRS) is required to replicate data to a secondary region, whereas Locally redundant storage (LRS) only replicates data within a single datacenter and cannot survive a regional outage.
To protect data against a regional disaster where the primary region is unavailable, geo-replication is necessary.
2
Evaluate the security and revocation requirements for Shared Access Signatures (SAS).
Determine that the SAS tokens must be associated with a stored access policy to support immediate revocation without rotating the primary storage account keys.
Ad-hoc SAS tokens cannot be revoked before their expiration unless the storage account keys are rotated. A stored access policy allows instant revocation by modifying or deleting the policy directly.

Key Concept

Azure Blob Storage redundancy options and Shared Access Signature (SAS) delegation using stored access policies.
Rate this question

Topics

Blob, File, and Disk Storage Solutions

More questions from this topic