Examkin

Question

Difficulty: EasyData Storage Security and Access Control

Your company needs to grant an external audit team temporary read-only access to financial reports stored in an Azure Blob storage container. You need to design an access solution that allows immediate revocation of access and adheres to cloud security best practices for identity and access management. Which two security controls should you implement? (Select two.)

  1. Associate a Shared Access Signature (SAS) with a stored access policy on the blob container.Answer
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token with a fixed expiration time directly in the URI.
  3. Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the auditor accounts.Answer
  4. D
    Assign the Storage Blob Data Reader role directly to each auditor's individual Microsoft Entra ID user account.

Answer

To secure the storage container access and follow best practices, you should associate the Shared Access Signature (SAS) with a stored access policy on the blob container, and assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the auditor accounts.
Associating a Shared Access Signature (SAS) with a stored access policy allows the policy to be modified or deleted to instantly revoke the token's validity. Additionally, assigning the Storage Blob Data Reader role to a Microsoft Entra ID security group ensures scalability and simplifies administrative governance by managing access at the group level.

Step-by-Step Solution

1
Determine how to configure revocable Shared Access Signatures.
A stored access policy is identified as the mechanism to allow revocation without rotating storage keys.
Ad-hoc SAS tokens cannot be easily revoked individually without key rotation, whereas SAS tokens bound to a stored access policy can be revoked by deleting or changing the policy.
2
Determine the best practice for assigning Azure RBAC roles.
Assigning the role to a Microsoft Entra ID security group is identified as the standard management practice.
Assigning permissions directly to user accounts makes tracking and removing access difficult, whereas group-based assignments scale efficiently and reduce administrative overhead.

Key Concept

Azure storage security controls including Stored Access Policies for SAS revocation, and Azure RBAC group-based access management.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic