Examkin

Question

Difficulty: HardData Storage Security and Access Control

A financial technology enterprise is designing a secure integration interface for a partner firm, Alpha Analytics, to retrieve historical transaction records stored in an Azure Blob Storage container named `tx-archive-2026`. The design must satisfy the following requirements:
- Alpha Analytics must have read-only access to the blobs.
- Access must be limited to a maximum duration of 4848 hours.
- Access must be restricted to Alpha Analytics' public outbound IP range (203.0.113.0/24203.0.113.0/24).
- The enterprise must have the capability to immediately revoke access before the 4848-hour window expires, without rotating the storage account keys or affecting other services.

Which storage security and access control solution should you recommend?

  1. Create a stored access policy on the container that specifies Read permissions. Generate a service Shared Access Signature (SAS) associated with the stored access policy, and configure the SAS to restrict access to the IP range 203.0.113.0/24203.0.113.0/24.Answer
  2. B
    Generate an ad-hoc service Shared Access Signature (SAS) with Read permissions, an expiration of 4848 hours, and an IP restriction of 203.0.113.0/24203.0.113.0/24.
  3. C
    Create a guest user account in Microsoft Entra ID for the partner firm. Assign the Storage Blob Data Reader role directly to this guest user account scoped to the container, and configure a Microsoft Entra Conditional Access policy to restrict access to the IP range 203.0.113.0/24203.0.113.0/24.
  4. D
    Create a Microsoft Entra ID security group, assign the Storage Blob Data Reader role to the group, and add the partner's identity to it. Configure Microsoft Entra Privileged Identity Management (PIM) for groups, assigning the partner's identity as an active member with a permanent assignment.

Answer

Create a stored access policy on the container that specifies Read permissions. Generate a service Shared Access Signature (SAS) associated with the stored access policy, and configure the SAS to restrict access to the IP range 203.0.113.0/24203.0.113.0/24.
The correct solution uses a service Shared Access Signature (SAS) linked to a stored access policy. By specifying the Read permissions and expiration on the stored access policy, the enterprise can revoke access instantly by modifying or deleting the policy, without needing to rotate the master storage account keys. The IP restriction is placed directly on the generated SAS token to meet the network requirements.

Step-by-Step Solution

1
Analyze the requirement for individual revocation of the access token.
Identify that to revoke a Shared Access Signature (SAS) without changing the storage account master keys, the SAS must be associated with a stored access policy.
Stored access policies reside on the storage container and can be modified or deleted to instantly invalidate any associated SAS tokens.
2
Apply constraints for permissions, time duration, and network limits.
Define Read permissions and a maximum of 4848 hours of validity on the stored access policy. Apply the IP restriction of 203.0.113.0/24203.0.113.0/24 on the SAS token parameters.
This satisfies the read-only, time-bounded, and network-isolated access requirements.
3
Evaluate identity and role assignment options.
Select the service SAS over direct RBAC assignments or permanent PIM groups.
Direct user RBAC assignments violate scalable management principles, and active/permanent PIM assignments violate JIT principles while requiring excessive administrative overhead.

Key Concept

Stored Access Policies vs. Ad-hoc SAS for Revocation Control
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic