Examkin

Question

Difficulty: MediumData Storage Security and Access Control

An energy company is designing a security and access control solution for wind turbine telemetry logs stored in an Azure Blob Storage container named telemetry-logs. The solution must meet the following requirements:
- External wind farm maintenance contractors must be granted read-only access to the telemetry-logs container for a maximum of 24 hours.
- You must be able to immediately revoke the contractors' access before the 24-hour window expires, without changing the storage account key or impacting other active access tokens.
- Internal infrastructure engineers must be granted administrative access to manage the storage settings only when performing scheduled maintenance tasks, and their access must be audited and automatically expire.
Which two security controls should you recommend to meet the requirements? (Select two.)

  1. Create a stored access policy on the telemetry-logs container and generate a Shared Access Signature (SAS) token associated with the policy for the contractors.Answer
  2. Configure Microsoft Entra Privileged Identity Management (PIM) and assign the infrastructure engineers as eligible for the Storage Account Contributor role.Answer
  3. C
    Generate an ad-hoc container-level Shared Access Signature (SAS) token with a 24-hour expiry time for the contractors.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) and assign the infrastructure engineers as permanently active in the Storage Account Contributor role.
  5. E
    Assign the Storage Account Contributor role directly to the individual Entra ID user accounts of the infrastructure engineers.

Answer

Create a stored access policy on the telemetry-logs container and generate a Shared Access Signature (SAS) token associated with the policy for the contractors, and configure Microsoft Entra Privileged Identity Management (PIM) and assign the infrastructure engineers as eligible for the Storage Account Contributor role.
The correct recommendations are using a stored access policy for the SAS tokens and using Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments. The stored access policy allows individual revocation of the generated SAS token without rotating the storage keys. PIM eligible role assignments ensure infrastructure engineers can only activate the Storage Account Contributor role when performing maintenance, ensuring auditing and automatic expiration of their administrative permissions.

Step-by-Step Solution

1
Analyze the access and revocation requirements for external contractors.
Identify that a stored access policy is required because it allows revocation of the associated Shared Access Signature (SAS) tokens by modifying or deleting the policy.
Ad-hoc SAS tokens cannot be revoked individually; revoking them requires rotating the storage account keys, which would affect other active SAS tokens and violate the scenario constraints.
2
Analyze the access and lifecycle requirements for internal infrastructure engineers.
Determine that Microsoft Entra Privileged Identity Management (PIM) is required, specifically using eligible assignments.
Eligible assignments allow engineers to request activation of the administrative role only when needed (just-in-time) for a limited duration, requiring approval and generating audit logs.

Key Concept

Data Storage Security and Access Control using Stored Access Policies and Privileged Identity Management (PIM)
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic