Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A financial services company is designing a storage solution for external consultants who need to upload weekly reports to an Azure Blob Storage container named consultant-uploads. The design must satisfy the following requirements:
- The consultants must be granted write-only access to the container for a duration of 90 days.
- The consultants must not be required to authenticate using Microsoft Entra ID.
- The security team must be able to immediately revoke the access if a compliance violation is detected.
Which of the following access control strategies should you recommend to meet these requirements?

  1. A
    Generate an ad-hoc service Shared Access Signature (SAS) token directly on the container with a 90-day validity period.
  2. Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token associated with that policy.Answer
  3. C
    Assign the Storage Blob Data Contributor role directly to the individual external user accounts in Microsoft Entra ID.
  4. D
    Assign the Storage Blob Data Owner role as an active Privileged Identity Management (PIM) assignment to each consultant's account.

Answer

Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token associated with that policy.
Associating a service Shared Access Signature (SAS) with a stored access policy allows the policy to be modified or deleted. Deleting or modifying the policy immediately revokes the SAS token, meeting the requirement of instant revocation. Since a SAS token does not require Microsoft Entra ID authentication, this approach meets all the requirements.

Step-by-Step Solution

1
Analyze the authentication requirement.
The requirement states that consultants must not use Microsoft Entra ID. This rules out solutions based on Entra ID RBAC or Privileged Identity Management (PIM) assignments.
Shared Access Signatures (SAS) allow clients to access storage resources without having an Entra ID identity.
2
Evaluate the revocation and duration requirement.
The SAS token must last for 90 days but must be instantly revocable. An ad-hoc SAS cannot be revoked without rotating keys, whereas a SAS associated with a stored access policy can be revoked by deleting or changing the policy.
Stored access policies provide server-side control over SAS lifetimes and permissions.
3
Combine security and configuration best practices.
Select the strategy that uses a stored access policy to manage a service SAS.
This is the only strategy that provides non-identity based access that is immediately revocable without rotating account keys.

Key Concept

Stored Access Policies vs. Ad-hoc SAS
Estimated Time:1m 30s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic