Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A clinical research organization is designing a security solution for an Azure Blob Storage container named researchdata that stores sensitive genetic sequencing results. The solution must meet the following access requirements:
1. Internal researchers require ongoing read access to the sequencing data. Access must be managed at scale rather than via individual assignments.
2. A partner laboratory requires read access to the data for a specific 48-hour window to validate findings.
3. The partner laboratory's access must support immediate revocation in case of a security anomaly, without affecting the access of internal researchers.

Which security configuration should you recommend to meet these requirements?

  1. Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal researchers. For the partner laboratory, generate a Shared Access Signature (SAS) token associated with a Stored Access Policy on the container.Answer
  2. B
    Assign the Storage Blob Data Reader role directly to the Microsoft Entra ID user account of each internal researcher. For the partner laboratory, generate a Shared Access Signature (SAS) token associated with a Stored Access Policy on the container.
  3. C
    Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal researchers. For the partner laboratory, generate an ad-hoc container-level Shared Access Signature (SAS) token with a 48-hour expiration.
  4. D
    Use Privileged Identity Management (PIM) to assign the Storage Blob Data Reader role to the internal researchers' group as a permanently active assignment. For the partner laboratory, generate a Shared Access Signature (SAS) token associated with a Stored Access Policy on the container.

Answer

Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal researchers. For the partner laboratory, generate a Shared Access Signature (SAS) token associated with a Stored Access Policy on the container.
The correct strategy uses group-based role assignments for the internal researchers to ensure scalable administration and follows the principle of least privilege. For the external partner laboratory, it uses a container-level Shared Access Signature (SAS) backed by a Stored Access Policy. This configuration meets the 48-hour access limit and allows the organization to revoke the SAS token immediately if necessary by altering or deleting the Stored Access Policy, without affecting the storage account keys or other users.

Step-by-Step Solution

1
Address the internal researchers' requirement by using group-based access control.
Create a Microsoft Entra ID security group, add the researchers, and assign the Storage Blob Data Reader role to the group.
This scales access management and avoids assigning RBAC permissions directly to individual user accounts.
2
Address the partner laboratory's temporary access and revocation requirements.
Define a Stored Access Policy on the container with a 48-hour lifetime, and generate a SAS token derived from this policy.
Using a Stored Access Policy allows the token to be immediately revoked by modifying or deleting the policy, which is not possible with an ad-hoc SAS without rotating the storage keys.

Key Concept

Combining Microsoft Entra ID group-based RBAC with Stored Access Policies on storage containers to balance ongoing access management with secure, revocable temporary access.
Estimated Time:1m 30s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic