Examkin

Question

Difficulty: HardData Storage Security and Access Control

A global healthcare research institution plans to store clinical trial genomic datasets in an Azure Blob Storage account named genomedata. You are designing a security and access control strategy to meet the following requirements:
1. External pharmaceutical research partners must be granted temporary, read-only access to specific blobs in a container named trial-results.
2. Access for partners must be restricted to a specific IP address range and must support immediate revocation before the planned 7-day expiration period.
3. Storage administrators must manage these access policies following the principle of least privilege, ensuring that administrator roles can only be activated for a maximum of 4 hours at a time and require manager approval.
4. Access permissions must not be assigned directly to individual admin accounts to ensure scalable governance.

Which three actions should you include in the storage security design? (Select THREE.)

  1. Create a Stored Access Policy on the trial-results container, and generate a Service Shared Access Signature (SAS) that references this policy and specifies the allowed IP address range.Answer
  2. B
    Generate an ad-hoc Service Shared Access Signature (SAS) with a 7-day expiration date and the allowed IP address range, without utilizing a Stored Access Policy.
  3. Create a Microsoft Entra ID security group for administrators, and configure a Privileged Identity Management (PIM) eligible role assignment for this group to the Storage Account Contributor role.Answer
  4. D
    Assign the Storage Account Contributor role directly to the individual administrator user accounts to simplify administrative auditing.
  5. Configure the Privileged Identity Management (PIM) role settings for the Storage Account Contributor role to require manager approval and enforce a maximum activation duration of 4 hours.Answer
  6. F
    Configure a permanently active role assignment in Privileged Identity Management (PIM) for the administrator group to the Storage Account Contributor role.

Answer

To meet the security objectives, you must create a Stored Access Policy on the trial-results container to generate a Service SAS with IP restrictions, create a Microsoft Entra ID security group for administrators with an eligible PIM role assignment, and configure PIM activation settings to require approval and limit duration to 4 hours.
To secure external partner access with immediate revocation capability, you must generate a Service SAS associated with a Stored Access Policy. This allows you to invalidate the SAS instantly by deleting or modifying the policy. For administrative access, following the principle of least privilege requires combining Microsoft Entra ID security groups (avoiding direct RBAC assignments) with Privileged Identity Management (PIM) eligible assignments. Setting the PIM role settings to require approval and limiting the activation window to 4 hours satisfies the operational control requirements.

Step-by-Step Solution

1
Address partner access and revocation requirements.
Create a Stored Access Policy on the trial-results container and generate a Service SAS that references this policy and includes the allowed IP range.
Stored Access Policies allow you to change the expiration time or delete the policy to instantly invalidate any associated SAS tokens. Ad-hoc SAS tokens cannot be revoked individually without rotating the storage keys.
2
Design group-based access control for administrative tasks.
Create a Microsoft Entra ID security group for administrators and configure eligibility in Privileged Identity Management (PIM) to the Storage Account Contributor role.
Assigning RBAC roles to security groups rather than individual users ensures scalable governance, while PIM eligibility enables just-in-time access elevation.
3
Enforce limits on administrative access duration and authorization.
Configure PIM role settings to require manager approval and restrict the maximum activation duration to 4 hours.
This satisfies the policy of least privilege and prevents administrators from possessing standing, high-privilege access.

Key Concept

Securing storage account access using Stored Access Policies combined with Microsoft Entra ID security groups and Privileged Identity Management (PIM) for administrative access control.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic