Examkin

Question

Difficulty: MediumData Storage Security and Access Control

An organization needs to grant a third-party audit application read-only access to an Azure Blob storage container for exactly 30 days. Security policies require that administrators must have the ability to immediately revoke this access at any time if a security compromise is suspected, without rotating the storage account keys or affecting other active integrations. Which access control strategy should you recommend?

  1. A
    Generate an ad-hoc service Shared Access Signature (SAS) token with read permissions and a 30-day expiration directly using the storage account key.
  2. Create a Stored Access Policy on the container with read permissions and a 30-day expiration, then generate a SAS token associated with this policy.Answer
  3. C
    Assign the Storage Blob Data Reader role directly to the partner application's service principal.
  4. D
    Add the partner application's service principal to an Entra ID security group and assign the group a permanently active Storage Blob Data Reader role assignment.

Answer

Create a Stored Access Policy on the container with read permissions and a 30-day expiration, then generate a SAS token associated with this policy.
The correct option outlines using a Stored Access Policy on the blob container to control the SAS token's permissions and lifetime. By linking the SAS token to a Stored Access Policy, administrators can revoke the access instantly by deleting or changing the policy, without impacting any other integrations or rotating account access keys.

Step-by-Step Solution

1
Analyze the core requirements for the solution.
Identify that the solution must provide temporary access (30 days) and be immediately revocable without rotating storage account keys or affecting other integrations.
This establishes the constraints for evaluating the different storage access mechanisms.
2
Evaluate the capabilities of Shared Access Signatures (SAS) and Stored Access Policies.
Determine that while an ad-hoc SAS can set a 30-day duration, it cannot be revoked without rotating keys. A Stored Access Policy provides a management layer on the container that allows immediate revocation by modifying or deleting the policy.
This isolates the optimal security control that satisfies both the expiration and instant revocation requirements.
3
Contrast the storage security control with identity-based controls.
Confirm that direct RBAC role assignments or permanent group assignments fail either the delegation structure recommendations or the automatic 30-day expiration requirement.
This eliminates non-conforming configurations and validates the choice of using a Stored Access Policy.

Key Concept

Stored Access Policies provide a way to group Shared Access Signatures (SAS) and place additional constraints on them, enabling revocation of the SAS tokens by modifying or deleting the policy rather than rotating storage keys.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic