Examkin

Question

Difficulty: HardData Storage Security and Access Control

An enterprise is designing a secure storage solution on Azure to hold sensitive transaction logs in a Blob Storage container. The logs contain highly confidential financial records. You need to design the access control strategy to meet the following security requirements:

- A team of external auditors must be granted temporary read access to the logs for a maximum duration of 4 hours per session, and this access must be immediately revocable in the event of a suspected security breach.
- A team of internal storage administrators requires privileged access to manage the storage container, but their permissions must not be permanently active and must require activation through Microsoft Entra Privileged Identity Management (PIM).
- Permissions must be managed at scale, avoiding direct assignment of role privileges to individual user identities.

Which two actions should you recommend to meet these requirements? (Select TWO.)

  1. Configure a stored access policy on the blob container, and generate Shared Access Signature (SAS) tokens associated with this policy for the external auditors.Answer
  2. Create a Microsoft Entra ID security group, assign the Storage Blob Data Reader role to the group, and configure Privileged Identity Management (PIM) for Groups to make the storage administrators eligible for the group.Answer
  3. C
    Assign the Storage Blob Data Reader role directly to each administrator's Microsoft Entra ID user account, and configure the PIM assignments as active.
  4. D
    Generate ad-hoc Shared Access Signature (SAS) tokens with a 4-hour expiration time directly in the URI for the external auditors without using a stored access policy.

Answer

Configure a stored access policy on the blob container for the external auditors' SAS tokens, and create a Microsoft Entra ID security group with PIM for Groups eligibility for the storage administrators.
Using a stored access policy enables immediate revocation of the associated SAS tokens by modifying the policy, meeting the requirements of the external auditors. PIM for Groups allows storage administrators to activate their access just-in-time, and utilizing a security group avoids direct RBAC assignments to individual users.

Step-by-Step Solution

1
Evaluate the requirement for temporary, revocable access for external auditors.
Determine that ad-hoc SAS tokens do not support granular, immediate revocation without key rotation, which affects all users. A stored access policy provides the required control.
Stored access policies allow immediate revocation of associated SAS tokens by altering or deleting the policy.
2
Evaluate the requirement for privileged access for internal administrators.
Determine that administrators must not have permanently active roles and must use PIM.
Microsoft Entra PIM allows roles to be configured as eligible rather than permanently active, providing just-in-time access.
3
Evaluate the scalability requirement for administrative access.
Determine that direct role assignments to individual users must be avoided in favor of group-based management.
Assigning RBAC roles to security groups rather than individual users aligns with the principle of least privilege and simplifies governance.

Key Concept

Azure storage security requires combining network controls, identity-based RBAC, and granular token lifecycles. For JIT administrative access, PIM for Groups is standard practice, while stored access policies are essential for revocable SAS token management.
Estimated Time:2m 0s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic