Question

Difficulty: MediumData Storage Security and Access Control

An enterprise is designing the security and access control architecture for an Azure Storage account named finstatements that will host sensitive monthly financial statements. The design must meet the following requirements:

* Internal auditors must be granted temporary Read access to the statements only when actively performing a quarterly audit. The activation of this access must require multi-factor authentication (MFA) and administrative approval.
* Auditor access must be managed at a group level to ensure scalable administration and avoid individual user-level assignments.
* An automated reporting service must have Read access to the statements using a Shared Access Signature (SAS) that expires in 180 days, but the SAS must be capable of being revoked immediately if compromised without affecting other storage operations.

Which two configurations should you include in the design? (Select two.)

  1. Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID group containing the auditors eligible for the Storage Blob Data Reader role.Answer
  2. Generate the SAS token for the automated reporting service by associating it with a Stored Access Policy on the destination blob container.Answer
  3. C
    Assign the Storage Blob Data Reader role directly to the individual Entra ID user accounts of the auditors.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the auditors as active members of the Storage Blob Data Reader role.
  5. E
    Generate an ad-hoc service SAS token with a validity period of 180 days and configure it directly on the automated reporting service.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID group containing the auditors eligible for the Storage Blob Data Reader role, and generate the SAS token for the automated reporting service by associating it with a Stored Access Policy on the destination blob container.
The correct configurations involve using Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID group containing the auditors eligible for the Storage Blob Data Reader role, and generating the SAS token for the automated reporting service by associating it with a Stored Access Policy. Using PIM with an eligible group assignment ensures JIT access, approval workflows, and scalable group management. Associating the SAS token with a Stored Access Policy enables immediate revocation by removing or modifying the policy without rotating storage account keys.

Step-by-Step Solution

1
Analyze the access requirements for the internal auditors.
Auditors require temporary access that is group-managed and requires MFA/approval on activation.
Privileged Identity Management (PIM) provides just-in-time (JIT) access control. Assigning eligibility to a group ensures group-level scalability and prevents direct user-level role assignments.
2
Analyze the access requirements for the automated reporting service.
The service requires a SAS token valid for 180 days that can be revoked immediately.
An ad-hoc SAS token cannot be individually revoked before its expiration date. Associating the SAS token with a Stored Access Policy enables individual revocation by deleting or updating the policy on the storage container.

Key Concept

Securing data storage access using just-in-time role eligibility via PIM and revocable SAS tokens via Stored Access Policies.
Rate this question