An enterprise is designing the security and access control architecture for an Azure Storage account named finstatements that will host sensitive monthly financial statements. The design must meet the following requirements:
* Internal auditors must be granted temporary Read access to the statements only when actively performing a quarterly audit. The activation of this access must require multi-factor authentication (MFA) and administrative approval.
* Auditor access must be managed at a group level to ensure scalable administration and avoid individual user-level assignments.
* An automated reporting service must have Read access to the statements using a Shared Access Signature (SAS) that expires in 180 days, but the SAS must be capable of being revoked immediately if compromised without affecting other storage operations.
Which two configurations should you include in the design? (Select two.)
- Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID group containing the auditors eligible for the Storage Blob Data Reader role.Answer
- Generate the SAS token for the automated reporting service by associating it with a Stored Access Policy on the destination blob container.Answer
- CAssign the Storage Blob Data Reader role directly to the individual Entra ID user accounts of the auditors.
- DConfigure Microsoft Entra Privileged Identity Management (PIM) to assign the auditors as active members of the Storage Blob Data Reader role.
- EGenerate an ad-hoc service SAS token with a validity period of 180 days and configure it directly on the automated reporting service.