Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A logistics company requires an external customs broker to upload shipping manifests to a specific Azure Blob Storage container named 'customs-docs' for a period of 90 days. The access method must satisfy the following requirements:
- Access must be limited strictly to the 'customs-docs' container.
- If the broker's contract is terminated early, access must be immediately revocable without changing storage account access keys or impacting other applications.
- The customs broker must not be required to authenticate via Microsoft Entra ID.

Which of the following access control methods should you implement?

  1. A service Shared Access Signature (SAS) token generated from a stored access policy on the containerAnswer
  2. B
    An ad-hoc service Shared Access Signature (SAS) token with an expiration time set to 90 days
  3. C
    An Azure RBAC role assignment of Storage Blob Data Contributor to individual Entra guest user accounts representing the broker's staff
  4. D
    A Microsoft Entra Privileged Identity Management (PIM) role assignment that grants the broker's group active access to the storage account

Answer

A service Shared Access Signature (SAS) token generated from a stored access policy on the container
The correct option provides a secure way to delegate container-scoped access to external entities without Entra ID authentication. By linking the service SAS token to a stored access policy, administrators can immediately revoke access by modifying or deleting the policy on the container. This does not require rotating the storage account keys, avoiding disruption to other applications.

Step-by-Step Solution

1
Determine the authentication mechanism
Since the external broker cannot use Microsoft Entra ID, Entra-based authentication (RBAC and PIM) is ruled out, pointing to Shared Access Signatures (SAS).
The scenario requires that the partner does not authenticate via Microsoft Entra ID.
2
Select the appropriate SAS type and scoping
Identify that a service SAS can be scoped to a single container ('customs-docs'), unlike an account SAS.
Access must be limited strictly to the container level.
3
Determine revocation strategy
Link the service SAS to a stored access policy rather than creating an ad-hoc SAS.
Stored access policies allow immediate revocation of the SAS by deleting or modifying the policy, whereas ad-hoc SAS tokens require rotating the storage account key to revoke, affecting other services.

Key Concept

Stored Access Policies vs. Ad-hoc SAS for Container Security and Revokability
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic