Examkin

Question

Difficulty: HardData Storage Security and Access Control

A healthcare organization is designing a security and access control solution for clinical trial data uploaded by external research partners to a private container in an Azure Storage account named clinicaltrialsdata. The solution must meet the following requirements:
- External partners must be granted temporary access to upload new data files directly to the container, without the ability to delete or modify existing files.
- The access credentials given to external partners must be immediately revocable in bulk, without regenerating the storage account access keys.
- Internal data auditors must have read-only access to the data, restricted to when they are performing active audits. The access must require approval and be restricted to a maximum duration of 8 hours.
- Administrative overhead must be minimized, and all assignments must adhere to the principle of least privilege and scale effectively.
Which of the following security architectures should you recommend?

  1. A
    Generate ad-hoc Shared Access Signature (SAS) tokens with Write permissions for the external partners. Assign the Storage Blob Data Reader role directly to the individual user accounts of the internal data auditors, configuring the assignment to expire after 8 hours.
  2. B
    Configure a Stored Access Policy on the container with Write permissions and generate Shared Access Signature (SAS) tokens associated with the policy for the external partners. Create a Microsoft Entra security group for the internal data auditors and assign the Storage Blob Data Reader role directly to the group as a permanently active assignment.
  3. Configure a Stored Access Policy on the container with Write permissions and generate Shared Access Signature (SAS) tokens associated with the policy for the external partners. Create a Microsoft Entra security group for the internal data auditors and configure Privileged Identity Management (PIM) to make the group eligible for the Storage Blob Data Reader role.Answer
  4. D
    Generate ad-hoc Shared Access Signature (SAS) tokens with Write permissions for the external partners. Create a Microsoft Entra security group for the internal data auditors and configure Privileged Identity Management (PIM) to make the group eligible for the Storage Blob Data Contributor role.

Answer

Configure a Stored Access Policy on the container with Write permissions and generate Shared Access Signature (SAS) tokens associated with the policy for the external partners. Create a Microsoft Entra security group for the internal data auditors and configure Privileged Identity Management (PIM) to make the group eligible for the Storage Blob Data Reader role.
The correct architecture uses a Stored Access Policy to manage external uploads, allowing immediate revocation of the associated Shared Access Signature (SAS) tokens by altering or deleting the policy rather than regenerating the storage account keys. For internal data auditors, a Microsoft Entra ID group mapped to an eligible assignment in Privileged Identity Management (PIM) guarantees that read-only access (Storage Blob Data Reader) is only active when requested and approved, up to a strict limit of 8 hours. This satisfies all constraints, scales cleanly, and adheres to the principle of least privilege.

Step-by-Step Solution

1
Address external partner access and bulk revocation requirements.
Create a Stored Access Policy on the target container with Write-only permissions and issue SAS tokens linked to it.
Linking SAS tokens to a Stored Access Policy enables immediate bulk revocation by modifying or deleting the policy, avoiding the need to regenerate the primary storage keys. Write-only permissions satisfy least privilege by preventing external partners from viewing or modifying existing data.
2
Address the identity grouping and scalability requirements for internal auditors.
Create a Microsoft Entra security group and place all internal data auditors into the group.
Assigning RBAC roles to groups instead of individual users reduces administrative overhead, ensures scalability, and simplifies access tracking.
3
Address time-bound, approved access (Just-In-Time) for audits.
Configure Microsoft Entra Privileged Identity Management (PIM) to make the auditors group eligible for the Storage Blob Data Reader role.
PIM allows users to request activation of their eligible role only when needed (JIT). Security administrators can set activation settings to require approval and limit the maximum duration to 8 hours. The Storage Blob Data Reader role provides the required read-only access.

Key Concept

Securing data storage access using Stored Access Policies for SAS control combined with Microsoft Entra ID groups and Privileged Identity Management (PIM) for Just-In-Time role-based access.
Estimated Time:2m 0s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic