Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A legal services firm is designing a secure Azure Blob storage solution for hosting sensitive litigation files. External forensic investigators require temporary read-only access to specific folders inside a container for a period of up to 48 hours. The access must be restricted to a specific external public IP range. The firm's security policy requires that administrative control must be maintained to immediately revoke access if a breach is suspected, without rotating the storage account access keys or impacting other active access tokens. Which two configuration steps should you include in the design to meet these security requirements? (Select TWO.)

  1. Create a stored access policy on the target container and generate a Shared Access Signature (SAS) token associated with that policy.Answer
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token with a 48-hour expiration directly on the container parameters.
  3. C
    Assign the Storage Blob Data Reader role directly to the individual external investigator Microsoft Entra ID user accounts.
  4. Configure the allowed public IP address range directly on the parameters of the generated Shared Access Signature (SAS) token.Answer
  5. E
    Configure a Microsoft Entra Privileged Identity Management (PIM) active assignment for the Storage Blob Data Reader role on the storage account.

Answer

Create a stored access policy on the target container, generate a Shared Access Signature (SAS) token associated with that policy, and configure the allowed public IP address range directly on the parameters of the generated SAS token.
To implement immediately revocable, time-bound access for external users without rotating storage account keys, you must create a stored access policy and generate a SAS token associated with that policy. Deleting or modifying the policy immediately invalidates the SAS token. To restrict the network origin, you must configure the allowed public IP address range directly in the SAS token parameters.

Step-by-Step Solution

1
Select the appropriate authorization method to allow external, temporary, and immediately revocable access.
Identify that Shared Access Signatures (SAS) are ideal for external users, but must be tied to a Stored Access Policy to enable immediate revocation without rotating keys.
Ad-hoc SAS tokens cannot be revoked individually; deleting or modifying a Stored Access Policy immediately invalidates all SAS tokens generated from it.
2
Address the network restriction requirement.
Configure the allowed IP address range parameter on the SAS token.
This restricts access to the specified public IP range of the external investigators at the authentication layer.

Key Concept

Stored Access Policies vs. Ad-hoc SAS and parameter-based network constraints for access control.
Estimated Time:2m 0s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic