Examkin

Question

Difficulty: MediumData Storage Security and Access Control

An enterprise is designing a secure storage solution for archiving monthly financial audit reports in an Azure Blob Storage container. The solution must satisfy the following requirements:
- External financial auditors must be granted read access to the reports for exactly 30 days.
- The enterprise must have the ability to immediately revoke access for all auditors before the 30-day period expires without rotating the storage account access keys or impacting other applications.
- Storage administrators must manage the storage security settings by using just-in-time (JIT) access.

Which design strategy should you recommend?

  1. A
    Configure Microsoft Entra Privileged Identity Management (PIM) with active role assignments for storage administrators. Create a Microsoft Entra security group for the auditors, and generate an ad-hoc Shared Access Signature (SAS) token with a 30-day lifetime on the container.
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments for storage administrators. Assign the Storage Blob Data Reader role directly to each auditor's Microsoft Entra ID user account, and generate a Shared Access Signature (SAS) token associated with a stored access policy on the container.
  3. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments for storage administrators. Create a Microsoft Entra security group for the auditors, and generate a Shared Access Signature (SAS) token associated with a stored access policy on the container.Answer
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) with active role assignments for storage administrators. Assign the Storage Blob Data Reader role directly to each auditor's Microsoft Entra ID user account, and generate an ad-hoc Shared Access Signature (SAS) token with a 30-day lifetime on the container.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments for storage administrators. Create a Microsoft Entra security group for the auditors, and generate a Shared Access Signature (SAS) token associated with a stored access policy on the container.
The correct strategy uses eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for storage administrators. For the external auditors, a Microsoft Entra security group reduces operational overhead compared to direct assignments. Associating the SAS token with a stored access policy enables immediate revocation of the SAS token at any time by modifying or deleting the policy, avoiding the disruption of rotating the storage account's master keys.

Step-by-Step Solution

1
Configure JIT access for security administrators.
Administrators use Microsoft Entra Privileged Identity Management (PIM) with eligible assignments rather than permanent active access.
This implements the principle of least privilege by ensuring administrative permissions are only active when needed and require justification/approval.
2
Configure the security boundary and access method for the auditing team.
Auditors are placed in a Microsoft Entra security group, and access is granted via a Shared Access Signature (SAS) token.
Grouping users prevents the overhead of direct RBAC assignments and aligns with identity lifecycle management best practices.
3
Associate the SAS token with a Stored Access Policy (SAP).
The SAS token's permissions and lifetime (30 days) are bound to a stored access policy defined on the blob container.
An SAP allows the enterprise to instantly revoke the SAS token by deleting or modifying the policy, removing the need to rotate storage account keys.

Key Concept

Data Storage Security and Access Control
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic