Examkin

Question

Difficulty: HardData Storage Security and Access Control

An automotive engineering company is designing a secure storage solution on Azure for crash test simulation video files. The files will be stored in an Azure Blob Storage container. The design must meet the following requirements:
1. Internal simulation analysis engineers must have read access to the video files. Access permissions must be managed collectively to minimize administrative overhead, rather than at the individual user level.
2. Storage administrators must have administrative permissions to manage the storage resources. These permissions must be granted dynamically on-demand with a required approval workflow, rather than being permanently assigned.
3. An external safety auditing partner needs temporary read-only access to specific video files. This access must be easily revocable at any time and must expire automatically after 30 days. The duration of this access must be controlled from the server side rather than by the client.

Which of the following security controls should you include in the storage design to meet these requirements? (Select TWO.)

  1. Configure a Stored Access Policy on the blob container and generate a Shared Access Signature (SAS) token associated with this policy for the external safety auditing partner.Answer
  2. Create a Microsoft Entra ID security group for the simulation analysis engineers, assign the Storage Blob Data Reader role to the group, and configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the storage administrator roles.Answer
  3. C
    Directly assign the Storage Blob Data Reader role to the user account of each simulation analysis engineer, and configure permanent active roles for the storage administrators.
  4. D
    Generate an ad-hoc Shared Access Signature (SAS) token for the external safety auditing partner with a 30-day expiration defined directly in the token parameters without using a stored access policy.
  5. E
    Configure Microsoft Entra Privileged Identity Management (PIM) with permanently active role assignments for the storage administrators to allow continuous access management.

Answer

Configure a Stored Access Policy on the blob container and generate a Shared Access Signature (SAS) token associated with this policy for the external safety auditing partner, and create a Microsoft Entra ID security group for the simulation analysis engineers, assigning the Storage Blob Data Reader role to the group and configuring Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the storage administrator roles.
The correct options are: configuring a Stored Access Policy on the blob container and generating a SAS token associated with it, and creating an Entra ID group for RBAC with PIM eligible assignments for storage admins. The Stored Access Policy allows server-side revocation and validation. Group-based RBAC combined with eligible PIM roles satisfies governance, scalability, and dynamic on-demand approval requirements.

Step-by-Step Solution

1
Evaluate the security and lifecycle management requirements for the storage administrators.
Administrative permissions must be dynamic and request-based, requiring Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments rather than permanent active ones.
This implements the principle of least privilege and just-in-time administrative access.
2
Determine the access governance strategy for internal simulation analysis engineers.
Create an Entra ID security group, assign the Storage Blob Data Reader role to the group, and add the engineers to this group.
Assigning permissions to groups instead of individual users reduces operational overhead and scales administrative management.
3
Design the temporary, revocable access mechanism for the external safety auditing partner.
Configure a Stored Access Policy on the container and generate a SAS token associated with that policy.
A stored access policy allows revocation of the token on the server side by altering or deleting the policy, without needing to rotate the account keys which would impact other clients.

Key Concept

Designing secure access and governance using RBAC groups, Privileged Identity Management, and Stored Access Policies for Azure Storage.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic