Examkin

Question

Difficulty: MediumData Storage Security and Access Control

An enterprise is planning to grant a third-party auditing firm temporary read-only access to financial reports stored in an Azure Blob Storage container for 14 days. The access must be easily revocable at any time during this period without affecting other storage access methods. Additionally, internal security administrators require temporary elevated access to manage the storage account settings, but only when actively performing audit tasks. Which of the following security and access control configurations should you recommend to meet these requirements? (Select TWO.)

  1. Configure a Stored Access Policy on the blob container and generate a Service Shared Access Signature (SAS) token associated with the policy for the external audit partners.Answer
  2. Configure Microsoft Entra Privileged Identity Management (PIM) to make the internal security administrators eligible for the Storage Blob Data Owner role.Answer
  3. C
    Generate an ad-hoc Shared Access Signature (SAS) token with a 14-day duration directly on the storage account for the external audit partners.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) with permanently active role assignments for the internal security administrators.
  5. E
    Assign the Storage Blob Data Reader role directly to each external auditor's individual Microsoft Entra ID user account.

Answer

Configure a Stored Access Policy on the blob container and generate a Service Shared Access Signature (SAS) token associated with the policy for the external audit partners, and configure Microsoft Entra Privileged Identity Management (PIM) to make the internal security administrators eligible for the Storage Blob Data Owner role.
The correct solution involves using a Stored Access Policy paired with a Service SAS to facilitate instant revocation, and utilizing Microsoft Entra PIM with eligible role assignments to implement just-in-time access for internal administrators.

Step-by-Step Solution

1
Evaluate the requirement for temporary, revocable access to the blob container for the external auditing firm.
Identify that using a Service SAS linked to a Stored Access Policy on the container allows instant revocation by changing or deleting the policy.
Ad-hoc SAS tokens cannot be individually revoked without rotating storage account keys, making a stored access policy necessary.
2
Evaluate the requirement for internal security administrators to have temporary elevated access to storage account settings.
Identify that Microsoft Entra Privileged Identity Management (PIM) should be configured to make the administrators eligible for the role rather than permanently assigned.
This enforces the principle of least privilege by requiring justification and approvals to activate the role for a limited time.

Key Concept

Securing data storage access using Stored Access Policies for SAS revocation and Microsoft Entra PIM for just-in-time administrative access control.
Estimated Time:2m 0s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic