Examkin

Question

Difficulty: MediumData Storage Security and Access Control

An enterprise is migrating an on-premises document management system to Azure Blob Storage. The system will store sensitive contract documents in a container named contracts. You need to design an access control solution that meets the following security requirements:

1. Internal operations staff must be granted read and write access to the contracts. Access management must scale efficiently as staff members join or leave the team.
2. External legal auditors must be granted temporary read-only access to specific documents. The company must be able to revoke this access immediately if an audit is terminated, without disrupting other clients or regenerating storage account keys.

Which two actions should you include in the design? (Select two.)

  1. Assign the Storage Blob Data Contributor role to a Microsoft Entra ID security group that contains the internal operations staff.Answer
  2. Define a Stored Access Policy on the container and generate Shared Access Signature (SAS) tokens associated with the policy for the external legal auditors.Answer
  3. C
    Assign the Storage Blob Data Contributor role directly to each internal operations staff member's Entra ID user account.
  4. D
    Generate ad-hoc Shared Access Signature (SAS) tokens with a one-year duration directly in the URI for the external legal auditors.

Answer

To secure access to the contracts container, you should assign the Storage Blob Data Contributor role to a Microsoft Entra ID security group containing the internal operations staff, and define a Stored Access Policy on the container to generate Shared Access Signature tokens for the external legal auditors.
The correct design uses a Microsoft Entra ID security group for internal staff to simplify access administration. It also uses a Stored Access Policy on the container to generate SAS tokens for external legal auditors, which allows the company to immediately revoke the access tokens by deleting or altering the policy, without impacting any other clients or rotating storage account keys.

Step-by-Step Solution

1
Address scalable internal operations access control.
Map internal staff to a Microsoft Entra ID security group and assign the group the Storage Blob Data Contributor role at the container or storage account scope.
This avoids direct user RBAC assignments and simplifies access management as team members change.
2
Address secure and revocable external access control.
Define a Stored Access Policy on the target container and generate SAS tokens linked to this policy.
Stored access policies allow immediate revocation of associated SAS tokens without needing to rotate storage account keys, which would affect other clients.

Key Concept

Combining Entra ID security groups for scalable role-based access control (RBAC) with Stored Access Policies for revocable Shared Access Signatures (SAS).
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic