Examkin

Question

Difficulty: HardData Storage Security and Access Control

A media production company stores high-value, pre-release film assets in an Azure Blob Storage container named `pre-release-footage`. You must design an access control solution that meets the following requirements:
1. Internal media editors must be allowed to modify the storage account's networking configurations and manage access keys, but only during scheduled maintenance windows. Their elevated access must require justification and automatically expire after 2 hours.
2. An external post-production vendor must be granted read-only access to a specific folder within `pre-release-footage` for exactly 30 days. If the vendor's access credentials are leaked, security administrators must be able to immediately revoke access for this vendor without rotating the storage account access keys or affecting other active tokens.
3. Access privileges must be granted to Microsoft Entra security groups rather than individual user accounts to ensure scalable management.

Which access control and security design should you recommend?

  1. A
    Assign the Storage Account Contributor role directly to the individual Entra ID user accounts of the media editors. For the post-production vendor, generate an ad-hoc Account SAS token with a validity period of 30 days.
  2. B
    Create an Entra ID security group for the media editors and assign it a permanently active role assignment in Privileged Identity Management (PIM) for the Storage Account Contributor role. For the post-production vendor, generate an ad-hoc Service SAS token with a 30-day lifespan.
  3. Create an Entra ID security group for the media editors and configure an eligible role assignment in Privileged Identity Management (PIM) for the Storage Account Contributor role with a 2-hour activation limit. For the post-production vendor, configure a Stored Access Policy on the container and generate a Service SAS token associated with that policy.Answer
  4. D
    Assign individual media editors as eligible for the Storage Account Contributor role in Privileged Identity Management (PIM) with a 2-hour activation limit. For the post-production vendor, generate a User Delegation SAS token with a 30-day lifespan and grant the Storage Blob Data Reader role directly to the vendor's individual guest user account.

Answer

Create a Microsoft Entra ID security group for the media editors and configure an eligible role assignment in Privileged Identity Management (PIM) for the Storage Account Contributor role with a 2-hour activation limit. For the post-production vendor, configure a Stored Access Policy on the container and generate a Service SAS token associated with that policy.
The correct design uses a Microsoft Entra security group with an eligible role assignment in Privileged Identity Management (PIM) to grant just-in-time access that requires activation and expires after 2 hours. For the partner access, configuring a Stored Access Policy on the container and generating a Service SAS token associated with that policy allows administrators to immediately revoke access by deleting or modifying the policy, without rotating storage keys or affecting other tokens.

Step-by-Step Solution

1
Configure role delegation for internal editors.
Create a security group containing the internal editors and define an eligible role assignment for Storage Account Contributor in Privileged Identity Management (PIM) with a 2-hour activation limit.
This provides just-in-time (JIT) access that requires justification, enforces the 2-hour duration limit, and follows group-based role assignments rather than individual mappings.
2
Configure the token-based access mechanism for the external vendor.
Define a Stored Access Policy on the target container and generate a Service SAS token linked to this policy.
Associating the Service SAS with a Stored Access Policy allows administrators to revoke access immediately by deleting or modifying the policy on the container, avoiding key rotation.
3
Ensure all identity requirements align with best practices.
Verify that no roles are assigned directly to individual users and no ad-hoc SAS tokens are used.
This guarantees compliance with scalability, governance, and auditability requirements.

Key Concept

Data Storage Security and Access Control
Estimated Time:2m 30s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic