Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A software development company is designing a security and access control strategy for an Azure Storage account named devlogs. You must design a solution that meets the following requirements:

1. A team of five internal security auditors must be granted temporary access to read audit logs in a specific blob container for 90 days. The solution must support immediate revocation of this access.
2. A database administrator must be able to manage the storage account configurations, but only when actively performing scheduled maintenance tasks. This administrative access must not be permanently active.
3. Access configuration must follow the principle of least privilege and minimize administrative overhead.

Which two actions should you include in the design?

  1. Configure a Microsoft Entra Privileged Identity Management (PIM) eligible role assignment for the database administrator.Answer
  2. Create a stored access policy on the container, and generate a service shared access signature (SAS) token associated with the policy.Answer
  3. C
    Configure a Microsoft Entra Privileged Identity Management (PIM) active role assignment for the database administrator.
  4. D
    Generate an ad-hoc service shared access signature (SAS) token on the container with a validity period of 90 days.
  5. E
    Assign the Storage Blob Data Reader role directly to each of the five security auditor user accounts.

Answer

To secure access, you should configure a Microsoft Entra Privileged Identity Management (PIM) eligible role assignment for the database administrator, and create a stored access policy on the container to generate an associated service shared access signature (SAS) token.
To fulfill the database administrator requirement, configuring an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) ensures the administrator must explicitly activate the role for a limited time when performing maintenance, avoiding permanently active administrative rights. To fulfill the auditor requirement, a stored access policy controls the service SAS token's validity and allows immediate revocation by modifying or deleting the policy, avoiding storage key rotation.

Step-by-Step Solution

1
Analyze the database administrator's administrative access requirement.
The database administrator needs scheduled, temporary access to manage storage account configurations.
Using Microsoft Entra Privileged Identity Management (PIM) with an eligible assignment ensures that the role is only active when needed (just-in-time) rather than permanently active, satisfying the principle of least privilege.
2
Analyze the security auditors' temporary access requirement.
The auditors need read-only access to a specific container for 90 days, with the ability to revoke access immediately.
A stored access policy defined on the container allows you to control the start time, expiry time, and permissions of a service SAS token. Deleting or modifying the policy immediately revokes the SAS token's access without rotating storage account keys.
3
Evaluate the incorrect options against security best practices.
Direct RBAC assignments, permanently active PIM roles, and ad-hoc SAS tokens are ruled out.
Direct RBAC assignments increase administrative overhead; active PIM assignments grant persistent administrative rights; ad-hoc SAS tokens cannot be revoked individually without rotating storage keys.

Key Concept

Implementing least privilege and dynamic access control for Azure Storage resources using Stored Access Policies and Privileged Identity Management (PIM).
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic