Examkin

Question

Difficulty: Very hardData Storage Security and Access Control

A healthcare organization is migrating an on-premises Electronic Health Record (EHR) system to Azure. The design requires configuring secure access to an Azure Storage account named ehrdata that contains sensitive patient medical images in a blob container.

The solution must meet the following security requirements:
- External partner radiologists must be granted temporary read-only access to the blob container for 7 days. This access must be immediately revocable at any time before the 7 days expire.
- Internal compliance auditors require access to review the data, and the configuration must enforce scalable access control using identity best practices.
- Security administrators must be able to rotate storage keys, but only during scheduled audit windows, requiring manager approval before they can perform this action.

Which three actions should you include in the storage security and access control design? (Select three.)

  1. Create a Stored Access Policy on the destination container, and generate a Shared Access Signature (SAS) token associated with that policy for the external radiologists.Answer
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token directly on the container with a validity of 7 days for the external radiologists.
  3. Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group containing the internal auditors.Answer
  4. D
    Assign the Storage Blob Data Reader role directly to the individual user accounts of each internal compliance auditor.
  5. Configure Microsoft Entra Privileged Identity Management (PIM) to make the security administrators eligible for the Storage Account Key Operator Service Role, requiring approval to activate.Answer
  6. F
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the Storage Account Key Operator Service Role as active to the security administrators.

Answer

To secure the storage account, you should create a Stored Access Policy on the destination container and generate a associated SAS token; assign the Storage Blob Data Reader role to a Microsoft Entra ID security group rather than individual users; and configure Microsoft Entra PIM to make security administrators eligible for the Storage Account Key Operator Service Role with activation approval required.
The correct architecture leverages a Stored Access Policy to bind the SAS token lifetime and permissions, facilitating revocation at any time. It uses Microsoft Entra ID security groups for scalable role assignments to enforce governance. Finally, it implements Privileged Identity Management (PIM) with eligible role assignments to enforce just-in-time (JIT) administrative access requiring workflow approval.

Step-by-Step Solution

1
Address external partner access security
Create a Stored Access Policy on the container and generate an associated SAS token.
This configuration allows the organization to revoke the SAS token early by changing the stored policy constraints or deleting the policy, without impacting other integrations.
2
Address auditor access scalability
Create a security group in Microsoft Entra ID, add the auditors to the group, and assign the Storage Blob Data Reader role to the group.
Direct role assignments to individual users do not scale and make access governance auditing difficult.
3
Address administrator privilege escalation
Configure Privileged Identity Management (PIM) with eligible assignments for the Storage Account Key Operator Service Role, requiring approval.
Active assignments leave administrative privileges permanently active, which violates the principle of least privilege and just-in-time access.

Key Concept

Applying least privilege, scalability, and revocability to Azure Storage security.
Estimated Time:3m 0s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic