Examkin

Question

Difficulty: Very hardData Storage Security and Access Control

A financial services firm is designing a secure storage solution for a multi-tenant payment processing platform. Transaction logs are stored in an Azure Blob Storage container named `ledgers`. The solution must satisfy the following security and governance requirements:

- External compliance auditors require read access to the `ledgers` container for a single 8-hour audit window. If a security incident is detected, administrative access must be capable of immediately terminating the auditors' access without affecting other storage operations or rotating the master storage account keys.
- The internal security engineering team requires administrative access to manage the storage account settings and access policies. Their access must follow the principle of least privilege, utilizing Just-in-Time (JIT) access elevation and avoiding direct user assignments to ensure scalable governance.

Which two security controls should you recommend to meet these requirements?

  1. For the external auditors, configure a Stored Access Policy on the `ledgers` container and generate a Shared Access Signature (SAS) token associated with that policy.Answer
  2. For the internal security engineering team, create a Microsoft Entra ID security group, assign the required storage administrative RBAC roles to the group, and configure eligible assignments using Privileged Identity Management (PIM).Answer
  3. C
    For the external auditors, generate an ad-hoc Service Shared Access Signature (SAS) token with an 8-hour expiration time directly in the token parameters.
  4. D
    For the internal security engineering team, assign the administrative RBAC roles directly to each individual security engineer's user account at the storage account scope.
  5. E
    For the internal security engineering team, configure active assignments in Microsoft Entra ID Privileged Identity Management (PIM) for each user account.

Answer

Configure a Stored Access Policy on the container and associate the SAS token with it for the external auditors, and create a Microsoft Entra ID security group with eligible assignments in Privileged Identity Management (PIM) for the security engineering team.
Associating the external auditors' Shared Access Signature (SAS) with a Stored Access Policy allows administrators to revoke access instantly by deleting or changing the policy, meeting the compliance window and safety parameters. Using a Microsoft Entra ID group with eligible Privileged Identity Management (PIM) assignments for the internal team ensures administrative access is governed via groups and elevated only when needed (JIT).

Step-by-Step Solution

1
Analyze the access revocation requirement for the external auditors.
Identified that immediate, non-disruptive revocation is required.
An ad-hoc SAS token cannot be revoked without key rotation. A Stored Access Policy (SAP) allows immediate revocation by modifying or deleting the policy directly on the container.
2
Analyze the identity and governance requirements for the internal security team.
Identified that JIT access and scalable governance are required.
Direct assignments to user accounts are unscalable. Security groups should be used. JIT requires PIM eligible assignments rather than active ones.
3
Select the configuration options that implement both secure controls.
Selected the Stored Access Policy strategy and the Entra ID group with PIM eligible assignment.
This combination satisfies the revocation constraint for external users and the JIT and group-based access requirements for internal administrators.

Key Concept

Azure Storage access control and privilege governance using Stored Access Policies and Entra ID Privileged Identity Management.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic