Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A media production agency is designing a secure storage solution on Azure to allow external freelance animators to upload raw rendering files to a specific Blob storage container named raw-renders. The access must meet the following requirements:

1. The animators must only have access to the raw-renders container for a maximum of 30 days.
2. The security team must be able to instantly revoke access to the container in the event of a credential leak, without rotating the storage account access keys or impacting other applications.
3. Access must be granted with the minimum necessary permissions.

Which of the following access control strategies should you recommend?

  1. Generate a Service Shared Access Signature (SAS) token associated with a Stored Access Policy defined on the raw-renders container.Answer
  2. B
    Generate an ad-hoc Service Shared Access Signature (SAS) token with a 30-day expiration directly on the raw-renders container.
  3. C
    Assign the Storage Blob Data Contributor role directly to each animator's Microsoft Entra ID user account at the container scope.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the animators a custom RBAC role with permanently active status at the container scope.

Answer

Generate a Service Shared Access Signature (SAS) token associated with a Stored Access Policy defined on the container.
Generating a Service SAS token associated with a Stored Access Policy is correct because Stored Access Policies provide a way to revoke or change the permissions of issued SAS tokens. Since the SAS token is tied to the policy, deleting or modifying the policy immediately invalidates the SAS token without needing to rotate the storage account's master access keys.

Step-by-Step Solution

1
Analyze the requirements for access delegation, lifetime restriction, and instant revocation without key rotation.
Identified that ad-hoc SAS is insufficient because it cannot be revoked without rotating storage account keys, and direct user RBAC or permanently active PIM configurations violate other access governance rules.
Establishing the security boundary and constraints helps narrow down the acceptable mechanisms for Azure Blob Storage access.
2
Evaluate the capabilities of Stored Access Policies on Azure Blob Storage containers.
Determined that a Stored Access Policy can group constraints (permissions, start/expiry time) and allows instant revocation by modifying or deleting the policy.
A Service SAS inherits constraints from the Stored Access Policy, making the policy a centralized control point for revocation.
3
Select the option that utilizes a Stored Access Policy to bind the SAS token.
Selected the option to generate a Service SAS associated with a Stored Access Policy.
This strategy satisfies the 30-day access window, ensures least privilege, and allows instant revocation without rotating the primary/secondary keys of the storage account.

Key Concept

Stored Access Policies provide a way to group constraints and manage permissions for container-level Service Shared Access Signatures, allowing easy revocation.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic