Examkin

Question

Difficulty: HardData Storage Security and Access Control

A maritime shipping enterprise is designing a secure ingestion pipeline for container telemetry logs stored in an Azure Blob Storage account named telemetrydata. External IoT gateway devices managed by a third-party vendor must upload telemetry files to a container named uploads. The security design must meet the following requirements:
- The gateway devices must only be allowed to write data to the container and must be blocked from reading, listing, or modifying existing data.
- The access credentials must expire after 90 days, and security administrators must have the ability to immediately revoke all outstanding access tokens in the event of a gateway breach without modifying storage account keys.
- All traffic to the storage account must be restricted to the vendor's dedicated public outbound IP range.

Which two actions should you include in the design?

  1. Create a Stored Access Policy on the uploads container specifying Write-only permissions and generate a service Shared Access Signature (SAS) token referencing the policy.Answer
  2. Configure the storage account firewall to restrict access, permitting traffic only from the vendor's dedicated public outbound IP range.Answer
  3. C
    Generate an ad-hoc Shared Access Signature (SAS) token with Write-only permissions and a 90-day validity period directly on the container.
  4. D
    Assign the Storage Blob Data Contributor role directly to each IoT gateway device's managed identity.

Answer

Create a Stored Access Policy on the uploads container specifying Write-only permissions and generate a service Shared Access Signature (SAS) token referencing the policy, and configure the storage account firewall to restrict access, permitting traffic only from the vendor's dedicated public outbound IP range.
To support immediate revocation of the access tokens without modifying the storage account keys, a Stored Access Policy must be created. Modifying or deleting the Stored Access Policy immediately invalidates any service SAS tokens associated with it. Restricting the storage account firewall to specific outbound IP ranges secures the network perimeter by ensuring only traffic from the vendor's IoT gateway devices is allowed.

Step-by-Step Solution

1
Analyze the token revocation requirement.
Identify that ad-hoc SAS tokens require storage account key rotation to revoke early, whereas service SAS tokens linked to a Stored Access Policy can be revoked instantly by modifying or deleting the policy.
To satisfy the constraint of immediate token revocation without modifying storage account keys.
2
Evaluate the network access control requirements.
Determine that the Azure Storage firewall must be configured to permit traffic exclusively from the third-party vendor's public IP addresses.
To satisfy the requirement of restricting traffic to the vendor's dedicated public outbound IP range.
3
Evaluate identity-based access controls against requirements.
Identify that direct assignment of the Storage Blob Data Contributor role violates the least-privilege policy (since it allows read and delete operations) and violates governance best practices.
To rule out the direct RBAC assignment distractor.

Key Concept

Securing Azure Storage access through a combination of network firewalls and revocable service SAS tokens using Stored Access Policies.
Estimated Time:2m 30s
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic