Examkin

Question

Difficulty: HardData Storage Security and Access Control

You are designing the security and access control architecture for an Azure Storage account named clinicaldata that contains proprietary research datasets. The solution must satisfy the following requirements:
- Internal researchers must only be granted access to the data during active project phases, which typically last up to 90 days. They must not have permanent standing permissions.
- Permissions for the internal researchers must be managed collectively to minimize administrative overhead.
- An external third-party analysis tool requires write access to a specific container for the same 90-day period. The tool does not support Microsoft Entra ID authentication.
- Access for the third-party tool must be easily revoked if a security compromise is suspected, without rotating the storage account keys and without affecting other workloads.

Which access control configuration should you recommend to meet these requirements?

  1. A
    Assign researchers to a Microsoft Entra ID security group configured with an active role assignment in Privileged Identity Management (PIM) for the Storage Blob Data Reader role. For the third-party tool, generate an ad-hoc Service Shared Access Signature (SAS) token with a 90-day validity period.
  2. Assign researchers to a Microsoft Entra ID security group configured with an eligible role assignment in Privileged Identity Management (PIM) for the Storage Blob Data Reader role. For the third-party tool, generate a Service Shared Access Signature (SAS) token associated with a Stored Access Policy.Answer
  3. C
    Assign the Storage Blob Data Reader role directly to each researcher's Entra ID account as an active assignment. For the third-party tool, generate an ad-hoc User Delegation SAS token with a 90-day validity period.
  4. D
    Assign researchers to a Microsoft Entra ID security group. For the third-party tool, generate an ad-hoc Service Shared Access Signature (SAS) token with a 90-day expiration period, signed directly with the storage account key without a stored access policy.

Answer

Assign researchers to a Microsoft Entra ID security group configured with an eligible role assignment in Privileged Identity Management (PIM) for the Storage Blob Data Reader role. For the third-party tool, generate a Service Shared Access Signature (SAS) token associated with a Stored Access Policy.
The correct design utilizes a Microsoft Entra ID security group to simplify administration, combined with Privileged Identity Management (PIM) eligible role assignments to ensure researchers do not have permanent standing access. For the third-party tool that cannot authenticate using Entra ID, a Service Shared Access Signature (SAS) token associated with a Stored Access Policy is the best approach. The Stored Access Policy allows administrators to revoke the SAS token immediately by deleting or modifying the policy, without needing to rotate the storage account keys.

Step-by-Step Solution

1
Configure administrative access for internal users.
Create a Microsoft Entra ID security group and assign researchers to it. Then, configure Privileged Identity Management (PIM) with an eligible assignment to the Storage Blob Data Reader role.
Using security groups reduces administrative overhead. Configuring the role as eligible in PIM ensures that researchers only activate the role when needed and that permissions automatically expire after the active phase, preventing standing access.
2
Configure access for the external third-party analysis tool.
Establish a Stored Access Policy on the target container, and then generate a Service Shared Access Signature (SAS) token associated with that policy.
Because the third-party tool does not support Entra ID, a SAS token is required. Associating it with a Stored Access Policy allows administrators to revoke access instantly by deleting or modifying the policy, bypassing the need to rotate the storage account keys.

Key Concept

Implementing least privilege, just-in-time access, and revocable delegation for Azure Storage.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic