Examkin

Question

Difficulty: MediumBlob, File, and Disk Storage Solutions

A company is designing a storage solution for a document management application. The documents must be stored in Azure Blob Storage.

The solution must meet the following requirements:
- If an entire Azure region suffers a major outage, the storage solution must remain resilient and prevent data loss.
- Access to the files must be granted to external vendors using Shared Access Signatures (SAS) that can be invalidated immediately if a security compromise is suspected.

Which two storage configurations should you recommend to meet the requirements?

  1. Configure the storage account to use Geo-redundant storage (GRS).Answer
  2. B
    Configure the storage account to use Locally redundant storage (LRS).
  3. C
    Generate ad-hoc Shared Access Signatures (SAS) with an explicit expiration date and time in the URI.
  4. Create a stored access policy on the container and associate it with the Shared Access Signatures (SAS).Answer

Answer

Configure the storage account to use Geo-redundant storage (GRS) and create a stored access policy on the container to associate with the Shared Access Signatures (SAS).
To ensure protection against regional outages, the storage account must be configured with Geo-redundant storage (GRS), which replicates data to a secondary region. To allow immediate invalidation of Shared Access Signatures (SAS), you must use a stored access policy, which allows you to revoke or change the permissions of associated SAS tokens without modifying the storage account keys.

Step-by-Step Solution

1
Analyze the resiliency requirement for regional outages.
Locally redundant storage (LRS) is insufficient because it only replicates data within a single datacenter. Geo-redundant storage (GRS) must be selected to ensure data is copied to a secondary region, providing protection against a regional failure.
Choosing the correct storage redundancy tier ensures business continuity during regional disasters.
2
Analyze the security requirement for immediate SAS revocation.
Ad-hoc SAS URIs cannot be individually revoked without rotating the storage account keys (which affects all SAS tokens). Associating the SAS with a stored access policy allows the policy to be modified or deleted, instantly revoking all SAS tokens tied to that policy.
Stored access policies decouple the SAS token validation from account keys, allowing fine-grained and immediate access control revocation.

Key Concept

Azure storage redundancy options and secure access delegation via stored access policies.
Rate this question

Topics

Blob, File, and Disk Storage Solutions

More questions from this topic