Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A gaming company is designing a secure storage solution to share log files stored in an Azure Blob Storage container named `gamelogs` with an external game analytics agency. The agency requires access to the container for 30 days from a specific public IP range. You must ensure that access can be revoked immediately if a security breach occurs. Additionally, a group of internal security administrators must be able to temporarily elevate their permissions to manage the storage account settings when an incident is reported, but they must not hold these privileges permanently. Which two actions should you include in the storage security design? (Select two.)

  1. Create a stored access policy on the container, and then generate a Shared Access Signature (SAS) token linked to this policy.Answer
  2. Configure Microsoft Entra Privileged Identity Management (PIM) to make the security administrators eligible for the Storage Account Contributor role.Answer
  3. C
    Generate an ad-hoc container-level Shared Access Signature (SAS) token with a 30-day validity period and apply the IP firewall rules directly to the token.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign the security administrators as permanently active in the Storage Account Contributor role.
  5. E
    Directly assign the Storage Blob Data Reader role to each external vendor analyst's Microsoft Entra guest account.

Answer

The correct actions are: creating a stored access policy on the container to generate a SAS token, and configuring Microsoft Entra Privileged Identity Management (PIM) to make security administrators eligible for the Storage Account Contributor role.
The correct approach uses a stored access policy on the blob container to generate the SAS token, allowing for instant revocation if needed by modifying or deleting the policy. It also uses Microsoft Entra Privileged Identity Management (PIM) to configure eligible role assignments for the security administrators, which ensures they only receive elevated permissions (just-in-time) after requesting activation.

Step-by-Step Solution

1
Analyze the requirement for sharing blob container access with external partners with the ability to revoke immediately.
Identify that a Shared Access Signature (SAS) is required, but it must be linked to a stored access policy to support immediate revocation without rotating the account keys.
Ad-hoc SAS tokens cannot be revoked individually; deleting or modifying a stored access policy is the only way to revoke a token without key rotation.
2
Analyze the requirement for temporary, non-permanent elevated permissions for security administrators.
Identify that Microsoft Entra Privileged Identity Management (PIM) must be used to configure the administrators as eligible for the required role, rather than active.
Configuring the role as eligible enforces just-in-time (JIT) access, aligning with the principle of least privilege.

Key Concept

Designing data storage security and access control using stored access policies and just-in-time identity management.
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic