Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A financial technology company is planning the security model for an Azure Storage account that holds sensitive transaction logs. The design must satisfy the following security requirements:

* Developers must only obtain administrative access to the storage account during active troubleshooting sessions, with all access requests requiring approval and auditing.
* An external compliance auditor requires read-only access to a specific container for 90 days, with the ability to revoke this access immediately at any time without changing account keys.
* Internal applications must be granted read access to the transaction logs using a scalable role assignment model that minimizes administrative overhead.

Which two security controls should you recommend to meet these requirements?

  1. Utilize a stored access policy on the container to generate and manage the Shared Access Signature (SAS) token for the external auditor.Answer
  2. Configure Azure AD Privileged Identity Management (PIM) to make the developer security group eligible for the Storage Account Contributor role.Answer
  3. C
    Issue an ad-hoc Shared Access Signature (SAS) token with a validity period of 90 days for the auditor.
  4. D
    Assign the Storage Blob Data Reader role directly to individual developer user accounts.
  5. E
    Configure Privileged Identity Management (PIM) to assign the Storage Account Contributor role as permanently active for the developer accounts.

Answer

Utilize a stored access policy on the container to generate and manage the Shared Access Signature (SAS) token for the external auditor, and configure Azure AD Privileged Identity Management (PIM) to make the developer security group eligible for the Storage Account Contributor role.
The correct options are utilizing a stored access policy for SAS token management and configuring PIM eligible assignments for the developer group. A stored access policy provides fine-grained control and revocation capability over SAS tokens. PIM eligible assignments ensure that developers only obtain administrative privileges when they explicitly request activation during troubleshooting, which requires approval and generates audit logs.

Step-by-Step Solution

1
Address the external auditor's temporary, revocable access requirement.
Identify that a stored access policy allows modification or revocation of the Shared Access Signature (SAS) token's permissions and expiration date without rotating the master storage account keys.
This directly satisfies the requirement for a 90-day revocable access window.
2
Address the developers' temporary administrative access requirement.
Select Microsoft Entra ID Privileged Identity Management (PIM) and configure eligible (just-in-time) assignments requiring approvals.
This satisfies the requirement that administrative access is only active during troubleshooting sessions and is fully audited.
3
Evaluate the scalability and administrative overhead of role assignments.
Discard options suggesting direct user-to-role assignment, ensuring RBAC is managed via groups or eligible PIM roles.
Direct assignments fail the best practice of scalable governance.

Key Concept

Data Storage Security and Access Control
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic