Examkin

Question

Difficulty: MediumData Storage Security and Access Control

A healthcare provider plans to share medical imaging files stored in an Azure Blob Storage container with an external research laboratory. The data sharing agreement specifies the following requirements:
- The laboratory must have read-only access for a duration of exactly 45 days.
- Access must be limited to the laboratory's public outbound IP address range.
- The provider must have the ability to revoke access immediately if a security breach is suspected, without regenerating the storage account keys or affecting other integrations.

Which access control method should you recommend to meet these requirements?

  1. Define a stored access policy on the container that specifies the read permission and expiration, and then generate a service SAS token that references this policy and contains the IP address restriction.Answer
  2. B
    Create an ad-hoc account SAS token with a validity period of 45 days, apply the IP address restriction directly to the token, and provide the token to the laboratory.
  3. C
    Assign the Storage Blob Data Reader role directly to the individual Entra ID guest accounts of the laboratory researchers, and use a Conditional Access policy to enforce the IP address range restriction.
  4. D
    Add the laboratory's guest accounts to a Microsoft Entra ID group, assign the Storage Blob Data Reader role to the group, and configure a permanently active Privileged Identity Management (PIM) role assignment for the group.

Answer

Define a stored access policy on the container that specifies the read permission and expiration, and then generate a service SAS token that references this policy and contains the IP address restriction.
The correct option provides a secure way to manage temporary access. By defining the permissions (read) and duration (45 days) in a stored access policy, the administrator can revoke access instantly by modifying or deleting the policy without needing to regenerate the storage account keys. Adding the IP address constraint to the generated service SAS token ensures that access is restricted to the laboratory's specific network.

Step-by-Step Solution

1
Analyze the requirements for access duration, revocation, and IP restriction.
The solution must support read-only permissions, a 45-day window, immediate revocation without key regeneration, and IP-based access limits.
This establishes the constraints that rule out ad-hoc SAS tokens and standard permanent RBAC assignments.
2
Evaluate the mechanism for instant revocation of Shared Access Signatures.
A stored access policy on the container can be deleted or modified, immediately invalidating any SAS tokens associated with it.
Ad-hoc SAS tokens cannot be revoked individually; only regenerating the storage account keys can revoke them, which violates the requirement to avoid impacting other integrations.
3
Determine where the IP address restriction should be applied.
The service SAS token generated from the stored access policy can include the allowed IP address range using the 'sip' parameter.
This satisfies the requirement to restrict access to the laboratory's public outbound IP range while keeping permissions managed by the stored policy.

Key Concept

Stored Access Policies vs. Ad-hoc SAS and RBAC for Secure Temporary Storage Access
Rate this question

Topics

Data Storage Security and Access Control

More questions from this topic