Examkin

Soru

Zorluk: KolayManage Storage Access Keys and Shared Access Signatures (SAS)

A developer is configuring a CI/CD pipeline that uploads build artifacts to a private blob container in an Azure Storage account. The pipeline requires access to upload these files but should not have administrative control over the storage account. You decide to generate a Shared Access Signature (SAS) token for this purpose.

To adhere to the principle of least privilege and secure access, which two settings should you configure? (Select two.)

  1. Set the allowed protocol parameter to HTTPS onlyCevap
  2. Configure the SAS permissions to include only WriteCevap
  3. C
    Assign the Storage Blob Data Contributor RBAC role directly inside the SAS token configuration
  4. D
    Configure the SAS token with no expiration date to ensure uninterrupted pipeline runs

Cevap

Enforce HTTPS only for the protocol and select only the Write permission.
Configuring the Shared Access Signature (SAS) token to allow only HTTPS ensures secure, encrypted data transmission. Restricting permissions to Write only satisfies the principle of least privilege, as the pipeline only needs to upload artifacts and does not require read or delete access.

Adım Adım Çözüm

1
Analyze the CI/CD pipeline's requirements.
The pipeline only needs to upload files (Write permission) and requires secure communication.
To conform to the principle of least privilege and security best practices.
2
Identify the appropriate protocol setting in the SAS token configuration.
Restrict the allowed protocol to HTTPS only.
Enforcing HTTPS prevents unencrypted transit of sensitive build data.
3
Select the required permissions for the token.
Enable the Write permission and leave Read, List, and Delete unchecked.
Providing only the Write permission ensures the pipeline cannot read, list, or delete existing blobs in the container.

Anahtar Kavram

Configuring Shared Access Signatures (SAS) to enforce least privilege access and secure protocols.
Tahmini Süre:45s
Bu soruyu puanla

Konular

Manage Storage Access Keys and Shared Access Signatures (SAS)

Bu konudan daha fazla soru