Examkin

Soru

Zorluk: OrtaManage Storage Access Keys and Shared Access Signatures (SAS)

Your company has an Azure Storage account named `corpdata2026` that contains a blob container named `financial-reports`. A third-party auditing application needs to retrieve reports from this container. You must grant the application temporary access while adhering to the principle of least privilege. The solution must meet the following requirements:
- The application must only have read access to the `financial-reports` container.
- The access must be time-limited and expire in 4 hours.
- The access must be restricted to the auditing application's public IP address of `198.51.100.45`.
- The access must be authorized using Microsoft Entra ID credentials of the administrator, without exposing or using the storage account access keys.

Which of the following should you generate to meet these requirements?

  1. A User Delegation SAS with Read permissions on the container, configured with the allowed IP address of `198.51.100.45` and an expiration time of 4 hours.Cevap
  2. B
    A Service SAS signed with the storage account access key, configured with Read permissions on the container, with the allowed IP address of `198.51.100.45` and an expiration time of 4 hours.
  3. C
    An Account SAS with Read permissions on the Blob service, configured with the allowed IP address of `198.51.100.45` and an expiration time of 24 hours.
  4. D
    An Azure RBAC role assignment of Storage Blob Data Reader for the application, and a storage firewall rule enabling 'Allow trusted Microsoft services to access this storage account'.

Cevap

A User Delegation SAS with Read permissions on the container, configured with the allowed IP address of `198.51.100.45` and an expiration time of 4 hours.
The correct answer is a User Delegation SAS with Read permissions, restricted to the client's public IP address, and set to expire in 4 hours. This is because a User Delegation SAS is secured using Microsoft Entra ID credentials to request a user delegation key, satisfying the requirement to avoid using storage account access keys. The other parameters correctly implement the read permission, time-limit, and IP restrictions.

Adım Adım Çözüm

1
Identify the authentication mechanism requirement.
Since the solution must use Microsoft Entra ID credentials and avoid using the storage account access keys, a User Delegation SAS must be used instead of a Service SAS or Account SAS.
A User Delegation SAS is signed with a user delegation key acquired using Microsoft Entra ID credentials, protecting the storage account keys from exposure.
2
Evaluate the scope, duration, and network constraints.
The SAS must be configured with Read permission on the container, a lifetime of 4 hours, and restricted to the client IP address of `198.51.100.45`.
These constraints satisfy the least-privilege access, time-limit, and IP restrictions specified in the scenario.

Anahtar Kavram

User Delegation SAS vs Service/Account SAS and RBAC configuration
Bu soruyu puanla

Konular

Manage Storage Access Keys and Shared Access Signatures (SAS)

Bu konudan daha fazla soru