Examkin

Soru

Zorluk: ZorManage Storage Access Keys and Shared Access Signatures (SAS)

Your company has an Azure Storage account named `mystorageacct`. You need to grant a third-party application read-only access to a specific blob container named `datasets`. The access must meet the following security requirements:

* Access must be restricted to HTTPS only.
* Access must only be allowed from the IP address range `192.0.2.128/26`.
* You must be able to revoke the access immediately before the planned expiration time, without affecting other applications or rotating the storage account keys.

Which of the following should you create to meet these requirements?

  1. A
    A Service SAS signed with the storage account access key and configured with an ad-hoc policy
  2. B
    An Account SAS associated with a stored access policy on the storage account
  3. A Service SAS associated with a stored access policy on the datasets containerCevap
  4. D
    A User Delegation SAS signed with Microsoft Entra ID credentials and configured with an ad-hoc policy

Cevap

A Service SAS associated with a stored access policy on the datasets container
A Service SAS associated with a stored access policy on the datasets container satisfies all requirements. The stored access policy allows you to revoke the SAS immediately by deleting or modifying the policy, without affecting any other SAS tokens or rotating the storage account access keys. The SAS token itself can be generated with constraints to enforce HTTPS-only and restrict access to the specified IP address range.

Adım Adım Çözüm

1
Analyze the scope requirement
The scope is restricted to a single blob container named datasets. Both Service SAS and User Delegation SAS can be scoped to a container, whereas Account SAS is scoped at the account level.
Identifying the scope helps narrow down the correct SAS type.
2
Evaluate the immediate revocation constraint
To revoke access immediately without rotating the account keys or affecting other applications/tokens, you must associate the SAS with a stored access policy. User Delegation SAS and ad-hoc Service SAS do not support stored access policies.
Stored access policies provide the ability to change or revoke permissions instantly by deleting or modifying the policy on the container.
3
Combine security and configuration constraints
A Service SAS associated with a stored access policy on the container allows you to enforce HTTPS-only and IP range restrictions while allowing immediate revocation via the policy.
This is the only configuration that satisfies all criteria: container scope, HTTPS-only, IP range restriction, and isolated immediate revocation.

Anahtar Kavram

Stored Access Policies and Shared Access Signatures (SAS)
Bu soruyu puanla

Konular

Manage Storage Access Keys and Shared Access Signatures (SAS)

Bu konudan daha fazla soru