Examkin

Soru

Zorluk: OrtaShared Access Signatures and Token-based Storage Security

Your company requires all storage accounts containing sensitive client data to comply with a security policy that limits the maximum validity period of Shared Access Signatures (SAS) signed with account keys to 4 hours. You have configured a SAS lifetime policy on the storage account named clientdata.

A developer generates an ad-hoc Service SAS token for a blob in this storage account with a validity period of 12 hours.

What is the result when a client attempts to read the blob using this Service SAS token 1 hour after it was generated?

  1. A
    The request succeeds because the SAS lifetime policy automatically truncates the token's validity period to 4 hours, and the request is made within the first hour.
  2. B
    The request succeeds because SAS lifetime policies only apply to Account SAS tokens and do not restrict Service SAS tokens.
  3. The request fails with an HTTP 403 (Forbidden) error because the validity period of the SAS token exceeds the maximum limit configured in the SAS lifetime policy.Cevap
  4. D
    The request succeeds because SAS lifetime policies only restrict the generation of new SAS tokens and do not affect the validation of tokens at the time of client requests.

Cevap

The request fails with an HTTP 403 (Forbidden) error because the validity period of the SAS token exceeds the maximum limit configured in the SAS lifetime policy.
The correct answer is that the request fails with a 403 (Forbidden) error. SAS lifetime policies limit the maximum expiration time allowed for SAS tokens signed with account keys. Because these tokens are generated offline, the policy is evaluated and enforced when a client presents the token for authorization. A token with an expiration exceeding the policy limit fails authorization completely.

Adım Adım Çözüm

1
Determine the scope of the SAS lifetime policy.
The SAS lifetime policy configured on the storage account applies to any SAS token (Service or Account) signed with the account keys, limiting the maximum validity period to 4 hours.
This establishes how the policy affects the generated 12-hour Service SAS token.
2
Analyze how SAS lifetime policies are enforced.
Since SAS tokens signed with account keys are created client-side, Azure Storage has no visibility into their generation. Consequently, the policy is enforced when a client presents the token for authorization.
This explains why the token was successfully generated but will fail during consumption.
3
Compare the token validity period with the allowed policy limit.
The token validity period is 12 hours, which exceeds the 4-hour limit. Since it violates the policy, Azure Storage returns an HTTP 403 (Forbidden) error during request authorization, regardless of when the request is sent.
This confirms the final outcome when the client attempts to access the resource.

Anahtar Kavram

Azure Storage SAS lifetime policies restrict the maximum allowed expiration period of SAS tokens signed with account keys, and this policy is enforced during request authorization.
Bu soruyu puanla

Konular

Shared Access Signatures and Token-based Storage Security

Bu konudan daha fazla soru