Examkin

Soru

Zorluk: OrtaShared Access Signatures and Token-based Storage Security

You are developing a secure C# application using the `Azure.Storage.Blobs` SDK (v12) to generate a Shared Access Signature (SAS) token. The token will grant temporary access to an external partner to download a specific PDF report from a private Azure Blob Storage container.

The solution must comply with the following security constraints:
- Grant read-only access to the specific blob.
- Restrict communication to HTTPS requests only.
- Limit access to the partner's public IP address, which is `198.51.100.45`.
- Set the start time to 15 minutes before the current time to account for clock skew.
- Set the expiry time to 2 hours from the current time.

Which two of the following code segments should you use to configure the `BlobSasBuilder` instance named `sasBuilder`? (Choose two.)

  1. sasBuilder.Protocol = SasProtocol.Https;Cevap
  2. B
    sasBuilder.Protocol = SasProtocol.HttpsAndHttp;
  3. sasBuilder.IPRange = SasIPRange.Parse("198.51.100.45");Cevap
  4. D
    sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);

Cevap

The correct configurations are setting the Protocol property to SasProtocol.Https and setting the IPRange property to SasIPRange.Parse("198.51.100.45").
The correct options are configuring the Protocol property of the BlobSasBuilder to Https to enforce secure-only transport, and parsing the single IP address using SasIPRange.Parse to restrict access to the partner's IP.

Adım Adım Çözüm

1
Analyze the HTTPS requirement.
The SAS token must restrict traffic to HTTPS. We use the SasProtocol.Https enumeration value.
Setting the Protocol property to Https ensures the storage service rejects any HTTP requests using this SAS.
2
Analyze the IP address restriction requirement.
The SAS token must restrict traffic to the specific IP address 198.51.100.45. We use SasIPRange.Parse("198.51.100.45") to configure the range.
Setting the IPRange property restricts requests to the specified IP address, rejecting requests from other sources.
3
Verify other requirements.
The start time, expiry, and permissions are correctly configured in the rest of the builder code, and the incorrect options are avoided.
Setting Write permissions violates read-only constraints, and using HttpsAndHttp violates the HTTPS-only restriction.

Anahtar Kavram

Configuring SAS tokens with least privilege, specific protocols, and IP restrictions using the Azure Storage SDK.
Bu soruyu puanla

Konular

Shared Access Signatures and Token-based Storage Security

Bu konudan daha fazla soru