Examkin

Soru

Zorluk: KolayData Storage Security and Access Control

You are designing a secure data storage solution in Azure. A partner organization requires read-only access to a specific Azure Blob Storage container for a period of 30 days. The security policy mandates that you must be able to revoke this access immediately if a security breach occurs, without rotating the storage account access keys.

Which of the following access control strategies should you recommend?

  1. A
    Assign the Storage Blob Data Reader role directly to the external developer's Microsoft Entra ID user account.
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token with a validity period of one year.
  3. Generate a Shared Access Signature (SAS) token that is associated with a stored access policy.Cevap
  4. D
    Configure a permanently active Storage Blob Data Reader role assignment in Microsoft Entra Privileged Identity Management (PIM) for the external developer.

Cevap

Generate a Shared Access Signature (SAS) token that is associated with a stored access policy.
Associating a Shared Access Signature (SAS) with a stored access policy allows you to manage the lifetime and permissions of the SAS dynamically. If you need to revoke access, you can delete or modify the stored access policy on the container. This immediately invalidates any SAS tokens generated from that policy without needing to rotate the storage account's primary or secondary access keys, minimizing disruption to other services.

Adım Adım Çözüm

1
Analyze the requirement for temporary, revocable access to a blob container without key rotation.
Identified that rotating storage account keys is unacceptable for revocation.
Rotating keys would disrupt other clients and applications using the same storage account.
2
Evaluate how to revoke a Shared Access Signature (SAS) token.
Found that an ad-hoc SAS cannot be revoked without key rotation, whereas a SAS associated with a stored access policy can be revoked by modifying or deleting the policy.
Stored access policies bind the SAS validation to the policy's state in Azure Storage.
3
Select the security control that matches the scenario requirements.
Recommend generating a SAS token associated with a stored access policy.
This fulfills the 30-day access, read-only permissions, and instant revocation requirements without rotating storage account keys.

Anahtar Kavram

Using stored access policies to manage and revoke Shared Access Signatures (SAS) without rotating storage account keys.
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru