Examkin

Soru

Zorluk: Çok zorData Storage Security and Access Control

An enterprise is designing a secure storage solution for a multi-tenant SaaS application that processes highly sensitive financial transactions in Azure. The solution must satisfy the following architectural requirements:

1. Operations team members must only be granted temporary, time-bound, just-in-time (JIT) access to manage the storage account's networking and security configurations.
2. An external audit firm requires read-only access to a specific blob container named 'audits' for a period of 9090 days. This access must be immediately revocable at any point without impacting other active applications or changing the storage account keys.
3. On-premises applications must authenticate to read blobs without storing credentials or access keys locally, ensuring all data plane access is audited.
4. Administrative overhead must be minimized by managing role assignments at scale, avoiding direct user-to-role or service principal-to-role mappings.

Which design strategy meets all these requirements while adhering to the principle of least privilege?

  1. Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) for an Entra security group containing the operations team. For the external audit firm, create a Stored Access Policy on the container and issue a Service SAS token associated with it. For the on-premises applications, use Microsoft Entra ID authentication via a service principal that is a member of an Entra security group assigned the Storage Blob Data Reader role.Cevap
  2. B
    Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) for an Entra security group containing the operations team. For the external audit firm, issue an ad-hoc Service SAS token with a 9090-day expiration. For the on-premises applications, use Microsoft Entra ID authentication via a service principal that is a member of an Entra security group assigned the Storage Blob Data Reader role.
  3. C
    Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) for individual operations team members. For the external audit firm, create a Stored Access Policy on the container and issue a Service SAS token associated with it. For the on-premises applications, use Microsoft Entra ID authentication via a service principal that is directly assigned the Storage Blob Data Reader role.
  4. D
    Configure an active role assignment in Microsoft Entra Privileged Identity Management (PIM) for an Entra security group containing the operations team. For the external audit firm, create a Stored Access Policy on the container and issue a Service SAS token associated with it. For the on-premises applications, use Microsoft Entra ID authentication via a service principal that is a member of an Entra security group assigned the Storage Blob Data Reader role.

Cevap

Configure an eligible role assignment in Microsoft Entra Privileged Identity Management (PIM) for an Entra security group containing the operations team. Create a Stored Access Policy on the audits container and issue a Service SAS token associated with it for the audit firm. Utilize Microsoft Entra ID authentication with a service principal inside a security group assigned the Storage Blob Data Reader role for the on-premises applications.
The correct strategy uses Microsoft Entra Privileged Identity Management (PIM) with eligible assignments to provide just-in-time (JIT) access to the operations group. It uses a Stored Access Policy to bind the SAS token for the audit firm, allowing instant revocation by modifying the policy without rotating storage account keys. It also aligns with administrative best practices by assigning RBAC roles to Entra security groups containing the operations team and the service principal for the on-premises applications, rather than directly to individual identities.

Adım Adım Çözüm

1
Enforce just-in-time (JIT) access for operations management.
Configure Microsoft Entra PIM with eligible role assignments instead of active assignments, ensuring operations staff must explicitly request activation to gain the required role.
Eligible role assignments ensure that permissions are not active by default, maintaining compliance with the JIT requirement.
2
Select a secure, revocable delegation method for the external auditors.
Create a Stored Access Policy on the target container and generate a Service SAS linked to this policy.
Ad-hoc SAS tokens cannot be revoked without rotating the storage account keys, which would affect other applications. Associating the SAS with a Stored Access Policy allows revocation by modifying or deleting the policy.
3
Establish keyless authentication for on-premises workloads.
Use Microsoft Entra ID authentication with a service principal, which allows access tracking and auditable logging via Azure diagnostic logs without hardcoding keys.
Authenticating with Entra ID service principals avoids access key leakage and enables robust data plane auditing.
4
Ensure governance scalability for all identity access.
Map RBAC roles to Entra ID security groups rather than individual users or service principals.
Direct role assignments to individual accounts increase administrative overhead and make auditing access changes difficult at scale.

Anahtar Kavram

Azure Storage data plane security requires combining Microsoft Entra ID group-based RBAC for persistent/JIT identities, and Stored Access Policies for secure, revocable third-party delegation.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru