Examkin

Soru

Zorluk: OrtaBlob, File, and Disk Storage Solutions

An enterprise is designing a backup storage solution for a critical financial application. The backup files will be stored in Azure Blob Storage. The storage solution must satisfy the following requirements:

* The data must be protected against a regional disaster where the primary region becomes completely unavailable.
* External auditors must be granted temporary access to the backups via Shared Access Signatures (SAS).
* The security team must be able to immediately revoke access to the SAS tokens at any time without changing the storage account keys.

Which storage redundancy configuration and access control mechanism should you recommend?

  1. A
    Locally redundant storage (LRS) and SAS tokens associated with a stored access policy
  2. B
    Geo-redundant storage (GRS) and ad-hoc SAS tokens with a short validity period
  3. Geo-redundant storage (GRS) and SAS tokens associated with a stored access policyCevap
  4. D
    Locally redundant storage (LRS) and ad-hoc SAS tokens with a short validity period

Cevap

Geo-redundant storage (GRS) and SAS tokens associated with a stored access policy
Geo-redundant storage (GRS) replicates data to a secondary Azure region, ensuring that backups are protected against a regional disaster. Associating SAS tokens with a stored access policy provides a mechanism to change the permissions, start time, or expiry time, or to revoke the SAS immediately by deleting the policy, all without rotating the primary storage account keys.

Adım Adım Çözüm

1
Evaluate the redundancy requirements for regional disaster recovery.
Determine that Geo-redundant storage (GRS) is required to replicate data to a secondary region, whereas Locally redundant storage (LRS) only replicates data within a single datacenter and cannot survive a regional outage.
To protect data against a regional disaster where the primary region is unavailable, geo-replication is necessary.
2
Evaluate the security and revocation requirements for Shared Access Signatures (SAS).
Determine that the SAS tokens must be associated with a stored access policy to support immediate revocation without rotating the primary storage account keys.
Ad-hoc SAS tokens cannot be revoked before their expiration unless the storage account keys are rotated. A stored access policy allows instant revocation by modifying or deleting the policy directly.

Anahtar Kavram

Azure Blob Storage redundancy options and Shared Access Signature (SAS) delegation using stored access policies.
Bu soruyu puanla

Konular

Blob, File, and Disk Storage Solutions

Bu konudan daha fazla soru