Examkin

Soru

Zorluk: ZorData Storage Security and Access Control

You are designing the security and access control architecture for an Azure Storage account named mfgtelemetry. The storage account contains two blob containers: firmware-updates and telemetry-logs.

You need to recommend a solution that meets the following security requirements:
- Internal operational administrators must have temporary, request-based read and write access to firmware-updates. Access must require approval, expire automatically, and be fully audited.
- An external partner must be granted read-only access to telemetry-logs. This access must be restricted to the partner's public IP range, must expire within 24 hours, and must support immediate revocation without rotating the storage account access keys or impacting other active access tokens.
- Administrative overhead must be minimized.

Which solution should you recommend?

  1. A
    Assign the Storage Blob Data Contributor role directly to the individual administrator user accounts on the firmware-updates container. Create a stored access policy on the telemetry-logs container, and generate an ad-hoc service Shared Access Signature (SAS) with IP restrictions and a 24-hour expiration.
  2. Configure Microsoft Entra Privileged Identity Management (PIM) to assign a security group containing the administrators as eligible for the Storage Blob Data Contributor role on the firmware-updates container. Create a stored access policy on the telemetry-logs container, and generate a service Shared Access Signature (SAS) linked to this policy with IP restrictions and a 24-hour expiration.Cevap
  3. C
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign a security group containing the administrators as active for the Storage Blob Data Contributor role on the firmware-updates container. Create a stored access policy on the telemetry-logs container, and generate a service Shared Access Signature (SAS) linked to this policy with IP restrictions and a 24-hour expiration.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to assign a security group containing the administrators as eligible for the Storage Blob Data Contributor role on the firmware-updates container. Generate an ad-hoc service Shared Access Signature (SAS) on the telemetry-logs container with IP restrictions and a 24-hour expiration.

Cevap

Configure Microsoft Entra Privileged Identity Management (PIM) to assign a security group containing the administrators as eligible for the Storage Blob Data Contributor role on the firmware-updates container, and use a service SAS associated with a Stored Access Policy for the external partner.
To satisfy the requirements for the administrators, using Microsoft Entra Privileged Identity Management (PIM) with an eligible assignment for a security group is the best practice. This enables just-in-time (JIT) access that requires approval, has a limited duration, and logs all activations for auditing. To satisfy the requirements for the external partner, generating a service Shared Access Signature (SAS) associated with a Stored Access Policy (SAP) allows you to specify permissions, IP limits, and expiration. If the token is compromised, you can delete or modify the Stored Access Policy to instantly revoke access without rotating the primary/secondary keys of the storage account, which would disrupt other integrations.

Adım Adım Çözüm

1
Analyze the access control requirements for the internal operational administrators.
Identified that they require temporary, request-based, approved, and audited read-write access.
This matches Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments using security groups for scalable governance.
2
Analyze the access requirements for the external partner.
Identified that they need read-only access restricted by IP, expiring in 24 hours, and requiring immediate individual revocation support without key rotation.
A Service SAS linked to a Stored Access Policy (SAP) is required because changing or deleting the SAP immediately revokes the SAS without affecting other keys or tokens.
3
Synthesize the two requirements to select the correct architectural combination.
The correct solution must use PIM group-based eligible assignment for administrators and a Stored Access Policy-backed Service SAS for the partner.
Other options use active PIM assignments (violating JIT approval), direct RBAC assignments (violating group governance), or ad-hoc SAS (violating keyless revocation).

Anahtar Kavram

Designing secure access control using Azure RBAC, PIM, and Stored Access Policies
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru