A healthcare provider plans to allow external clinical researchers to upload trial datasets to a specific Azure Blob Storage container. You need to design an access solution that meets the following requirements:
- The researchers must have write access for a maximum of 48 hours.
- You must be able to revoke access immediately if a security compromise is detected.
- The solution must minimize administrative effort.
Which two actions should you include in the design? (Select TWO.)
- Create a stored access policy on the blob container.Cevap
- Generate a Shared Access Signature (SAS) token that references the stored access policy.Cevap
- CGenerate an ad-hoc Shared Access Signature (SAS) token with a 48-hour lifetime directly on the container.
- DAssign the Storage Blob Data Contributor role directly to each researcher's individual guest user account.
Cevap
To meet the security and revocation requirements with minimal administrative overhead, you must create a stored access policy on the blob container and generate a Shared Access Signature (SAS) token that references this policy.
To meet the requirement of immediate revocation, you must define a stored access policy on the blob container and then generate a Shared Access Signature (SAS) token that references this policy. If a compromise is detected, you can delete or modify the stored access policy, which immediately invalidates the SAS token without needing to rotate the storage account keys.
Adım Adım Çözüm
Anahtar Kavram
Delegating access to Azure Storage containers securely using Stored Access Policies to support revocation.
Tahmini Süre:1m 0s