Examkin

Soru

Zorluk: ZorData Storage Security and Access Control

A logistics enterprise is designing a secure storage solution for external supplier invoices stored in an Azure Blob Storage container named supplierinvoices within a storage account named logisticsdata. The solution must satisfy the following security and operational requirements:

- External auditors require read access to the container for a temporary 14-day audit window. The access must be immediately revocable at any time during the audit without affecting other applications or rotating the storage account access keys.
- Internal financial analysts require read and write access to the container. They must obtain access only on-demand and for a limited duration, utilizing administrative self-service activation. The administration of access must scale efficiently without managing individual user permissions.

Which two actions should you include in the design to meet the requirements?

  1. Configure a stored access policy on the supplierinvoices container and generate a service shared access signature (SAS) token associated with this policy for the external auditors.Cevap
  2. In Microsoft Entra Privileged Identity Management (PIM) for groups, assign the Storage Blob Data Contributor role as eligible to a Microsoft Entra ID security group containing the financial analysts.Cevap
  3. C
    Generate an ad-hoc service shared access signature (SAS) token with a 14-day expiration time directly for the external auditors.
  4. D
    Directly assign the Storage Blob Data Contributor role to each individual financial analyst's user account in the Azure portal.
  5. E
    In Microsoft Entra Privileged Identity Management (PIM), assign the Storage Blob Data Contributor role as active to the Microsoft Entra ID security group containing the financial analysts.

Cevap

Configure a stored access policy on the supplierinvoices container and generate a service shared access signature (SAS) token associated with this policy for the external auditors, and in Microsoft Entra Privileged Identity Management (PIM) for groups, assign the Storage Blob Data Contributor role as eligible to a Microsoft Entra ID security group containing the financial analysts.
The correct design uses a stored access policy to secure the external auditor's temporary access, enabling immediate revocation by deleting or modifying the policy without rotating storage account keys. For the financial analysts, configuring the Storage Blob Data Contributor role as eligible for a Microsoft Entra ID security group ensures that access is only granted on-demand (just-in-time) through PIM self-service activation and simplifies administration by managing access at the group level.

Adım Adım Çözüm

1
Address the external auditor revocation requirement.
Using a service SAS token associated with a stored access policy allows immediate revocation by modifying or deleting the stored access policy, keeping other services unaffected.
Ad-hoc SAS tokens cannot be revoked without rotating the storage account access keys, which would affect other services.
2
Address the internal analyst on-demand activation requirement.
Using Microsoft Entra Privileged Identity Management (PIM) for groups to assign the Storage Blob Data Contributor role as eligible meets the on-demand activation requirement.
Active PIM assignments provide permanent access instead of just-in-time access.
3
Address the administration and scalability requirement.
Assigning the role to a Microsoft Entra ID group instead of individual accounts ensures administrative scalability.
Direct user role assignments do not scale and are harder to audit and maintain.

Anahtar Kavram

Designing secure access to Azure Storage using Stored Access Policies for SAS revocation and Microsoft Entra PIM for groups to achieve scalable, just-in-time RBAC administration.
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru