Examkin

Soru

Zorluk: KolayData Storage Security and Access Control

A company needs to grant an external consultancy temporary read-only access to a specific container in an Azure Storage account. The access must be valid for 14 days, and the security team must be able to revoke this access immediately if a security anomaly is detected. Which two security controls should you recommend? (Select two.)

  1. Create a stored access policy on the blob container.Cevap
  2. Generate a service Shared Access Signature (SAS) associated with the stored access policy.Cevap
  3. C
    Generate an ad-hoc Shared Access Signature (SAS) with a 14-day expiration.
  4. D
    Assign the Storage Blob Data Reader role directly to the individual external consultant accounts.

Cevap

To support immediate revocation and temporary access, you should create a stored access policy on the container and generate a service Shared Access Signature (SAS) associated with that policy.
To satisfy the security and revocation requirements, a stored access policy should be created on the blob container, and a service SAS should be generated that references this policy. This structure allows the administrator to revoke the SAS immediately by deleting or altering the stored access policy on the server side without changing the storage account keys.

Adım Adım Çözüm

1
Define a stored access policy on the target blob container.
A policy is created containing the permissions and a 14-day validity window.
Stored access policies group SAS constraints and allow them to be altered or revoked after the SAS is issued.
2
Generate a service SAS referencing the stored access policy.
A SAS token is generated that points to the stored access policy.
This links the token lifetime and permissions to the policy, enabling immediate revocation by modifying or deleting the policy.

Anahtar Kavram

Stored Access Policies for SAS Revocation
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru