Examkin

Soru

Zorluk: OrtaData Storage Security and Access Control

A retail company stores point-of-sale (POS) transaction audit logs in an Azure Blob Storage container named pos-audit-logs. A third-party auditing firm requires temporary read access to this container. You must design an access control solution that meets the following security requirements:

- Access must be limited to a specific 30-day auditing window.
- The security team must be able to revoke the access immediately in the event of a credential compromise, without affecting other integrations that rely on the storage account keys.
- The external auditors must be granted only the minimum required permissions.

Which access control strategy should you recommend?

  1. Create a Stored Access Policy on the container and generate a Shared Access Signature (SAS) token associated with that policy.Cevap
  2. B
    Generate an ad-hoc Shared Access Signature (SAS) token directly with a start time, expiry time, and read permission.
  3. C
    Assign the Storage Blob Data Reader role directly to each of the external auditor's individual Microsoft Entra ID user accounts.
  4. D
    Configure a Privileged Identity Management (PIM) policy that assigns the Storage Blob Data Reader role to the auditors as a permanently active assignment.

Cevap

Create a Stored Access Policy on the container and generate a Shared Access Signature (SAS) token associated with that policy.
The correct solution is to use a Stored Access Policy on the container and issue a SAS token linked to that policy. A Stored Access Policy provides a management layer on the storage container. By changing the policy parameters or deleting the policy itself, the associated SAS token is immediately invalidated, providing a reliable revocation mechanism. This satisfies the requirement to terminate access in the event of a compromise without rotating the storage account keys, which would affect other integrations.

Adım Adım Çözüm

1
Analyze the requirement for temporary access revocation without key rotation.
Identified that ad-hoc Shared Access Signatures (SAS) require key rotation for revocation, which would disrupt other integrations. A Stored Access Policy must be used to enable individual SAS token revocation.
Stored Access Policies allow changing parameters or deleting the policy, which instantly invalidates all associated SAS tokens without modifying storage account keys.
2
Determine the appropriate security principal and assignment methodology.
Ruled out direct RBAC assignments to individual users and permanent PIM role assignments.
Direct assignments to individuals violate group governance best practices, and permanent PIM assignments violate just-in-time access principles.
3
Synthesize the requirements into a unified access control recommendation.
Recommended a container-level Stored Access Policy combined with an associated SAS token.
This strategy satisfies the 30-day time window, guarantees immediate revocation capability, and adheres to the principle of least privilege.

Anahtar Kavram

Stored Access Policies provide a way to group shared access signatures and provide additional constraints, including the ability to revoke them immediately without rotating storage account keys.
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru