Examkin

Soru

Zorluk: KolayData Storage Security and Access Control

A logistics company stores shipment logs in an Azure Blob Storage container. You need to grant an external auditor temporary read-only access to this container. The access must expire automatically after 24 hours, and you must have the ability to revoke the access immediately if a security policy is violated. Which security control should you implement to meet the requirements?

  1. A service Shared Access Signature (SAS) token associated with a stored access policy on the containerCevap
  2. B
    An ad-hoc service Shared Access Signature (SAS) token with a 24-hour lifetime generated directly using the storage account keys
  3. C
    A new Microsoft Entra ID user account for the auditor with a direct assignment of the Storage Blob Data Reader role
  4. D
    A permanently active assignment for the auditor's account using Microsoft Entra Privileged Identity Management (PIM)

Cevap

A service Shared Access Signature (SAS) token associated with a stored access policy on the container
The correct option is to use a service SAS token associated with a stored access policy. A stored access policy provides the ability to change the constraints of a SAS token after it has been issued, including the ability to revoke the token immediately by deleting the policy or changing its expiration time, without affecting other tokens or requiring a storage account key rotation.

Adım Adım Çözüm

1
Define a stored access policy on the Azure Blob Storage container with read-only permissions and a 24-hour expiration window.
An access policy is established on the container, allowing granular control over SAS tokens linked to it.
Linking the SAS token to a stored access policy is required to enable instant revocation by modifying or deleting the policy.
2
Generate a service SAS token referencing the newly created stored access policy.
A SAS token is generated that inherits its parameters, including permission and lifetime constraints, from the stored access policy.
This ensures that the token cannot bypass the limits set by the policy and can be revoked instantly.
3
Provide the SAS token to the external auditor.
The auditor can access the container for up to 24 hours, and access can be revoked at any time by updating the stored access policy.
This satisfies the requirements for temporary, auto-expiring, and instantly revocable access with minimal administrative overhead.

Anahtar Kavram

Stored Access Policies allow management and immediate revocation of Shared Access Signature (SAS) tokens without rotating storage account keys.
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru