Examkin

Soru

Zorluk: OrtaData Storage Security and Access Control

A utility company is designing a secure storage solution for smart grid telemetry data stored in Azure Blob Storage. The solution must meet the following requirements:
- Support temporary, read-only access to specific blob containers for external auditors. This access must automatically expire after 88 hours and must be capable of being revoked immediately if a security compromise is suspected.
- Restrict network access to only allow traffic from the company's on-premises office IP range (198.51.100.0/24198.51.100.0/24) and a dedicated Azure Virtual Network (VNet).
- Minimize administrative effort and adhere to the principle of least privilege.

Which two configurations should you include in the design?

  1. Create a stored access policy on the blob containers, and generate service shared access signatures (SAS) associated with the policy.Cevap
  2. Configure the storage account firewall to permit access from the 198.51.100.0/24198.51.100.0/24 IP range and enable a private endpoint connected to the VNet.Cevap
  3. C
    Generate ad-hoc user delegation SAS tokens with an 88-hour expiration time for each auditor.
  4. D
    Assign the Storage Blob Data Reader role directly to each auditor's individual Microsoft Entra ID user account.
  5. E
    Assign the Storage Blob Data Reader role to a Microsoft Entra ID security group, and configure Privileged Identity Management (PIM) to make the group membership permanently active.

Cevap

Create a stored access policy on the blob containers and generate service shared access signatures (SAS) associated with the policy, and configure the storage account firewall to permit access from the IP range and enable a private endpoint connected to the VNet.
Using a stored access policy associated with service SAS tokens ensures that access can be revoked immediately by altering or removing the policy. Restricting the storage firewall to the specified IP address range and using a private endpoint within the VNet properly isolates network access to only authorized sources.

Adım Adım Çözüm

1
Evaluate the requirement for temporary, revocable access.
Identify that ad-hoc SAS tokens cannot be revoked individually without rotating keys, whereas service SAS tokens associated with a stored access policy can be revoked instantly by modifying or deleting the policy.
This satisfies the requirement to support 8-hour access that can be immediately revoked.
2
Evaluate the network restriction requirement.
Determine that combining a storage firewall rule for the public on-premises IP range and a private endpoint for private VNet access restricts network access securely.
This satisfies the network access restriction requirement.
3
Evaluate the identity and access management requirements.
Avoid direct RBAC user assignments and permanently active PIM assignments.
This ensures adherence to identity governance best practices and the principle of least privilege.

Anahtar Kavram

Securing Azure Storage access using stored access policies for revocable SAS tokens and network firewalls with private endpoints.
Bu soruyu puanla

Konular

Data Storage Security and Access Control

Bu konudan daha fazla soru