Shared Access Signatures

Practice questions

1. Question 1Q-0A4BFD

   An ASP.NET Core application must let a client download one specific blob for 15 minutes. The application already uses the storage account key to create the token. Which SAS configuration follows least privilege?

   1. A.Create a service SAS for the blob with read permission, HTTPS-only access, and an expiry time 15 minutes in the future.
   2. B.Create an account SAS with read, write, delete, and list permissions for all storage services and HTTPS-only access.
   3. C.Create a service SAS for the container with read, write, delete, and list permissions and an expiry time one day in the future.
   4. D.Create a user delegation SAS without authenticating the application with Microsoft Entra ID.
   See the answer and solution
2. Question 2Q-7D8622

   A company distributes service SAS tokens for blobs in a container. The tokens reference a stored access policy. A token is leaked, and the security team wants to invalidate all tokens that use that policy without rotating the storage account keys or changing access for unrelated SAS tokens. What should the team do?

   1. A.Delete or modify the stored access policy referenced by the SAS tokens.
   2. B.Change the container's public access level to Blob.
   3. C.Regenerate both storage account access keys.
   4. D.Change the IP address restriction in each token's URL without generating new tokens.
   See the answer and solution
3. Question 3Q-363BDF

   A security-sensitive web API must issue a read-only SAS for one blob, but the API must not store or access a storage account key. The API runs under a Microsoft Entra service principal that has permission to generate user delegation keys for the storage account. Which implementation is appropriate?

   1. A.Use DefaultAzureCredential to authenticate a BlobServiceClient, call GetUserDelegationKeyAsync, create a BlobSasBuilder with Resource = "b" and read permission, and generate SAS query parameters with the user delegation key.
   2. B.Use DefaultAzureCredential to authenticate a BlobServiceClient, then call GenerateAccountSasUri with read, write, and list permissions.
   3. C.Construct a service SAS by placing the service principal's client secret in the SAS signature field.
   4. D.Set the blob container's public access level to Blob and return the blob URL without a SAS.
   See the answer and solution
4. Question 4Q-086CD9

   An API must allow a client to upload one newly created block blob for 20 minutes. The client must not be able to read, delete, or list blobs, and the request must use HTTPS. Which service SAS settings provide the least privilege?

   1. A.Permissions: cw; signed resource: b; protocol: HTTPS
   2. B.Permissions: rwdl; signed resource: c; protocol: HTTPS
   3. C.Permissions: r; signed resource: b; protocol: HTTPS
   4. D.Permissions: acwl; signed resource: c; protocol: HTTP or HTTPS
   See the answer and solution
5. Question 5Q-499BA6

   A solution must grant temporary access to both a blob container and an Azure Queue Storage queue by using one SAS. The application uses Microsoft Entra ID and is not allowed to store or access a storage account key. What is the correct conclusion?

   1. A.Use a user delegation SAS because it can authorize Blob Storage and Queue Storage.
   2. B.Use an account SAS generated with Microsoft Entra ID because account SAS tokens do not require an account key.
   3. C.The requirements cannot be met with one SAS; user delegation SAS is for Blob Storage, while account or service SAS requires an account key.
   4. D.Use a service SAS signed with the application's Microsoft Entra access token.
   See the answer and solution