Shared Access Signatures · AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security
An ASP.NET Core application must let a client download one specific blob for 15 minutes. The application already uses the storage account key to crea…
Practice question from Shared Access Signatures (AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security), with the correct answer and a step-by-step solution.
easy · MCQ · Q-0A4BFD
An ASP.NET Core application must let a client download one specific blob for 15 minutes. The application already uses the storage account key to create the token. Which SAS configuration follows least privilege?
- A.Create a service SAS for the blob with read permission, HTTPS-only access, and an expiry time 15 minutes in the future.Correct answer
- B.Create an account SAS with read, write, delete, and list permissions for all storage services and HTTPS-only access.
- C.Create a service SAS for the container with read, write, delete, and list permissions and an expiry time one day in the future.
- D.Create a user delegation SAS without authenticating the application with Microsoft Entra ID.
Solution
A service SAS can be scoped to a single blob and limited to read access, HTTPS, and a short validity period. Account-wide permissions and unnecessary operations violate least privilege. A user delegation SAS requires Microsoft Entra authentication and a user delegation key.
More from Shared Access Signatures
- A company distributes service SAS tokens for blobs in a container. The tokens reference a stored access policy. A token is leaked, and the…
- A security-sensitive web API must issue a read-only SAS for one blob, but the API must not store or access a storage account key. The API r…
- An API must allow a client to upload one newly created block blob for 20 minutes. The client must not be able to read, delete, or list blob…
- A solution must grant temporary access to both a blob container and an Azure Queue Storage queue by using one SAS. The application uses Mic…
Practise more Implement Azure Security
Sign up free for adaptive practice on this chapter, with instant feedback and hints on every question.
Start practising freeFree to start · No credit card needed