Shared Access Signatures · AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security
A security-sensitive web API must issue a read-only SAS for one blob, but the API must not store or access a storage account key. The API runs under…
Practice question from Shared Access Signatures (AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security), with the correct answer and a step-by-step solution.
hard · MCQ · Q-363BDF
A security-sensitive web API must issue a read-only SAS for one blob, but the API must not store or access a storage account key. The API runs under a Microsoft Entra service principal that has permission to generate user delegation keys for the storage account. Which implementation is appropriate?
- A.Use DefaultAzureCredential to authenticate a BlobServiceClient, call GetUserDelegationKeyAsync, create a BlobSasBuilder with Resource = "b" and read permission, and generate SAS query parameters with the user delegation key.Correct answer
- B.Use DefaultAzureCredential to authenticate a BlobServiceClient, then call GenerateAccountSasUri with read, write, and list permissions.
- C.Construct a service SAS by placing the service principal's client secret in the SAS signature field.
- D.Set the blob container's public access level to Blob and return the blob URL without a SAS.
Solution
A user delegation SAS is signed with a user delegation key obtained through Microsoft Entra ID rather than with a storage account key. The SAS should be scoped to the blob, use resource type "b", grant only read permission, and have a short validity period. Client secrets are not SAS signatures, and public access does not provide controlled, authenticated access.
More from Shared Access Signatures
- An ASP.NET Core application must let a client download one specific blob for 15 minutes. The application already uses the storage account k…
- A company distributes service SAS tokens for blobs in a container. The tokens reference a stored access policy. A token is leaked, and the…
- An API must allow a client to upload one newly created block blob for 20 minutes. The client must not be able to read, delete, or list blob…
- A solution must grant temporary access to both a blob container and an Azure Queue Storage queue by using one SAS. The application uses Mic…
Practise more Implement Azure Security
Sign up free for adaptive practice on this chapter, with instant feedback and hints on every question.
Start practising freeFree to start · No credit card needed