AZ-104 Question 56
Single answerYour organization needs to share a Blob container externally for exactly 72 hours, allowing only read access while limiting exposure to the entire storage account. Which solution best meets this requirement?
- A
Generate a Shared Access Signature (SAS) with read permissions and set the expiry to 72 hours
- B
Assign the Storage Blob Contributor role to the external user at the subscription scope
- C
Enable anonymous public read access on the container and rely on container-level ACLs
- D
Use a stored access policy with service endpoints configured to allow only certain IP ranges
Show answer and explanation
Correct answer: A
Explanation
A SAS token with read permissions offers granularity in specifying both the allowed operations (read-only) and the timeframe (72 hours). This ensures the container is accessible only for a limited duration and does not grant any broader permissions.
- A. Correct.
Generating a SAS with read permissions and a set expiry time provides temporary, scoped access without exposing the entire account
- B. Incorrect.
Assigning the Storage Blob Contributor role grants both read and write permissions to the storage, which is excessive and not time-bound
- C. Incorrect.
Anonymous public read access on the container exposes the contents to anyone with the link, failing to limit access to authorized users
- D. Incorrect.
A stored access policy can define permissions at the container level, but service endpoints alone do not create a time-bound read-only scenario