AZ-104 Question 57
Single answerYour company manages an Azure Storage account used to store large media files. You want to share the video files with an external partner for a short window of time. The external partner should only have read-only access to the files. Which method should you use to provide the partner with secure, time-limited access?
- A
Generate a Shared Access Signature (SAS) with read-only permissions and distribute the SAS link to the partner
- B
Create a new access key for the Storage account and provide it to the partner
- C
Enable public read access on the storage container
- D
Create a local user in the storage account and assign them the Storage Blob Data Owner role
Show answer and explanation
Correct answer: A
Explanation
When you need to share data in a controlled, time-limited manner, a Shared Access Signature (SAS) is the preferred solution. It allows specifying both the expiration and the level of access without exposing the storage account’s keys.
- A. Correct.
Shared Access Signatures (SAS) can provide granular permissions and limited time-based access to the desired resources, making them ideal for secure external sharing.
- B. Incorrect.
Access keys grant full access to the entire storage account, which is not recommended for external partners because it poses a security risk.
- C. Incorrect.
Making the container public would compromise security, allowing anyone with the container URL to access the files without restrictions.
- D. Incorrect.
Assigning the Storage Blob Data Owner role provides excessive permissions and is not suitable for short-term, read-only external access.