AZ-104 Question 61
Select 2Your organization runs a container in Azure Blob Storage which currently stores critical files. You need to generate a Shared Access Signature (SAS) so that a consultant can upload new files without reading or deleting existing ones. Which two configurations must you include in the SAS to meet this requirement?
- A
Use 'Write', 'Add', or 'Create' permissions in the SAS token
- B
Include a stored access policy that grants both read and write permissions
- C
Exclude 'Read' and 'Delete' permissions from the SAS token
- D
Restrict the SAS expiry time to 24 hours
Show answer and explanation
Correct answers: A, C
Explanation
To ensure the consultant can only upload new files while preventing any access to existing blobs, you must include the permissions that allow new file creation (Write/Add/Create) and exclude any permissions that would enable reading or deleting existing data.
- A. Correct.
This option enables the ability to upload new files without automatically granting read or delete permissions.
- B. Incorrect.
Granting both read and write permissions would allow the consultant to view existing data, which must be prevented.
- C. Correct.
Removing read and delete prevents the consultant from accessing or removing existing files, restricting them to just uploading new content.
- D. Incorrect.
Although it's a best practice to set a specific expiration, limiting the SAS duration alone does not prevent the ability to read or delete existing blobs.