AZ-104 Question 62
Single answerYou have a private container named 'media' in your Azure Storage account storing corporate training videos. You need to share one specific training video with an external vendor for exactly 12 hours. The vendor should be able to download and view the file, but must lose access immediately after the 12-hour window. Which approach should you use to accomplish this?
- A
Generate a service-level SAS for the video with Read permission, specifying an expiry time of 12 hours from now
- B
Create a stored access policy with Write permission and combine it with a SAS for the video file
- C
Generate an account-level SAS with List and Read permissions, valid for 24 hours, and share the SAS URL
- D
Create a user delegation SAS for the entire container with Read permission and no expiry time
Show answer and explanation
Correct answer: A
Explanation
To ensure the vendor can view the video for only a specific window of time, you must generate a SAS that grants read-only access to the target blob and sets an exact expiry time. This guarantees that once the SAS token expires, the vendor can no longer access the file.
- A. Correct.
Specifying Read permission and defining a 12-hour expiry uniquely meets the requirement to provide temporary access to a single file
- B. Incorrect.
A stored access policy with Write permission does not limit the user to read-only access, and combining it with a SAS would grant more permissions than needed
- C. Incorrect.
An account SAS with a 24-hour duration and List permission would allow the vendor to enumerate additional data and view the file for longer than the required 12 hours
- D. Incorrect.
A user delegation SAS without an expiry time would grant indefinite access, which fails the requirement to limit access to 12 hours