AZ-104 Question 63
Single answerA company hosts a web application that needs to upload files to an Azure Blob Storage container. The goal is to grant the web application write-only access to the container without exposing the storage account key. Which approach best meets these requirements?
- A
Generate a user delegation SAS with only write permissions and hand it to the web application
- B
Embed the storage account key in the application code so the web app can regenerate SAS tokens on demand
- C
Use a stored access policy with read, write, and delete permissions and provide that SAS to the application
- D
Generate a shared access signature for the entire storage account with all permissions enabled
Show answer and explanation
Correct answer: A
Explanation
A user delegation SAS can be generated through Azure AD, restricting operations to only those required, such as write operations. This method avoids storing or exposing the storage account key and adheres to the principle of least privilege.
- A. Correct.
Creating a user delegation SAS with specific permissions (e.g., write only) ensures minimal permission exposure and uses Azure AD to avoid storing the account key in the application code.
- B. Incorrect.
Embedding the storage account key in the code defeats the purpose of secure access, as the key should remain confidential and not be exposed to the client.
- C. Incorrect.
A stored access policy granting broad permissions (read, write, delete) is overly permissive when you only need to provide write-only access, and it can increase security risks.
- D. Incorrect.
Generating a shared access signature for the entire account with all permissions is not recommended because it violates the principle of least privilege and exposes the entire storage account.