AZ-104 Question 64
Single answerYou are an Azure Administrator for a company that stores departmental data in different containers. A manager requests read access to a container for 30 days but also wants the flexibility to extend or revoke the access without issuing new SAS tokens. Which configuration should you implement?
- A
Create a Service SAS with a 30-day expiration and manually regenerate a new token if needed
- B
Attach a Stored Access Policy to the container and link the SAS token to it
- C
Enable public access on the container for 30 days and then disable it
- D
Assign the manager a built-in role through Azure RBAC in the container’s access control settings
Show answer and explanation
Correct answer: B
Explanation
Using a Stored Access Policy tied to the container lets you modify or revoke the policy without having to reissue new SAS tokens. This approach meets the requirement of granting limited-time access while providing an easy way to extend or revoke permissions.
- A. Incorrect.
This only provides a single SAS token; you would have to regenerate and redistribute it each time you want to extend or revoke access.
- B. Correct.
A Stored Access Policy allows you to define and extend or revoke permissions at the policy level without reissuing the SAS tokens.
- C. Incorrect.
Public access is not recommended for sensitive data and does not provide granular management of access permissions.
- D. Incorrect.
Azure RBAC is not used to manage SAS tokens; it is intended for role-based access at the management plane, not directly for short-term access via SAS.