AZ-104 Question 65
Single answerYou need to grant a group of external consultants temporary read access to a container named 'monthly-reports' in your Azure Storage account. You also want to be able to quickly revoke or extend permissions without distributing new tokens to each consultant. How should you use a stored access policy to accomplish this?
- A
Create a shared access signature (SAS) for the storage account and reuse the same token across the container.
- B
Establish a user delegation SAS at the Azure AD level and distribute that token to the consultants.
- C
Define a stored access policy on the 'monthly-reports' container and generate SAS tokens that reference this policy.
- D
Generate a service SAS for individual blobs in the container, each with its own expiration date.
Show answer and explanation
Correct answer: C
Explanation
Stored access policies allow you to configure container-level permissions and expiry settings in a single place. By generating a SAS token associated with this policy, you can revoke or modify access without having to redistribute new SAS tokens to end users, making it easier to manage permissions for external consultants.
- A. Incorrect.
This only creates a SAS at the account level without leveraging a stored access policy for container-level management.
- B. Incorrect.
A user delegation SAS uses Azure AD credentials, but does not align with directly controlling a single container’s access policy.
- C. Correct.
Defining a stored access policy on the container allows you to centrally manage and update expiration dates or permissions without issuing new SAS tokens.
- D. Incorrect.
Creating individual service SAS tokens for each blob requires updating multiple tokens if permissions or expiration dates need to change.