AZ-104 Question 66
Single answerYou have an Azure Storage container that stores confidential documents. You need to grant temporary read access to an external partner and be able to revoke that access without needing to regenerate SAS tokens each time. Which approach satisfies this requirement?
- A
Create a shared access signature with an expiration date by referencing a stored access policy in the container
- B
Generate a user delegation SAS through Azure Active Directory for the entire container
- C
Create a new blob access policy for each file individually without a shared access signature
- D
Provide anonymous access to the blob container and disable public access later
Show answer and explanation
Correct answer: A
Explanation
Storing the SAS within a stored access policy allows you to revoke or modify permissions simply by changing or removing the stored access policy, ensuring a simpler way to manage and revoke access without issuing new tokens.
- A. Correct.
By referencing a stored access policy, you can revoke or modify the SAS by updating or deleting the policy without the need to issue new tokens to each user.
- B. Incorrect.
While user delegation SAS can be controlled via Azure AD, it does not offer the immediate revocation ease that comes with a stored access policy.
- C. Incorrect.
Creating separate policies for each file increases management complexity and does not offer a convenient revocation mechanism for all files at once.
- D. Incorrect.
Enabling anonymous access to the entire container is insecure and does not provide a fine-grained revocation method.