AZ-500 Question 158
Single answerA web application running on-premises needs temporary read-only access to a specific container in your Azure storage account. The application does not support federated or Azure AD–based authentication. You want to ensure minimal exposure of credentials while granting only the necessary permissions. Which method provides the most secure and appropriate solution?
- A
Grant the application the primary storage account key to authenticate and configure read-only policies at the container level
- B
Generate a shared access signature (SAS) token with read-only privileges and set an appropriate expiration date
- C
Set the storage account firewall to allow all incoming connections from the on-premises IP address of the application for read access
- D
Assign the Reader role at the subscription level to the application’s identity so it can read from the container
Show answer and explanation
Correct answer: B
Explanation
When a client or application requires restricted access to Azure Blob Storage and does not support Azure AD authentication, a best-practice approach is to create a Shared Access Signature (SAS) with the minimal required permissions and set a limited validity period. This approach follows the principle of least privilege and reduces the risk of credential misuse. For further details, reference Microsoft’s documentation on SAS tokens at https://learn.microsoft.com/azure/storage/common/storage-sas-overview.
- A. Incorrect.
Option 1 is incorrect because distributing the primary storage account key provides full access, not just read-only. This increases risk if the key is compromised, as the key can be used to access all containers and operations in the storage account.
- B. Correct.
Option 2 is correct. Creating a SAS token with read-only permissions and a short expiry date ensures the application can only perform read operations on the target container for a limited time, aligning with best practices for least privilege and reduced credential exposure.
- C. Incorrect.
Option 3 is incorrect because simply allowing the IP address in the storage account firewall does not inherently provide an authentication mechanism or read-only permission. The storage account firewall restricts access based on network, but another method of authentication is still needed.
- D. Incorrect.
Option 4 is incorrect because assigning the Reader role at the subscription level is overly broad and grants more access than necessary. Best practice is to scope permissions as narrowly as possible to comply with the principle of least privilege.