Plan and Implement Security for Storage AZ-500 Practice Questions (Page 8)

Questions 36–37

1. 36expert · medium

   A company has a storage account that hosts a legacy application. The application uses the account key to access blobs. The security team wants to move to Azure AD authentication, but the application vendor has stated that the application only supports connection strings with account keys. The application runs on an Azure VM. You need to minimize the risk of key compromise while keeping the application functional. What should you do?

   • AStore the account key in Azure Key Vault and have the application retrieve it at runtime using the VM's managed identity.
   • BGenerate a SAS token with a long expiry and embed it in the application's connection string.
   • CDisable the account key and use a user-assigned managed identity with a custom endpoint.
   • DAssign the Storage Blob Data Contributor role to the VM's managed identity and update the application to use Azure AD authentication.
   Reveal Solution Discussion Select an answer first
2. 37expert · medium

   A company has an Azure Storage account with a container that stores sensitive reports. The reports are accessed by a legacy application that only supports shared key authentication. The security team wants to restrict access to a specific IP range and also wants to rotate the account key every 30 days. The application team is concerned about downtime during key rotation. What should you recommend?

   • AAssign the Storage Blob Data Reader role to the application's service principal and remove the account keys.
   • BCreate a shared access signature (SAS) with an IP restriction and a 30-day expiry, and provide it to the application.
   • CConfigure the storage account firewall to allow only the required IP range, and rotate the primary key while the application uses the secondary key.
   • DEnable Azure Defender for Storage and rely on its threat detection to protect the account.
   Reveal Solution Discussion Select an answer first