PrepAway - Latest Free Exam Questions & Answers

You need to allow the user access only to the video file, and then revoke access once the user no longer needs

You manage a collection of large video files that is stored in an Azure Storage account.
A user wants access to one of your video files within the next seven days.
You need to allow the user access only to the video file, and then revoke access once the
user no longer needs it.
What should you do?

PrepAway - Latest Free Exam Questions & Answers

A.
Give the user the secondary key for the storage account. Once the user is done with the
file, regenerate the secondary key.

B.
Create an Ad-Hoc Shared Access Signature for the Blob resource. Set the Shared
Access Signature to expire in seven days.

C.
Create an access policy on the container. Give the external user a Shared Access
Signature for the blob by using the policy. Once the user is done with the file, delete the
policy.

D.
Create an access policy on the blob. Give the external user access by using the policy.
Once the user is done with the file, delete the policy.

Explanation:
Ref: http://azure.microsoft.com/en-us/documentation/articles/storage-dotnet-sharedaccesssignature-part-1/

26 Comments on “You need to allow the user access only to the video file, and then revoke access once the user no longer needs”

  5. exam monkey says:

    The wording of this question is ambiguous. When it states that ‘You need to allow the user access only to the video file, then revoke access when they no longer need it’, it is not clear if this means you must be able to manually revoke access when the user no longer needs it (which may be less than 7 days), or that it is ok to have this done automatically after the 7 days.

    If it must be done manually, then C is the correct answer as it is the only way to manually remove access. If automatic, then B is better as access will expire in 7 days without any further effort on your part.




    0



    0
  6. ee says:

    imho, ans C provides access to the full container of video files, instead with ans B you are giving access to only that specific file.
    it is clearly stated “You need to allow the user access ONLY to the video file”, so I would go for B




    0



    0
  9. Chaitanya says:

    Two key takeaways here, first it says the container is a collection of video files and user need access to only one video file.

    Option C gives user access at the container level which gives access to all video files.

    Since the access is needed only for one video file, the answer is B.




    0



    0
  10. orangebird says:

    B. Access policies are used when you’ll need to repeatedly grant the same access (not for one-offs), and 2) you wouldn’t delete the *policy* when the user was done – you’d revoke the SAS token created using the policy.




    0



    0
  12. Prady says:

    The team that came up with these questions clearly didn’t think about the candidates’ mindset. They assumed that the candidates have gone so deep into implementing Azure Infrastructure solutions that they can understand the slightest difference in such non-standard features that the engineering team at MS has designed.
    This is another example of a very thin and tricky line between two answers.
    The link https://azure.microsoft.com/en-us/documentation/articles/storage-dotnet-shared-access-signature-part-1/ explains so many things and is probably the only resource that candidates will refer to in order to address SAS model… and it is still unclear if it should be an ‘ad-hoc SAS’ that auto expires (with no revocation step mentioned) or if it is the ‘SAS with Stored Access Policy’ that essentially does the same thing (particular Blob, not entire container level) and has an extra manual revocation step.
    Grrrrrrrrrr!!!!




    0



    0
  13. Prady says:

    Got some info outside of the documentation.
    Shared Access Policy cannot be applied on Blob. It can only be applied on Container. (Probably a known fact here)
    Adhoc SAS key should not be applied to container. To revoke, the storage account key will need to be changed. (not needed here)
    Between B & C:
    B seems right because it is only needed for 7 days so it is safe to generate adhoc on blob and share SAS key. This poses one limitation. To manually revoke, you need to change the Storage Account Key. There is no other way to “revoke access once user no longer needs it”.
    C sounds better because B has the revoke constraint. By generating Shared Access Policy, you can define constraints (read-only for Blob) and time limit. To revoke access, simply delete the policy.
    Therefore, my vote is for C.




    0



    0

Leave a Reply