nerdexam
Microsoft

AZ-204 · Question #246

You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage. The token is compromised. You need to revoke the token. What are two possible ways to…

The correct answer is A. Revoke the delegation key. D. Remove the role assignment for the security principle. If you believe that a SAS has been compromised, then you should revoke the SAS. You can revoke a user delegation SAS either by revoking the user delegation key, or by changing or removing RBAC role assignments for the security principal used to create the SAS…

Submitted by zhang_li· Mar 30, 2026Implement Azure security

Question

You develop a REST API. You implement a user delegation SAS token to communicate with Azure Blob storage. The token is compromised. You need to revoke the token. What are two possible ways to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Options

  • ARevoke the delegation key.
  • BDelete the stored access policy.
  • CRegenerate the account key.
  • DRemove the role assignment for the security principle.

How the community answered

(52 responses)
  • A
    75% (39)
  • B
    8% (4)
  • C
    17% (9)

Explanation

If you believe that a SAS has been compromised, then you should revoke the SAS. You can revoke a user delegation SAS either by revoking the user delegation key, or by changing or removing RBAC role assignments for the security principal used to create the SAS. https://docs.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#revoke-a- user-delegation-sas

Topics

#user delegation SAS#blob storage#token revocation#RBAC

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice