AZ-204 · Question #300
Drag and Drop Question An organization plans to deploy Azure storage services. You need to configure shared access signature (SAS) for granting access to Azure Storage. Which SAS types should you use?
The correct answer is Account-level; Service-level; User delegation. Azure Storage supports three types of SAS, each suited to different scenarios: Account-level SAS grants access to resources in one or more storage services (Blob, Queue, Table, File) and can delegate access to service-level operations, making it ideal for broad, cross-service acc
Question
Exhibit
Answer Area
Drag items
Correct arrangement
- Account-level
- Service-level
- User delegation
Explanation
Azure Storage supports three types of SAS, each suited to different scenarios: Account-level SAS grants access to resources in one or more storage services (Blob, Queue, Table, File) and can delegate access to service-level operations, making it ideal for broad, cross-service access requirements. Service-level SAS delegates access to a specific resource within a single storage service (e.g., a specific blob container or file share), providing granular, resource-scoped access. User delegation SAS is the most secure option as it is secured with Azure AD credentials rather than the storage account key, and is supported only for Blob storage - it is recommended when Azure AD integration is required for enhanced security and auditability.
Topics
Community Discussion
No community discussion yet for this question.