nerdexam
Microsoft

AZ-500 · Question #13

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is B. No. Option B (No) is correct because creating a new stored access policy does not revoke existing access - it simply adds another policy without invalidating the SASs and stored access policies already in use by unauthorized users. Why Option A (Yes) is wrong: Creating a new stored…

Submitted by ngozi_ng· Mar 6, 2026Secure compute, storage, and databases

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Subscription named Sub1. You have an Azure Storage account named Sa1 in a resource group named RG1. Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to Sa1. Solution: You create a new stored access policy. Does this meet the goal?

Options

  • AYes
  • BNo

How the community answered

(53 responses)
  • A
    23% (12)
  • B
    77% (41)

Explanation

Option B (No) is correct because creating a new stored access policy does not revoke existing access - it simply adds another policy without invalidating the SASs and stored access policies already in use by unauthorized users.

Why Option A (Yes) is wrong: Creating a new stored access policy has no effect on existing SASs or previously created stored access policies. Unauthorized users with valid existing credentials would still retain access to both the blob and file services.

What actually meets the goal: To immediately revoke all access to Sa1, you should regenerate the storage account keys. Since all SASs and stored access policies are ultimately tied to the storage account keys, regenerating the keys instantly invalidates all existing SASs and stored access policies across both services.

Memory Tip: Think of the storage account key as the "master lock" - regenerating it is like changing all the locks at once, rendering every existing key (SAS/stored access policy) useless immediately. Creating a new policy is just adding another lock without removing the old ones.

Topics

#Azure Storage#Shared Access Signature (SAS)#Stored Access Policy#Access Revocation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice