You have an Azure storage account named "store2020". You go ahead and create the following shared access signature: If key1 for the storage account is rotated, would a user using the Azure storage…

Question

Exhibits

Options

• AYes
• BNo

• A
  19% (4)
• B
  81% (17)

Explanation

Explanation

Option B (No) is correct because when the storage account key (key1) is rotated/regenerated, any Shared Access Signature (SAS) token that was generated using that key is immediately invalidated, regardless of whether the SAS token's expiry date has not yet passed or the IP address conditions are met. Since the SAS token was signed with key1, rotating key1 breaks the cryptographic signature that validates the token, making it unusable.

Option A (Yes) is incorrect because even though the user's IP address (12.10.10.100) and the date (10th September 2019) may fall within the SAS token's permitted parameters, these conditions are irrelevant once the signing key has been rotated - the token itself is no longer valid.

Key Insight: A SAS token is cryptographically tied to the storage account key used to generate it. Think of it like a wax seal - if you change the stamp (rotate the key), all old seals (existing SAS tokens) are broken and unrecognizable.

Memory Tip: Remember "Rotate the key = Kill the SAS." Whenever a key is regenerated, treat all SAS tokens signed with that key as immediately expired and inaccessible, regardless of any other conditions defined in the token.

No community discussion yet for this question.