AZ-500 Question #153: Real Exam Question with Answer & Explanation

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You generate new SASs. Does this meet the goal?

Options

• AYes
• BNo

Explanation

Why B (No) is Correct: Generating new SASs does not revoke existing ones - it simply creates additional access tokens. The unauthorized users would still retain valid access through the old SASs and stored access policies, meaning the breach continues uninterrupted.

Why A (Yes) is Wrong: Creating new SASs is an additive action, not a revocation action. It does nothing to invalidate previously issued tokens, so existing unauthorized access remains fully intact.

The Correct Approach: To immediately revoke all access to sa1, you should regenerate the storage account keys. Since all SASs and stored access policies are ultimately signed by the storage account key, regenerating the key instantly invalidates every SAS and stored access policy derived from it - both for the blob service and the file service.

Memory Tip: Think of the storage account key as the "master lock." SASs are copies of keys made from that master - generating more copies doesn't change the lock. But regenerating the master key (changing the lock) makes all existing copies useless instantly. When you need to revoke everything at once, go to the root - the account key.

No community discussion yet for this question.