Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

Question

Options

• AYes
• BNo

• A
  88% (14)
• B
  13% (2)

Explanation

Explanation

Regenerating the access keys for Sa1 immediately invalidates all existing Shared Access Signatures (SASs) and stored access policies that were derived from those keys, effectively revoking all unauthorized access to both the blob service and the file service simultaneously. Since SASs are cryptographically signed using the storage account keys, once the keys are regenerated, any SAS tokens signed with the old keys become permanently invalid. This is the most efficient and comprehensive method to revoke all access at once, covering both services mentioned in the scenario.

Why "No" (Option B) is wrong: There is no alternative solution presented here that would better meet the goal - regenerating access keys is precisely the recommended Microsoft approach for emergency revocation of all SAS-based access across an entire storage account.

Why this matters: Stored access policies can be individually revoked, but if you need to revoke all access quickly - especially when keys may be compromised - regenerating keys is the nuclear option that cuts off everything instantly.

Memory Tip: Think of the storage account key as the "master key" to a building - if someone copies it to make unauthorized copies (SASs), changing the master lock (regenerating the key) makes all copies useless immediately, regardless of how many were made.

No community discussion yet for this question.