Drag and Drop Question You manage an Azure Machine Learning workspace named workspace1 by using the Python SDK v2. You must register datastores in workspace1 for Azure Blob storage and Azure Files…

The correct answer is Identity-based access; Shared Access Signature (SAS). This question tests the ability to select appropriate security access methods for Azure Blob and Azure Files storage based on specific requirements, emphasizing Azure AD integration and time-limited credentials.

Design and prepare a machine learning solution

Question

Drag and Drop Question You manage an Azure Machine Learning workspace named workspace1 by using the Python SDK v2. You must register datastores in workspace1 for Azure Blob storage and Azure Files storage to meet the following requirements: - Azure Active Directory (Azure AD) authentication must be used for access to storage when possible. - Credentials and secrets stored in workspace1 must be valid for a specified time period when accessing Azure Files storage. You need to configure a security access method used to register the Azure Blob and Azure Files storage in workspace1. Which security access method should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

Drag items

Account keyIdentity-based accessShared Access Signature (SAS)

Correct arrangement

Identity-based access
Shared Access Signature (SAS)

Explanation

This question tests the ability to select appropriate security access methods for Azure Blob and Azure Files storage based on specific requirements, emphasizing Azure AD integration and time-limited credentials.

Approach. To correctly answer, 'Identity-based access' should be dragged to 'Azure Blob storage', and 'Shared Access Signature (SAS)' should be dragged to 'Azure Files storage'.

Azure Blob storage and Identity-based access: The requirement states that 'Azure Active Directory (Azure AD) authentication must be used for access to storage when possible'. Identity-based access (using Azure AD identities) is the most secure and recommended method for Azure Blob storage, allowing fine-grained access control through Azure RBAC (Role-Based Access Control) and leveraging existing Azure AD identities, thus fulfilling the Azure AD authentication requirement for Blob storage.
Azure Files storage and Shared Access Signature (SAS): The requirement specifies that 'Credentials and secrets stored in workspace1 must be valid for a specified time period when accessing Azure Files storage'. Shared Access Signatures (SAS) are designed to provide delegated access to Azure Storage resources with specified permissions and for a limited time. This directly addresses the need for time-limited credentials for Azure Files. While Azure Files supports Identity-based access for certain SMB scenarios, SAS is the explicit mechanism for obtaining programmatic access with a specific validity period for a datastore registration context.

Common mistakes.

common_mistake. 1. Using 'Account key' for either storage type: Account keys provide full, unrestricted access to the entire storage account. They do not support time-limited access and do not leverage Azure AD for authentication directly. They are generally considered less secure than identity-based access or SAS with least privilege principles.

Using 'Shared Access Signature (SAS)' for Azure Blob storage: While SAS can be used for Blob storage, the primary requirement for Blob storage is 'Azure Active Directory (Azure AD) authentication... when possible'. Identity-based access directly fulfills this using Azure AD identities and RBAC, which is generally preferred over SAS for internal services like an Azure ML workspace accessing its own storage.
Using 'Identity-based access' for Azure Files storage (given the time-limited requirement): While Azure Files can integrate with Azure AD for certain scenarios (like SMB access with hybrid identities or Azure AD DS), the specific requirement for 'credentials and secrets... valid for a specified time period' is best met by a Shared Access Signature (SAS), which is explicitly designed for time-bound, delegated access.

Concept tested. Azure Storage security, authentication mechanisms (Account Key, SAS, Identity-based access/Azure AD), and the appropriate use cases for each method across different Azure Storage services (Blob, Files). This tests the ability to apply security best practices such as leveraging Azure AD for authentication and using time-limited credentials where appropriate.

Topics

#Azure ML Datastores#Storage Authentication#Shared Access Signatures (SAS)#Managed Identity

Community Discussion

No community discussion yet for this question.

Full DP-100 Practice