Pass Your Microsoft SC-500 Exam Easy!

Revocation and SAS expiry response are useful after a token has been issued, but do not choose a delegation mechanism that avoids storage account keys.

A time-limited SAS is not necessarily keyless; a service or account SAS can still be signed using the storage account key.

Disabling Shared Key can improve account security, but the question seeks a way for the service to issue delegated blob access without possession of the account key.

Choosing a more narrowly scoped SAS in the next issuance improves future practice, but it does not invalidate the bearer URL that is already publicly exposed and may be downloaded repeatedly during its remaining validity window.

Waiting for expiry leaves an active disclosure window for anyone who copied the URL. The response must include prompt containment, whichever revocation mechanism is technically supported for the token type, and investigation of access already performed.

Stored access policies cannot revoke account SAS or user-delegation SAS. Recognizing that distinction helps choose a method, but mere recognition does not remove the publicly leaked token; the owner must perform applicable revocation and response actions now.

Changing a stored access policy can help revoke an associated service SAS, but that control is relevant only when such a policy is actually linked. The immediate requirement is a newly restricted upload token and verification of its allowed operations.

Choosing the right SAS type matters, but merely evaluating user delegation versus service SAS does not fix excessive permissions on an already issued credential. The unnecessary list and delete capabilities must be removed from the actual issued grant.

A Storage Blob Data role assignment can be limited to particular principals, but if the partner is using a SAS bearer URL, adjusting another user’s Entra role does not automatically constrain permissions embedded in that SAS.

Stored access policy behavior does not explain why an otherwise newly minted SAS has a token time window shifted by local time conversion. Check token fields and timestamps first rather than modifying unrelated policy objects.

Switching from account SAS to a narrower SAS can reduce privilege but does not diagnose a signature or time-window failure. Incorrect signing inputs or start time can make either token type unusable even with the right resource permissions.

User delegation SAS is an excellent choice when Entra-based issuance is supported, but changing the signing model alone will not fix erroneous local-time handling or an incorrectly URL-encoded token in the client.

Clock skew and signing-parameter debugging are useful for a failing SAS but no token failure is described. Correcting timestamps would not reduce an account SAS intended for multiple services to a single-blob read-only grant.

Waiting for an existing token to expire is a revocation issue, not a design answer for a new access grant. The user should not be given an account SAS with broad storage-service scope in the first place.

A narrowly scoped SAS is the right mechanism, but merely stating that SAS should expire does not decide which signing authority and resource scope are best. In this case Entra-backed delegation is available and avoids signing broad account-level permissions.

User delegation SAS reduces reliance on account keys but remains a bearer URL; logging its signature would still expose delegated access. Choosing a different SAS type alone does not sanitize current or future diagnostic records.

A shorter or narrower resource scope reduces impact, but it does not justify writing credential-bearing query strings into a broad-access log store. Any exposed SAS can be replayed during its validity period until effectively revoked or expired.

Understanding stored access policy limitations matters when revoking certain SAS types, but it is not the primary prevention here. The root cause is telemetry collecting and retaining sensitive token parameters.

Rotating the storage account Shared Key affects services and SAS signed with the account key, not an Entra-issued user-delegation key. This would risk unrelated clients without revoking the token in the question.

Issuing a replacement SAS may support continued business access after containment, but the previous token remains usable until its signed key expires or is revoked. A new token does not invalidate the original leaked credential.

Stored access policies govern linked service SAS, not user-delegation SAS. A user-delegation SAS is ad hoc, so changing a container policy does not modify the delegated key that signed this token or cause its authorization to expire early.

Giving a user a short SAS can restrict resource scope, but a service or account SAS signed with Shared Key would still violate the stated ban. The account must enforce a prohibition on Shared Key authorization rather than relying only on shorter token lifetimes.

Redacting sensitive token strings from logs limits credential leakage, but it does not stop clients from authenticating with account keys or generating key-signed SAS tokens. Logging hygiene and authorization enforcement are separate controls.

A user-delegation SAS is the preferred delegated Blob access model when supported, but a recommendation alone does not enforce a governance requirement on every client. Setting the account property prevents legacy key-based authorization from remaining available.

Revoking a user-delegation key invalidates user-delegation SAS, which are signed through Microsoft Entra delegation. This scenario specifies a service SAS linked to a container stored access policy, so key revocation for a different signing mechanism is not the targeted control.

New tokens do not supersede earlier service SAS tokens automatically. If the old stored access policy remains active, the original URL can continue authorizing the contractor until it expires or the linked policy is revoked.

A service SAS is signed with the storage account key and can be used as a bearer token, regardless of the interactive sign-in state of the employee who generated it. Disabling that employee does not modify a still-valid SAS or its stored access policy.

A user-delegation SAS is useful for temporary delegated access, but the requirement is for an ongoing Entra group role assignment. Tokens have lifetimes and bearer risks and would not establish the desired group membership-based access governance.

An account-level read SAS can enable access broader than the one container and is not naturally tied to Entra security-group membership. A narrowly scoped Blob Data Reader role is the auditable and least-privilege choice in this scenario.

A partner SAS granting upload would provide write capability and would not implement ongoing container-scoped Entra group authorization. Delegating upload to a token is a different identity and action model from the stated group read-only requirement.

SQL firewall and DNS validation may be needed for connectivity, but they do not replace SQL administrative passwords with workload identity.

Encryption at rest does not remove the embedded administrator credential or reduce what a connection can execute.

A private endpoint limits network exposure but does not eliminate or invalidate a hardcoded administrator credential.