A vendor receives SAS access for a short upload. Which two choices reduce exposure? Select 2 answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

A.Assume a leaked SAS is harmless because clients must know the account key too
B.Grant only required resource/operation scope and a short validity interval
C.Protect the token as a bearer credential and plan supported revocation
D.Use a stored access policy as a universal control for every SAS type

Show the answer and explanation

✓ Correct answers

Grant only required resource/operation scope and a short validity interval
Protect the token as a bearer credential and plan supported revocation

A SAS bearer can act within its grants, so constrain/protect it and plan revocation. Possession of the account key is not required for token use. Stored policies apply only to eligible service SAS, not all types. Source guide: PDF page 29.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.