
Answer-first summary for fast verification
Answer: Storage accounts should prevent shared key access
The correct answer is C. While disallowing public access to storage accounts can mitigate some risks, the primary policy to prevent the threat from reoccurring involves disallowing Shared Key authorization. Shared Key authorization can be exploited if the keys are compromised, so enforcing Azure AD authorization provides a stronger security posture. By preventing shared key access, you ensure that only Azure AD credentials, which offer superior security and ease of use, are used to authorize requests. This significantly reduces the risk of keys being compromised and used maliciously.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
Given the multifaceted information related to security in Azure Storage, consider the following scenario: You receive a security alert in Microsoft Defender for Cloud similar to the one illustrated in the exhibit. This alert highlights a potential threat due to anonymous public read access to containers and blobs in Azure Storage. Although this type of access might be useful for sharing data, it poses a security risk if not managed properly. Improper handling of anonymous access can lead to data breaches caused by operational complexity, human error, or malicious attacks, such as those performed by attackers using tools like MicroBurst to crawl for public containers.
After you have taken steps to remediate the current threat, you need to prevent this situation from occurring again. Which policy definition should you assign to Azure Storage to mitigate the risk of anonymous public read access and protect your data from future breaches?
Note: Microsoft recommends enabling anonymous access only when it's absolutely necessary for your application scenario, as improper configurations can lead to significant vulnerabilities and data exploitation.
A
Storage account public access should be disallowed
B
Azure Key Vault Managed HSM should have purge protection enabled
C
Storage accounts should prevent shared key access
D
Storage account keys should not be expired