AZ-204 Develop for Azure storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

  Why this is correct

  This option correctly configures a container-level Shared Access Signature (SAS) by setting the 'Resource' type to "c", which targets the entire container. It precisely grants 'Read' and 'List' permissions, aligning with a common requirement to allow users to view container contents without modification. The 'StartsOn' and 'ExpiresOn' properties define a secure, short-lived access window starting immediately, ensuring the principle of least privilege and time-bound access for the generated URI.

• ✗

  var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "b", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

  Why it's wrong here

  This option is incorrect because setting 'Resource = "b"' indicates a blob-level Shared Access Signature, not a container-level SAS. A blob-level SAS grants permissions to a single specific blob, not the entire container. Consequently, the specified 'BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List' would not apply effectively to the container's contents as a whole, failing to provide the intended container-wide access for reading and listing documents.

• ✗

  var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow, ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.All }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

  Why it's wrong here

  This option is flawed because it assigns 'BlobContainerSasPermissions.All' to the Shared Access Signature. Granting "All" permissions provides full control over the container, including read, write, delete, and management operations, which significantly exceeds a typical requirement for merely reading and listing sensitive documents. This violates the principle of least privilege, creating an unnecessary security risk by providing more access than required for the specified task.

• ✗

  var sasBuilder = new BlobSasBuilder { BlobContainerName = containerName, Resource = "c", StartsOn = DateTimeOffset.UtcNow.AddDays(-1), ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), Permissions = BlobContainerSasPermissions.Read | BlobContainerSasPermissions.List }; Uri sasUri = containerClient.GenerateSasUri(sasBuilder);

  Why it's wrong here

  This option is incorrect because the 'StartsOn' property is set to 'DateTimeOffset.UtcNow.AddDays(-1)', meaning the Shared Access Signature becomes valid from yesterday. While functionally valid, this extends the potential exposure window of the SAS unnecessarily, as it could have been used for a full day before the intended activation. For security best practices, SAS tokens should be valid only for the minimum required duration, starting as close to the actual usage time as possible.