Exam AZ-500 topic 2 question 20 discussion

Actual exam question from Microsoft's AZ-500

Question #: 20
Topic #: 2

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Sub1.
You have an Azure Storage account named sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to sa1.
Solution: You regenerate the Azure storage account access keys.
Does this meet the goal?

A. Yes
B. No

Show Suggested Answer

Suggested Answer: A 🗳️

by debsauce at March 13, 2021, 10:25 p.m.

Comments

Submit Cancel

francis6170

Highly Voted 3 years, 4 months ago

Got this in the AZ-500 exam (Sept 2021)! A: Yes

upvoted 11 times

...

Squaiyumi

Highly Voted 3 years, 10 months ago

In the exam 6 April

upvoted 11 times

...

Knighthell

Most Recent 2 months ago

Selected Answer: A

yes but only if BUT: access is through SAS tokens → these tokens can be based on: Account SAS (tied to the storage account key → regenerating the keys will invalidate these SAS tokens) Service SAS or User Delegation SAS → regenerating the keys may not be sufficient if there are SAS tokens signed with user delegation keys. Stored Access Policies → if the token was issued using a stored access policy, you also need to revoke or update the policy.

upvoted 1 times

...

brooklyn510

1 year, 1 month ago

On exam 1/2/24

upvoted 5 times

...

flafernan

1 year, 2 months ago

Selected Answer: A

Yes, regenerating Azure storage account access keys is an effective way to revoke all existing access to the storage account. When you regenerate access keys, the old keys become invalid, which effectively denies access to all services associated with the account, including the blob service and file service.

upvoted 3 times

...

JunetGoyal

1 year, 3 months ago

yes, As SAS are built on top of access key!

upvoted 1 times

...

Andre369

1 year, 8 months ago

Selected Answer: A

Regenerating the Azure storage account access keys will revoke all access to the storage account, including the blob service and the file service. By regenerating the access keys, the existing SAS tokens and stored access policies will become invalid, preventing unauthorized access to the storage account.

upvoted 2 times

...