An administrator distributed several service SAS tokens that share one stored access policy on a blob container. A token is suspected leaked and all of them must be invalidated at once without regenerating the account keys. What should the administrator change?
- AModify the stored access policy on the container Correct
- BRegenerate the primary storage account access key
- CApply a near-term expiry to each issued SAS token
- DAdd an IP network rule that blocks the leaked client
Why A is correct: Correct. The documentation states stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys, so editing the policy invalidates every SAS bound to it.
Why B is wrong: Regenerating the key works but the requirement is to avoid touching the account keys.
Why C is wrong: Expiry is set when a token is created and cannot be edited on already-distributed tokens.
Why D is wrong: A network rule limits source ranges but does not revoke the tokens themselves.