SC-100 Certification Practice Question #36

Question

You have an Azure subscription that contains multiple Azure Storage blobs and Azure Files shares.

You need to recommend a security solution for authorizing access to the blobs and shares. The solution must meet the following requirements:

•	Support access to the shares by using the SMB protocol.
•	Limit access to the blobs to specific periods of time.
•	Include authentication support when possible.

What should you recommend for each resource? To answer, select the options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

For blobs, the requirement is time-limited access with authentication when possible. All SAS types are time-bound, but only the user delegation SAS is signed with Microsoft Entra credentials rather than the account key, satisfying the "authentication when possible" criterion — and MS Learn explicitly recommends user delegation SAS over account/service SAS for limited delegated blob access. For the shares, the requirement is SMB-protocol access with authentication; SAS tokens don't authenticate SMB mounts, whereas Microsoft Entra Domain Services provides Kerberos-based identity authentication for Azure Files SMB shares (and fits the tenant that already syncs with AD DS). The community is strongly and consistently aligned on this pairing, led by a 9-👍 Highly Voted answer, and both rows are confirmed by separate MS Learn pages. Confidence is 90%: no official Suggested Answer is published, but community consensus is near-unanimous and the MS Learn grounding is direct for both selections.

More SC-100 practice questions