AZ-104 Practice Question 13: Revoke Leaked Account SAS
Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 3 of 10
A contractor was given an ad hoc account SAS for the storage account stcontoso, signed with key1 and valid for another six months. The token has been posted in a public support forum.
You must invalidate that token immediately. Other applications use key2 to reach the account. What should you do?
Show answer and explanation
Answer:
An account SAS is "secured with the storage account key," and the signature is validated against that key on every request. Regenerating key1 invalidates every signature produced with it, including this token, the moment the rotation completes. Applications still using key2 keep working, which is why Azure gives every account two keys; you rotate one while the other carries the load.
Option B is not available for this token. Microsoft states that "a user delegation SAS or an account SAS must be an ad hoc SAS. Stored access policies are not supported for the user delegation SAS or the account SAS." Deleting a policy is the fast revocation path for a service SAS only.
Option C changes nothing about tokens that already exist. A SAS expiration policy only warns when someone generates a new SAS with a validity interval longer than the recommendation; it does not shorten or revoke a SAS already in circulation.
Option D targets the wrong authorisation path. A SAS signed with an account key carries its own permissions and is not evaluated against the holder's Azure RBAC assignments, so removing the role leaves the leaked token fully usable.
Reference: Grant limited access to data with shared access signatures (SAS)