AZ104-Q: revoke a group of SAS tokens
An application distributes several service SAS tokens for one blob container. The administrator must revoke those tokens before their expiry without rotating the entire storage-account key. What should have been used?
- A) The storage-account access key directly.
- B) One account SAS per user with a one-year expiry.
- C) A stored access policy associated with the container SAS tokens. ✓
- D) A Reader RBAC assignment at the subscription.
Answer: C. A stored access policy provides a controllable server-side policy for associated service SAS tokens. Changing or deleting the policy can revoke or alter them together.
Why not the others: An access key is broad and rotation affects all key users. Long expiry increases exposure. Azure RBAC Reader does not create a SAS or grant Blob data access by itself.