Microsoft Azure Security Technologies (AZ-500)

Is generating new shared access signatures effective in revoking access to an Azure Storage account?

1. Yes

2. No

The correct answer is: No

Generating new shared access signatures (SAS) is not effective in revoking access to an Azure Storage account. When new SAS tokens are created, they do not invalidate previously issued tokens. This means that any SAS tokens that are still within their validity time frame will continue to grant access to the storage resources as specified at the time they were generated. To effectively revoke access to an Azure Storage account via SAS, you would need to regenerate the storage account keys. Doing so invalidates all previously issued shared access signatures and any other access granted using the old keys. This highlights the fact that the management of keys and signatures is crucial for maintaining security, especially when access needs to be altered or withdrawn. In summary, while creating new SAS tokens can change what is accessible with new tokens, it does not affect existing tokens, hence it cannot be relied upon as a method for revoking access effectively.