Microsoft Azure Security Technologies (AZ-500)

What should an administrator do if users can still access Blob service after suspected unauthorized access?

1. Restrict access at the storage account level

2. Regenerate the Azure storage account access keys

3. Recreate shared access signatures with different permissions

4. Enable auditing on the storage account

The correct answer is: Regenerate the Azure storage account access keys

Regenerating the Azure storage account access keys is a crucial step when there is suspicion of unauthorized access, particularly because the access keys are pivotal for authenticating requests to the Blob service. If unauthorized users have obtained these keys, they can potentially access the Blob service and any data it contains. By regenerating the keys, the existing keys become invalid, effectively cutting off any unauthorized access. This action significantly enhances security because it removes any existing access granted via the old keys. Following the regeneration, the administrator can control and manage new keys more closely, ensuring that only legitimate users are granted access. While restricting access at the storage account level, recreating shared access signatures, or enabling auditing on the storage account are all beneficial practices, they don’t immediately remove unauthorized access that might have already occurred through compromised keys. The regeneration process is a decisive action that addresses the potential breach directly and is essential in protecting the data stored within the Blob service.