Storage Accounts

Question 1

Storage Account authentication methods

Answer 1

-Access Keys
-Shared Access Signatures
-RBAC

Question 2

Storage Account Access Keys

Answer 2

-2x 512-bit kets
-access keys allow global access to all resources within the storage account (not good security practice)
-Use access leys sparingly
-The use of access keys violates the principle of least privilege
-access keys need to be diligently protected and rotated regularly

Question 3

Share Access Signature (SAS)

Answer 3

-Authentication token
-Access parameters
-Resource location

Question 4

Storage Account security

Answer 4

-All storage accounts and their containers (BLOB, files, VHDs) are encrypted using Storage System Encryption (SSE).
-Windows OS (that runs on top of a virutal hard disk that is transparently encrypted) can again encrypt the data using Azure Disk Encryption aka Bit Locker with the keys secured in Azure Key Vault.