Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Create a shared access signature (SAS) that is signed with a user-delegation key. The user-delegation key is obtained through Microsoft Entra ID authentication by whoever creates the SAS, so the storage account access key never leaves Azure. If the SAS is later compromised or no longer needed, you can immediately invalidate it by calling the Revoke User Delegation Keys operation (or the corresponding CLI/PowerShell command), which cancels all user-delegation keys issued before the revocation time. A service SAS relies on the account key, public anonymous access removes all authentication, and distributing the account key grants full account permissions and is hard to revoke granularly.