Microsoft Azure Administrator Associate AZ-104 Practice Question

To grant temporary and restricted access to a specific blob, you should generate a service-level Shared Access Signature (SAS) token with read permissions. A service-level SAS allows you to specify permissions, the resource (in this case, the blob), and the time window for access. It provides fine-grained control without exposing the storage account keys.

An account-level SAS grants permissions at the storage account level and could potentially allow access to more resources than intended. A stored access policy manages constraints for SAS tokens but does not generate the URL itself. Setting the blob's access level to public read access would make the blob accessible to everyone, which is less secure and does not limit access to a specific time window.