An ivy-walled archive function still uses the storage account key and must grant access to one blob container only. Which SAS should the developer mint?
Select an answer to reveal the explanation.
Short Explanation
One container, one service, still signing with the account key? That’s a service SAS—not an account SAS that can wander across queues and tables.
Full Explanation
A service SAS is limited to one storage service (such as Blob) and can target a container or object; it is typically signed with the account key (or a stored access policy). An account SAS can authorize operations across multiple services and some account-level operations, which exceeds least privilege when only one container is required.