A mulch-yard kiosk pastes a SAS into an http:// link on a chalkboard web page. What distribution practice must the developer follow?
Select an answer to reveal the explanation.
Short Explanation
A SAS in the clear on http:// is basically taping the key to the chalkboard. Mint it and share it only over HTTPS.
Full Explanation
Create and distribute SAS credentials only over HTTPS. A mulch-yard kiosk that pastes a SAS into an http:// chalkboard page exposes the signature query string in cleartext to network observers, intermediate proxies, and referrer leakage. HTTPS protects the token in transit when minting and when browsers fetch the resource.
Preferring HTTP so municipal firewalls can inspect the query string fails because cleartext inspection comes at the cost of credential theft. Security monitoring should not require publishing SAS on unencrypted links; use HTTPS and server-side logging strategies that do not demand open exposure.
Emailing the account key alongside the SAS over any protocol fails because the account key is a durable master credential. Distributing it with the SAS multiplies blast radius far beyond a single time-boxed signature.
Publishing the SAS on an anonymous FTP mirror fails because anonymous FTP is unauthenticated distribution of a bearer URL, often without encryption, making theft trivial for anyone who finds the mirror.
Exam caveat: HTTPS on the Storage endpoint and HTTPS on the page that embeds the SAS are both in scope. Mixed content (HTTPS page loading http:// blob URLs) is both blocked by browsers and unsafe.
Operational check: ensure generated URLs use https:// for the storage endpoint, serve the kiosk page over HTTPS, and verify no account key appears beside the SAS in email, FTP, or public markdown. Treat any HTTP-distributed SAS as compromised and revoke or let it expire immediately.