A nimbus-radar hut leaks a service SAS that referenced stored access policy field. How should the developer revoke access without breaking every other client?
Select an answer to reveal the explanation.
Short Explanation
If the leak rode on policy field, edit or delete that policy and those signatures go dark—without nuking the account keys and every other client.
Full Explanation
When a leaked service SAS referenced stored access policy field, revoke by deleting or changing that policy so signatures that include the signed identifier for field fail validation. Other clients using different policies or ad hoc SAS (or other credentials) can continue, avoiding a blunt rotation of both account keys that would break every key-based client at once.
Rotating both storage account keys immediately as the only supported option fails the “without breaking every other client” requirement. Key rotation invalidates all account-key signatures and connection strings still on the old key; it is a last resort for key compromise, not the precise fix for one policy-based leak.
Deleting the leaked blob while leaving the policy unchanged fails because the SAS may still authorize access to other resources covered by the same policy signature, and recreating the blob would leave the leaked URI useful again if permissions still match.
Publishing a new ad hoc SAS with a longer expiry while ignoring the leak fails because it does not revoke the stolen URI; it only adds another credential and extends risk.
Exam caveat: revocation via stored access policy only affects SAS that reference that policy. If the leaked URI was purely ad hoc with no signed identifier, changing policies will not help—you must wait for expiry or rotate keys / change ACLs as appropriate.
Operational check: identify si=field on the leaked URI, delete or alter policy field on the container, replay the leaked URI and confirm authorization failure, then mint replacement SAS under a new policy name for legitimate nimbus-radar hut clients.