Your subscription contains a storage account storage1 with a container named container1. You need to configure access to container1 so that: only read access is allowed, both HTTP and HTTPS are permitted, and the permission applies to all content in the container. Which mechanism should you use?

A shared access signature (SAS) is the correct mechanism because it provides granular control over access to Azure Storage resources, including containers and blobs. With a SAS, you can specify permissions (like read-only), allowed protocols (HTTP and HTTPS), and an expiration time. This meets all the requirements: read-only access, both HTTP and HTTPS, and application to all content within the container. An access policy defines stored access policies for a container or blob, which can then be referenced by a SAS. It doesn't grant access directly but helps manage multiple SAS tokens. Azure Content Delivery Network (CDN) is used for caching and delivering content globally, not for defining access permissions to the underlying storage. Access keys provide full administrative access to the entire storage account and are too broad for this specific, limited access requirement.