AZ-104 Question 227
Single answerYou are the Azure Administrator for Contoso. You have an Azure web app running in a subnet within your virtual network and an Azure Storage account in the same region. You want to ensure traffic flows privately and securely between the web app and the storage account by using a service endpoint. You have already created the service endpoint for Microsoft.Storage. What should you do next to ensure only that subnet can access the storage account via the Azure backbone?
- A
Add the web app’s outbound IP addresses to the storage account’s firewall rules
- B
Configure a private endpoint for your storage account
- C
Restrict the storage account firewall to allow the specific subnet and enable the Microsoft.Storage service endpoint on that subnet
- D
Modify the application settings to use private.azurestorage.net as the endpoint
Show answer and explanation
Correct answer: C
Explanation
Service endpoints require you to update the Azure service (storage account) firewall to allow traffic from a specific subnet and enable the relevant service endpoint on that subnet. Restricting the firewall to the subnet where your web app resides ensures secure private connectivity over the Azure backbone.
- A. Incorrect.
Although adding outbound IP addresses can help restrict access, it does not leverage service endpoints and can be cumbersome to maintain if IP addresses change
- B. Incorrect.
Private endpoints provide a private IP in your subnet but do not use service endpoints; this is an alternative solution, not the same
- C. Correct.
Restricting the storage account firewall to your subnet and enabling the Microsoft.Storage service endpoint on that subnet ensures traffic only flows through the Azure backbone
- D. Incorrect.
Using private.azurestorage.net is the fully qualified domain name for private endpoints, not for service endpoints