AZ-104 Question 228
Single answerYou manage a virtual network (VNet) that hosts several Azure VMs in a single subnet. You also have an Azure Storage account in the same region. You want to ensure that only traffic from this subnet can access the storage account and that all public inbound traffic is restricted. Which configuration step should you take first to achieve this?
- A
Enable the service endpoint for Azure Storage on the subnet and configure the Azure Storage firewall to allow traffic only from that subnet
- B
Create a Network Security Group (NSG) rule to explicitly allow Internet traffic to the Azure Storage account from the subnet
- C
Deploy a user-defined route (UDR) that sends all traffic to an on-premises location for inspection before allowing access to the storage account
- D
Enable Azure Firewall on the VNet and configure forced tunneling to block all direct Internet traffic
Show answer and explanation
Correct answer: A
Explanation
By enabling the service endpoint for Azure Storage on the subnet and limiting storage account access to that subnet within the Azure Storage firewall settings, you create a secure path for the VMs to reach the storage account privately. Public traffic is blocked while only traffic from the configured subnet is allowed.
- A. Correct.
Enabling the service endpoint for Azure Storage on the subnet and restricting storage firewall access to that subnet allows secure, private connectivity while blocking external Internet traffic.
- B. Incorrect.
This option doesn’t meet the requirement to restrict public access; it explicitly allows Internet traffic rather than preventing it.
- C. Incorrect.
While UDRs can control routing, they won’t inherently enable or restrict secure access to Azure Storage. Service endpoints or private endpoints are required for restricting direct Internet traffic to the service.
- D. Incorrect.
Although Azure Firewall can help with network-level security, you still need to enable service endpoints (or private endpoints) and adjust the storage firewall itself to restrict public inbound access.