AZ-104 Question 58
Select 2You manage an Azure Storage account that must only be accessible from within an Azure Virtual Network (VNet) via a site-to-site VPN. All public traffic to the storage account must be blocked. In the storage account’s Firewalls and virtual networks configuration, which actions should you take to meet these requirements? Choose two.
- A
Allow access from all networks
- B
Allow access from selected networks
- C
Add the relevant VNet and subnet to the Virtual networks list
- D
Enable 'Allow Azure services on the trusted services list to bypass this firewall'
Show answer and explanation
Correct answers: B, C
Explanation
To restrict Azure Storage account access to a specific VNet via a site-to-site VPN and block public access, you must choose 'Allow access from selected networks' in the Storage Firewall settings and explicitly add the targeted VNet and subnet. This configuration ensures only traffic coming through your VNet is permitted, fulfilling the requirement to block all public access.
- A. Incorrect.
Selecting 'Allow access from all networks' would permit traffic from public networks, which violates the requirement to block all public traffic.
- B. Correct.
Selecting 'Allow access from selected networks' ensures the storage account is only accessible from network configurations you explicitly specify, aligning with the requirement to only allow VNet traffic.
- C. Correct.
You must specify the particular VNet and subnet to allow access from that network. This is essential to limit connectivity to your VNet only.
- D. Incorrect.
Enabling this option would permit certain Azure services to bypass the firewall, which could unintentionally allow traffic that should be restricted.