AZ-104 Question 59
Select 2You administer an Azure Storage account that must only allow incoming connections from an Azure Virtual Network subnet (10.1.0.0/24) and a single on-premises public IP address (203.0.113.10). You need to block all other traffic from the internet. Which configuration steps should you take in the storage account’s Firewall and virtual network settings? (Choose two.)
- A
Select 'Selected networks' in the Firewall and virtual network tab, and add the specific subnet (10.1.0.0/24)
- B
Select 'All networks' and rely on the subnet’s service endpoint to secure traffic
- C
Add the on-premises IP address (203.0.113.10) to the 'Firewalls and virtual networks' allowlist
- D
Enable 'Allow Azure services on the trusted services list to access this storage account' to strictly limit inbound traffic
Show answer and explanation
Correct answers: A, C
Explanation
By configuring 'Selected networks' and adding both the specific Azure Virtual Network subnet and the on-premises public IP address to the Storage account firewall, you ensure that only those sources are permitted. This satisfies the requirement to block all other inbound traffic while allowing the specified subnet and IP address.
- A. Correct.
Selecting 'Selected networks' and adding the subnet ensures only traffic from that subnet is permitted (assuming service endpoints or private endpoints are correctly configured).
- B. Incorrect.
Choosing 'All networks' would override restrictions by allowing inbound traffic from any location, which is not desired in this scenario.
- C. Correct.
Adding the on-premises IP address (203.0.113.10) to the storage account firewall explicitly grants access from that address while blocking other unknown IPs.
- D. Incorrect.
Enabling 'Allow Azure services on the trusted services list' opens broad access from various Azure services, not limiting traffic to just the specified subnet and IP address.