AZ-104 Question 92
Single answerYou manage an Azure Storage account that hosts both an Azure file share and multiple Blob containers for your company. A new security requirement mandates that all traffic to and from the storage account must use encryption in transit, including SMB connections to the file share. Which configuration change should you make to meet this requirement?
- A
Enable secure transfer required on the Azure Storage account
- B
Configure a private endpoint for the storage account
- C
Generate a Shared Access Signature (SAS) for the file share using HTTPS only
- D
Enable soft delete for all Blob containers
Show answer and explanation
Correct answer: A
Explanation
Enabling 'secure transfer required' ensures all connections to the storage account are encrypted, covering both HTTPS for Blob services and SMB encryption in transit for Azure file shares.
- A. Correct.
Enabling secure transfer required forces all connections to use encrypted protocols such as HTTPS and SMB 3.x with encryption in transit, meeting the organization’s policy.
- B. Incorrect.
While private endpoints provide secure connectivity to Azure resources, they do not guarantee encrypted data in transit by themselves.
- C. Incorrect.
Generating a SAS with HTTPS only helps secure access but does not enforce encryption for all SMB traffic on the file share.
- D. Incorrect.
Soft delete prevents accidental data deletion, which is useful, but does not enforce encryption in transit.