AZ-500 Question 146
Select 2Your organization stores sensitive data in an Azure storage account. They want to ensure data is accessible only from the company’s Azure virtual networks, detect any anomalous activity, and protect against potential threats. Which two actions should you implement to meet these security requirements?
- A
Configure a private endpoint so the storage account is only reachable from your virtual network
- B
Enable Microsoft Defender for Storage for the storage account
- C
Allow blob public access at the container level for easy testing
- D
Generate a Shared Access Signature (SAS) with no defined expiration for unrestricted access
Show answer and explanation
Correct answers: A, B
Explanation
By configuring a private endpoint, you ensure traffic to your storage account remains within Azure virtual networks, thus meeting network isolation requirements. Enabling Microsoft Defender for Storage provides threat detection and alerts on unusual file or access patterns. Public access and long-lived SAS tokens increase vulnerability. For more details, review Microsoft’s best practices in the Azure documentation on securing storage accounts.
- A. Correct.
Correct. A private endpoint enables secure access to your storage account from within your Azure virtual network, preventing internet-exposed access. This satisfies the requirement to limit connectivity to specific network boundaries.
- B. Correct.
Correct. Microsoft Defender for Storage (formerly Azure Defender for Storage) actively monitors and detects anomalous activities, helping to protect against potential attacks and store logs for analysis.
- C. Incorrect.
Incorrect. Allowing public blob access at the container level exposes data to the public internet, undermining the requirement for restricted access.
- D. Incorrect.
Incorrect. A SAS token with no expiration introduces unnecessary risk of unaudited, long-lived permissions and fails to address the requirement of secure access from specific networks.