AZ-500 Question 67
Select 2You have an Azure Storage account used to store sensitive internal documents. Your security requirements state that only requests from your on-premises corporate network (with known public IP ranges) and an existing Azure virtual network subnet can access the storage account. You decide to configure the built-in firewall settings for the storage account to enforce these restrictions. Which two actions should you take to meet these requirements while minimizing unnecessary exposure?
- A
Enable the firewall in the storage account, select 'Selected networks', and add your corporate network’s public IP address range.
- B
Allow access from all networks to ensure seamless connectivity for all Azure services.
- C
Add the Azure virtual network subnet under the 'Firewall and virtual networks' section for the storage account.
- D
Disable the firewall on the storage account, and rely solely on credentials and Shared Access Signatures (SAS).
- E
Enable 'Allow trusted Microsoft services to access this storage account' to bypass all IP and VNet restrictions.
Show answer and explanation
Correct answers: A, C
Explanation
To protect an Azure Storage account, you must configure its built-in firewall to allow only known trusted IP addresses/subnets. In this scenario, you should first select 'Selected networks' and add your corporate network's public IP ranges. Then, specify the Azure virtual network subnet so only traffic from that subnet can access the account. Avoid overly permissive settings like 'Allow access from all networks' or completely disabling the firewall. For more details, refer to Microsoft Docs on securing Azure Storage with firewall rules (https://docs.microsoft.com/azure/storage/common/storage-network-security).
- A. Correct.
Correct. By selecting 'Selected networks' and specifying your known corporate IP range, you ensure that traffic from your on-premises network is allowed and other networks are blocked by default.
- B. Incorrect.
Incorrect. Choosing 'Allow access from all networks' circumvents any firewall restrictions, defeating the purpose of restricting access to only on-premises and specific virtual networks.
- C. Correct.
Correct. Adding the Azure virtual network subnet to the storage account firewall ensures that only resources within that subnet can access the storage account in addition to your on-premises IP range.
- D. Incorrect.
Incorrect. Disabling the storage account firewall exposes the storage service to any network, relying solely on authorization methods, which increases the attack surface.
- E. Incorrect.
Incorrect. While 'Allow trusted Microsoft services...' can be useful in certain scenarios (e.g., Azure Backup), it does not limit all external traffic; it bypasses some restrictions, potentially allowing more than your specified networks.