AZ-500 Question 73
Single answerYour organization needs to secure access to an Azure Storage account so that all traffic from on-premises offices travels only through a private connection. The public endpoint of the storage account must be disabled to prevent external connections. You have already established a site-to-site VPN from your on-premises network to an Azure virtual network (VNet). Which approach should you implement to achieve these requirements?
- A
Enable the storage account firewall and whitelist your on-premises network's public IP ranges.
- B
Enable service endpoints for the storage account in the VNet where your on-premises VPN terminates.
- C
Create a private endpoint for the storage account in the VNet and configure on-premises DNS to resolve the private endpoint address.
- D
Use an Azure Application Gateway to proxy all storage traffic from your on-premises network into Azure.
Show answer and explanation
Correct answer: C
Explanation
To secure Azure resources like a storage account behind a private connection, you should use an Azure Private Endpoint. By placing a private endpoint in your VNet, all traffic between your on-premises network and the storage account traverses a private IP address. You then configure on-premises DNS to resolve the storage account's hostname to its private IP address. This approach blocks external public access by disabling the public endpoint. Refer to Microsoft documentation on Private Endpoints (https://learn.microsoft.com/azure/private-link/private-endpoint-overview) for more details.
- A. Incorrect.
Option 1 is incorrect. Whitelisting on-premises IPs in the storage account firewall still uses the public endpoint. This does not ensure traffic goes through a private connection, and the storage account would still be reachable over the internet.
- B. Incorrect.
Option 2 is incorrect. Service endpoints provide a secure channel within Azure but do not fully hide or disable the public endpoint. Service endpoints also do not guarantee purely private connectivity from on-premises over a VPN, because traffic may still route over the public endpoint.
- C. Correct.
Option 3 is correct. Using a private endpoint places the storage account behind a private IP address in your Azure VNet, ensuring traffic stays on the private network. Configuring your on-premises DNS to point to the private endpoint eliminates any need to traverse the public internet and effectively disables the public endpoint.
- D. Incorrect.
Option 4 is incorrect. While Azure Application Gateway can secure web traffic, it is not the primary service for creating a private connection to a storage account. It also will not inherently disable the public endpoint of the storage account.