AZ-500 Question 74
Single answerYou have an Azure Storage account that needs to be accessible only through an Azure Virtual Network (VNet) and an on-premises environment connected via VPN. The requirement is to block all public traffic from the internet while still allowing both the internal VNet traffic and on-premises traffic to access the storage account securely. Which solution should you implement?
- A
Configure a private endpoint for the Storage account, disable public network access, and ensure traffic routes through the secure VNet or VPN
- B
Enable the Storage account’s public endpoint and control access strictly with an Azure Firewall
- C
Use service endpoints on the VNet without disabling public network access for the Storage account
- D
Apply a Network Security Group (NSG) that only allows inbound connections from your on-premises IP addresses
Show answer and explanation
Correct answer: A
Explanation
Using a private endpoint is a best practice when you need to fully restrict public network traffic and ensure all traffic flows through a private connection. By disabling the public endpoint on the Storage account and leveraging a private endpoint, you confine all connections within the Azure VNet and from on-premises through the VPN (or ExpressRoute), greatly reducing exposure. Further details on private endpoints and secure connectivity approaches can be found in Azure documentation: https://learn.microsoft.com/azure/private-link/private-endpoint-overview.
- A. Correct.
Option 1 is correct. A private endpoint creates a private IP within your VNet, eliminating the need for a public endpoint and ensuring traffic remains private whether coming from on-premises through a VPN or within the same Azure VNet. Disabling public network access helps prevent any direct internet-based access.
- B. Incorrect.
Option 2 is incorrect. Although Azure Firewall can filter traffic, leaving the Storage account’s public endpoint open can still expose the resource to additional attack vectors. The firewall alone does not enforce private connectivity; a private endpoint is the recommended solution.
- C. Incorrect.
Option 3 is incorrect. Service endpoints do allow VNet traffic to securely connect to Azure services, but they do not disable the public endpoint. If you need to completely block public access, a private endpoint is necessary.
- D. Incorrect.
Option 4 is incorrect. An NSG can help control traffic within a VNet or filter inbound traffic from specific IPs, but it does not by itself disable the public endpoint of a Storage account or provide fully private access.