AZ-500 Question 76
Single answerYou have a virtual network named ProdVNet with a subnet called SubnetA and an Azure Storage account named corpfiles. You want to secure corpfiles so that only resources in SubnetA can access it over Azure’s internal backbone. You enable the Service Endpoint for Microsoft.Storage on SubnetA. Which additional configuration must you implement to restrict corpfiles access exclusively to SubnetA?
- A
Enable the 'Allow Trusted Microsoft Services' option in the storage account firewall
- B
Configure the storage account firewall to 'Allow access from selected networks' and add SubnetA
- C
Disable the storage account firewall to allow vNet traffic to flow unimpeded
- D
Create a private endpoint for the storage account in SubnetA
Show answer and explanation
Correct answer: B
Explanation
To lock down access to an Azure Storage account using a vNet service endpoint, you must enable the endpoint on the desired subnet (in this case, SubnetA) and then configure the storage account's firewall to allow access only from that subnet. This setup ensures all traffic uses Azure’s backbone network and effectively restricts external access. For more details, refer to Microsoft’s documentation on virtual network service endpoints: https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview.
- A. Incorrect.
Option 1 is incorrect because enabling the 'Allow Trusted Microsoft Services' option only permits certain Azure services to bypass the firewall. It does not secure the storage account to SubnetA specifically.
- B. Correct.
Option 2 is correct. After enabling the Service Endpoint for Microsoft.Storage on SubnetA, you must configure the storage account firewall to allow access only from that subnet. This ensures all traffic remains on the Azure backbone and is restricted to the specified subnet.
- C. Incorrect.
Option 3 is incorrect because disabling the firewall leaves the storage account publicly accessible, defeating the purpose of restricting access to SubnetA.
- D. Incorrect.
Option 4 is incorrect because creating a private endpoint is a different feature that provides a dedicated network interface within your subnet. While private endpoints also restrict network access, it is not required if you specifically want to use a Service Endpoint configuration to secure traffic with minimal changes.