AZ-500 Question 94
Single answerYou have an Azure Storage account hosting a static website that must remain publicly accessible to all users. However, you want to reduce exposure by preventing direct connections to the storage account endpoint over the public internet. Which approach should you implement to meet these requirements?
- A
Enable a public endpoint on the storage account but allow inbound traffic only from your corporate IP range
- B
Use a private endpoint for the storage account and integrate it with Azure CDN so all user requests go through the CDN endpoint
- C
Configure a Network Security Group (NSG) on the storage account to block inbound traffic on port 80
- D
Deploy an Azure App Service with a public IP address and copy the static files there
Show answer and explanation
Correct answer: B
Explanation
To publicly serve static website content without exposing the storage account endpoint, it is recommended to use private endpoints paired with a service like Azure CDN or Azure Front Door. The private endpoint ensures the storage account is accessible only over a private connection, while the CDN or Front Door URL is used by external clients. For more details, refer to Microsoft’s documentation on using private endpoints and Azure CDN for static website hosting.
- A. Incorrect.
Option 1 is incorrect because limiting inbound traffic by corporate IP addresses blocks legitimate public access. You need the content to be accessed by all users, not just those in your corporate range.
- B. Correct.
Option 2 is correct because using a private endpoint for the storage account removes direct public access and allows Azure CDN to serve the content to end users. This pattern ensures the storage account is privately accessible within Azure while the CDN endpoint remains public-facing.
- C. Incorrect.
Option 3 is incorrect because NSGs do not provide filtering capabilities for an Azure Storage account endpoint in the same way they do for virtual machines in a virtual network. NSGs are typically applied to subnets and network interfaces, not directly to the storage service. Also, simply blocking port 80 does not comprehensively solve the exposure issue or allow for HTTPS access from the broader internet.
- D. Incorrect.
Option 4 is incorrect because migrating to an Azure App Service does not address the requirement to keep using the existing storage account securely. This approach also introduces additional overhead and does not directly solve the storage account’s public endpoint exposure issue.