AZ-500 Question 95
Select 2Your company hosts a public-facing web application in Azure App Service. The application fetches static files from an Azure Storage account. You must ensure that the website remains publicly accessible, but direct anonymous access to the storage account is blocked. You also want to restrict access so that only the web app can retrieve files. Which two actions should you perform to meet these requirements?
- A
- Enable the storage account firewall and add the Azure App Service’s outbound IP addresses to the allowed list.
- B
- Disable the 'Allow Blob public access' setting at the storage account level.
- C
- Create a public container and set the container access level to 'Container'.
- D
- Enable Private Link for the storage account and integrate it with Azure App Service via a private endpoint.
Show answer and explanation
Correct answers: A, D
Explanation
To restrict public traffic but still allow the web application to retrieve files, you must configure the storage account so that only the web app can access it. Option 1 leverages the storage account firewall and the web app’s outbound IP addresses, while Option 4 relies on Private Link integration. Both methods effectively block direct anonymous requests while preserving functionality for the intended web application. For more details, see the official Azure documentation on 'Configure Azure Storage firewalls and virtual networks' and 'Secure your storage account with Private Link.'
- A. Correct.
- Correct. By enabling the storage account firewall and allowing only the web app’s outbound IP addresses, you block all direct public traffic while still letting the web app access the files. This is a common approach to reduce exposure and secure storage resources against unauthorized requests.
- B. Incorrect.
- Incorrect. Simply disabling 'Allow Blob public access' can disrupt scenarios where files need to be accessed publicly unless you configure an alternative authentication method (such as a managed identity). In the given scenario, you specifically want the web app to access files without allowing anonymous access. The firewall or private endpoint approaches are more aligned with the stated requirement of restricting traffic solely to the web app.
- C. Incorrect.
- Incorrect. Setting the container to 'Container' level access makes its contents publicly listable, which contradicts the goal of blocking direct anonymous access. This is a common mistake when trying to enable public content while forgetting to limit direct enumeration or retrieval.
- D. Correct.
- Correct. Enabling Private Link and setting up a private endpoint integrates the storage account with the web app’s virtual network. This prevents direct public access while ensuring the web application can still reach the files. It’s a recommended best practice for minimizing exposure to the internet.