AZ-500 Question 96
Select 2Your company hosts an Azure Storage account for a public-facing web application that serves static content from a container named 'webcontent.' The storage account also has a container named 'privatefiles' that contains sensitive data. You need to ensure the 'webcontent' container remains publicly accessible while protecting 'privatefiles' from all public internet access. In addition, you want detailed visibility into any attempts (successful or not) to read or modify data in 'privatefiles.' Which two actions should you perform?
- A
Configure 'webcontent' for public read (Blob) access and set 'privatefiles' to private container-level access.
- B
Enable Azure Defender for Storage on the entire storage account to monitor and log access attempts, including suspicious activities.
- C
Enable the storage account firewall to allow traffic only from private IP addresses, blocking the public internet entirely.
- D
Distribute a SAS token for the 'privatefiles' container to all employees with full permissions and no expiration date.
Show answer and explanation
Correct answers: A, B
Explanation
To secure public access to Azure resources while still providing visibility into sensitive data operations, it's crucial to configure container-level access appropriately and enable monitoring features. Configuring 'webcontent' as publicly accessible at the container level fulfills the requirement for public static content. Enabling Azure Defender for Storage delivers threat detection alerts and logs, thereby ensuring visibility and a clear audit trail for attempts to access 'privatefiles.' For more details, refer to Microsoft Azure documentation about Storage account public access (https://learn.microsoft.com/azure/storage/blobs/anonymous-read-access-configure) and Azure Defender for Storage (https://learn.microsoft.com/azure/defender-for-cloud/defender-for-storage-introduction).
- A. Correct.
Option 1 is correct. By setting the 'webcontent' container to public read (Blob access level), users can retrieve content without authentication. Keeping 'privatefiles' private ensures that sensitive data is not accessible without valid credentials.
- B. Correct.
Option 2 is correct. Azure Defender for Storage (previously Advanced Threat Protection for Azure Storage) provides threat detection and logs suspicious activities, giving you detailed visibility into attempts to read or modify data in the storage account.
- C. Incorrect.
Option 3 is incorrect. If you configure the storage account firewall to allow only private IP addresses, the public content in 'webcontent' will also be blocked from the internet, which doesn't meet the requirement of keeping 'webcontent' publicly accessible.
- D. Incorrect.
Option 4 is incorrect. Distributing a SAS token with full permissions and no expiration date poses a security risk. It doesn't restrict access solely to authorized users, and there's no built-in expiration to limit the token's validity period.