AZ-700 Question 243
Single answerYou have an Azure Virtual Network (VNet) with a subnet named SubnetA. You enable the Microsoft.Storage service endpoint on SubnetA to securely connect to an Azure Storage account in the same region. Despite the service endpoint being enabled, users can still connect to the storage account over the public internet. You want to restrict access so that only traffic from SubnetA can reach the storage account. What should you do next?
- A
Configure the storage account� firewall to allow only traffic from SubnetA and set the network access to 'Selected networks.'
- B
Enable the 'Allow Azure services on the trusted services list to access this storage account' option in the storage account settings.
- C
Disable public network access on the storage account and enable a private endpoint on SubnetA.
- D
Create a custom route table that forwards all outbound requests from SubnetA to the storage account.
Show answer and explanation
Correct answer: A
Explanation
Service endpoints allow traffic from a subnet to remain on the Azure backbone when accessing a specific service (e.g., Azure Storage). However, to truly lock down the storage account to that subnet, you must configure 'Firewalls and virtual networks' on the storage account to accept traffic only from 'Selected networks' and explicitly allow the subnet(s). Refer to Azure documentation on 'Configure Azure Storage firewalls and virtual networks' for more details.
- A. Correct.
Correct. Even if you enable service endpoints at the subnet level, you must configure the storage account� firewall to limit access to that subnet. Setting the network access to 'Selected networks' and specifying the subnet ensures that only inbound traffic from SubnetA is allowed.
- B. Incorrect.
Incorrect. Allowing Azure services on the trusted services list does not restrict access to SubnetA alone; instead, it permits certain Azure platform services to bypass the firewall. This setting does not address preventing public internet access.
- C. Incorrect.
Incorrect. While a private endpoint also locks down access via private IP, it is a different technology from service endpoints. Switching to a private endpoint might be a solution, but it is not what you 'must do next' specifically for service endpoints to function as intended.
- D. Incorrect.
Incorrect. A custom route table does not by itself secure the storage account. Service endpoints require firewall configuration on the storage account to enforce which subnets are allowed.