AZ-700 Question 244
Select 2You have a web application running on an Azure Web App, and you need to ensure that all traffic to an Azure Storage account remains on the Microsoft backbone network. You decide to use service endpoints to restrict access to the storage account from only the specific subnet that hosts your web app. Which two actions must you perform to successfully implement this configuration?
- A
Enable the Microsoft.Storage service endpoint on the subnet that hosts the web app
- B
Configure the storage account firewall to allow access from the subnet service endpoint
- C
Enable the Microsoft.Sql service endpoint on the same subnet
- D
Disable any Network Security Groups (NSGs) on the subnet to avoid blocking storage traffic
Show answer and explanation
Correct answers: A, B
Explanation
To secure traffic to an Azure Storage account via service endpoints, you must enable the Microsoft.Storage endpoint on the relevant subnet and update the storage account firewall settings to accept traffic from that subnet. This ensures all traffic traverses Microsoft� private network rather than the public internet. For more details, refer to the official Microsoft documentation on configuring service endpoints for Azure Storage (https://docs.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview).
- A. Correct.
Option 1 is correct. Configuring a service endpoint for Microsoft.Storage on the subnet used by the web app is required so that the traffic to your Azure Storage account is restricted to that subnet and routed over the Azure backbone network.
- B. Correct.
Option 2 is correct. After enabling service endpoints on the subnet, you must allow that subnet in the storage account firewall. This helps ensure only traffic from the whitelisted subnet can access the storage account using the service endpoint.
- C. Incorrect.
Option 3 is incorrect. The Microsoft.Sql service endpoint is unrelated to Azure Storage. Enabling it on the same subnet won�t help you restrict storage traffic or provide the necessary secure connection to the Azure Storage account.
- D. Incorrect.
Option 4 is incorrect. You do not need to disable NSGs to enable service endpoints. NSGs can still provide additional security layers while you configure service endpoints for subnet traffic to an Azure service.