AZ-700 Question 245
Single answerYou are designing a solution for a company that stores sensitive data in an Azure Storage account. The virtual machines (VMs) in a single subnet must securely connect to the Storage account. There is no requirement to provide private connectivity from on-premises, but you want to restrict inbound connections from other Azure subnets and the public internet. You also want a simple design with minimal overhead. Which approach should you recommend?
- A
Set up Azure Application Gateway in front of the Storage account and block inbound traffic except from the Gateway� private IP address.
- B
Enable a service endpoint for the Storage service on your subnet and configure the Storage account firewall to allow traffic only from that subnet.
- C
Deploy a Private Endpoint for the Storage account in the subnet and disable the public network access setting in the Storage account.
- D
Implement an ExpressRoute circuit with private peering to route all traffic to the Storage account from the on-premises network.
Show answer and explanation
Correct answer: B
Explanation
Service endpoints allow resources in a virtual network to securely communicate with Azure services like Storage over the Azure backbone instead of the public internet. When you only need to restrict traffic to a single subnet in Azure and do not require private connectivity from on-premises, enabling a service endpoint is simpler and more cost-effective compared to configuring private endpoints or ExpressRoute. More details can be found in Microsoft� documentation on Azure service endpoints: https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview.
- A. Incorrect.
Option 1 is incorrect. Application Gateway is typically used for HTTP/HTTPS traffic management and not a straightforward way of restricting storage traffic. While it can control traffic at Layer 7 for web applications, it is not a standard solution for securing Azure Storage account access.
- B. Correct.
Option 2 is correct. Enabling a service endpoint for the Storage service on your subnet and limiting the Storage account firewall to that subnet provides a simple, secure way to ensure only resources in that subnet can access the Storage account. It routes traffic over Azure� backbone network instead of the public internet.
- C. Incorrect.
Option 3 is incorrect in this scenario. Although a Private Endpoint is a more restrictive option (it offers a private IP for the Storage account), it involves added complexity in terms of DNS configuration and manageability. Since there is no requirement for on-premises private connectivity and minimal overhead is preferred, a service endpoint is more suitable.
- D. Incorrect.
Option 4 is incorrect. ExpressRoute with private peering is beneficial if you require dedicated or hybrid connectivity from on-premises to Azure resources, but it is unnecessary for a single subnet in Azure connecting to a Storage account. It also introduces greater cost and complexity than required.