AZ-700 Question 247
Single answerYou manage an Azure environment that contains a virtual network named VNet1 and a storage account named Storage1. You have enabled the Azure Storage service endpoint on a subnet named Subnet1 within VNet1. However, you discover that traffic from the public internet can still reach Storage1. Which additional action must you take to restrict access so only Subnet1 can connect to Storage1?
- A
Configure the storage account� Firewalls and virtual networks to allow access only from Subnet1 and disable access from other networks.
- B
Enable the 'Endpoint Isolation' feature under the service endpoint settings of Subnet1 to block public traffic.
- C
Create a custom DNS zone for Storage1 and map it to Subnet1 to route traffic internally.
- D
Add a service endpoint policy to block traffic from all other subnets in the region.
Show answer and explanation
Correct answer: A
Explanation
Enabling a service endpoint on a subnet only ensures traffic to the Azure service is routed over the Azure backbone network from that subnet. To completely restrict public traffic, you also need to configure the resource� (e.g., Storage account�) �Firewalls and virtual networks� settings so that only the subnet with the service endpoint is allowed. Refer to Microsoft� documentation on securing Azure Storage endpoints for detailed steps and best practices: https://learn.microsoft.com/azure/storage/common/storage-network-security#grant-access-from-a-virtual-network.
- A. Correct.
Option 1 is correct. In Azure Storage� networking settings (under �Firewalls and virtual networks�), you must select �Selected networks� instead of �Allow access from all networks,� and explicitly add the subnet where the service endpoint is enabled. This ensures all external traffic is blocked and only traffic from the specified subnet can connect.
- B. Incorrect.
Option 2 is incorrect. There is no built-in �Endpoint Isolation� feature in Azure service endpoints. Simply enabling a service endpoint on a subnet does not, by itself, block public internet access to the resource. You must configure the resource� firewall settings as well.
- C. Incorrect.
Option 3 is incorrect. Custom DNS settings do not restrict public access to the storage account. They only change name resolution and routing. Access restrictions must be configured in the storage account� network settings.
- D. Incorrect.
Option 4 is incorrect. Service endpoint policies can be used to control outbound traffic from a subnet to certain Azure services, but applying a policy alone does not disable public access. You still need to configure the storage account� firewall to fully lock down inbound traffic to that subnet.