AZ-700 Question 250
Select 3A company has a virtual network (VNet) with a subnet named 'BackendSubnet.' They need to restrict all traffic from 'BackendSubnet' to a single Azure Storage account, blocking every other storage account. Which three actions should you perform to achieve this using a service endpoint policy?
- A
Enable the Microsoft.Storage service endpoint on the 'BackendSubnet' for secure access.
- B
Create a user-defined route (UDR) to direct traffic from the 'BackendSubnet' to the storage account.
- C
Create a service endpoint policy and add a definition referencing the specific storage account.
- D
Associate the service endpoint policy with the 'BackendSubnet.'
- E
Apply a Network Security Group (NSG) outbound rule allowing traffic only to the storage account.
Show answer and explanation
Correct answers: A, C, D
Explanation
Service endpoint policies allow you to restrict Azure service traffic (in this case, Microsoft.Storage) from a specific subnet to only defined resource instances. The required steps are: (1) Enable the Microsoft.Storage service endpoint on the subnet, (2) create a service endpoint policy referencing the required storage account(s), and (3) associate the policy with the subnet to enforce the restriction. Detailed guidance is available in the official Microsoft documentation for service endpoint policies in Azure, which explains that user-defined routes and basic NSG configurations do not provide this type of Azure service-level resource filtering.
- A. Correct.
Correct. You must enable the Microsoft.Storage service endpoint on the subnet so that traffic to the specified account can flow over the service endpoint. Without enabling the service endpoint, the subnet cannot leverage the service endpoint policy.
- B. Incorrect.
Incorrect. A custom route is not strictly required to restrict access. Service endpoint policies do not rely on user-defined routes (UDRs) to filter traffic to a specific Azure service resource; they rely on enabling the service endpoint and the service endpoint policy itself.
- C. Correct.
Correct. You need to create a service endpoint policy and reference the specific storage account. This is what enforces that only the defined storage account can be accessed from the subnet.
- D. Correct.
Correct. After creating the policy and its definitions, you must associate the policy to the subnet where you want to enforce the restrictions. Associating the policy to 'BackendSubnet' ensures that only the specified account is accessible there.
- E. Incorrect.
Incorrect. An NSG rule alone cannot enforce that only a specific storage account is accessed. While NSG rules can help control ports and addresses, service endpoint policies are specifically designed to filter Azure service traffic by resource, and that is the scenario's requirement.