AZ-700 Question 251
Select 2An organization hosts an Azure virtual network with multiple subnets, including a Production subnet (ProdSubnet). They have an Azure Storage account that must only be accessible from this ProdSubnet. They decide to use a service endpoint for Microsoft.Storage to secure traffic between the subnet and the Storage account. Which two actions should you take to properly configure this scenario so that only traffic from the ProdSubnet can access the Storage account?
- A
Under the Storage account� Firewalls and virtual networks, select �Allow access from selected networks� and add the ProdSubnet under the proper Virtual Network and subnet.
- B
Enable the Microsoft.Storage service endpoint under the ProdSubnet configuration in the virtual network settings.
- C
Create an inbound Network Security Group (NSG) rule on the ProdSubnet that explicitly allows traffic from the Storage account� public IP address.
- D
Create a Private Endpoint for the Storage account and disable public network access for the account.
- E
Add a custom route in the ProdSubnet� route table to forward all internet traffic to a Network Virtual Appliance (NVA).
Show answer and explanation
Correct answers: A, B
Explanation
When configuring Azure service endpoints for a Storage account, you must enable the service endpoint (Microsoft.Storage) on the relevant subnet and then use the Storage account� firewall settings to allow traffic solely from that subnet. This approach ensures only the intended subnet traffic is granted access. For more details, consult Microsoft documentation on 'Use Azure service endpoints to secure your critical Azure service resources.'
- A. Correct.
Correct. In the Storage account� networking settings, selecting �Allow access from selected networks� and specifying the ProdSubnet ensures that only traffic from that subnet is allowed. This firewall configuration is essential to restrict access to the subnet.
- B. Correct.
Correct. Enabling the Microsoft.Storage service endpoint on the ProdSubnet ensures traffic to the Storage account uses the dedicated service endpoint path within Microsoft� network. Without enabling it, the subnet cannot route traffic securely to the Storage account via the service endpoint.
- C. Incorrect.
Incorrect. With service endpoints, you don�t need a special inbound NSG rule to allow the Storage account� public IP address. Configuring the service endpoint and the Storage account firewall settings is sufficient.
- D. Incorrect.
Incorrect. Creating a Private Endpoint is a different method for securing access, not using service endpoints. Private endpoints assign a private IP address in your subnet, which is not what is required here.
- E. Incorrect.
Incorrect. Simply adding a route to forward internet traffic does not limit access to the Storage account from a specific subnet. The key is to use the firewall setting in the Storage account and enable the service endpoint on the ProdSubnet.