SC-100 Certification Practice Question #173

Question

Your company has 10 branch offices. Each office has a local internet connection that uses a static IP address.

You have an Azure subscription. The subscription contains a storage account named storage1 that stores blobs.

Users in the branch offices access the blobs via the internet.

You need to recommend a solution to ensure that the data in storage1 is accessible only from the branch office static IP addresses. The solution must minimize costs.

What should include in the recommendation?

Accepted Answer

The branch offices reach blob storage over the public internet from known static public IPs, and the goal is to allow only those IPs while minimizing cost. Azure Storage firewall IP network rules do exactly this — set the default action to Deny and add each branch's public IP range — with no additional billed resource. MS Learn explicitly describes adding the public IP of an on-premises client to a storage IP network rule. Azure Firewall (B) and Private Link (A) both introduce extra cost and are unnecessary, and an NSG (D) cannot govern access to a storage account's PaaS public endpoint. Suggested Answer, Most Voted, multiple comments, and MS Learn all agree on C.

More SC-100 practice questions