SC-100 Certification Practice Question #197

Question

Your company plans to provision blob storage by using an Azure Storage account. The blob storage will be accessible from 20 application servers on the internet.
You need to recommend a solution to ensure that only the application servers can access the storage account.
What should you recommend using to secure the blob storage?

Accepted Answer

The blob storage is reached over the internet by 20 known application servers, and the goal is to allow only those servers. The Azure Storage account firewall provides exactly this: IP network rules that allow specific public IP address ranges (the application servers) and deny everything else on the account's public endpoint. MS Learn explicitly describes creating IP network rules from a client's public IP to access storage data. NSGs and Azure Firewall operate on virtual-network/subnet traffic rather than a storage account's own endpoint, and WAF protects web applications — so they are eliminated. The Suggested Answer, the unanimous Most Voted (C, 17 votes), the top comments, and MS Learn all converge on C, with no credible dissent.

More SC-100 practice questions