AZ-204 Develop for Azure storage Practice Question
A company stores sensitive customer data in Azure Blob Storage. They require that all access to the storage account be logged and that any access from outside the corporate network be denied. They also need to allow read access from a specific Azure web app without exposing the storage account publicly. Which three actions should be taken? (Choose three.)
⚠ Common exam trap
It's easy for candidates to confuse Azure Defender for Storage (a security monitoring service) with diagnostic logging, or they incorrectly assume that a SAS token is the only way to grant access to a web app, overlooking managed identity and role-based access control (RBAC).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace
Enabling diagnostic settings for the storage account and sending logs to a Log Analytics workspace captures all access logs (including read, write, and delete operations) as required by the scenario. This satisfies the logging requirement. Assigning the 'Storage Blob Data Reader' role to the web app's managed identity provides secure, credential-less read access for the web app to the storage account, aligning with the principle of least privilege and avoiding public exposure. Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app ensures that access from outside the corporate network is denied and that the storage account is not exposed publicly, as the web app would access it via a private link or service endpoint within the allowed VNet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Azure Defender for Storage
Why it's wrong here
Enabling Azure Defender for Storage primarily provides advanced threat detection capabilities, such as identifying unusual access patterns, suspicious activities, or potential malware uploads. While it enhances overall security posture by generating security alerts and recommendations, it does not provide granular logging of all access requests (like successful reads/writes) nor does it function as a network firewall to restrict access to specific virtual networks or subnets. Therefore, it fails to meet the explicit requirements for comprehensive access logging and network-level access control.
- ✓
Enable diagnostic settings for the storage account and send logs to a Log Analytics workspace
Why this is correct
Enabling diagnostic settings for the storage account allows for comprehensive logging of all requests, including successful and failed operations, authentication types, and source IP addresses. By sending these logs to a Log Analytics workspace, the company gains a centralized, queryable repository for auditing all access attempts to the sensitive data. This fully satisfies the requirement to log all access, enabling detailed monitoring, security analysis, and compliance auditing.
- ✓
Assign the 'Storage Blob Data Reader' role to the web app's managed identity
Why this is correct
Assigning the 'Storage Blob Data Reader' role to the web app's managed identity leverages Azure Active Directory for secure, identity-based access control. A managed identity provides an automatically managed identity for Azure services, eliminating the need to store credentials directly in the web app's configuration or code. This approach grants the web app the least privilege necessary—read-only access to blob data—without exposing any secrets, significantly enhancing security and aligning with best practices for application authentication.
- ✓
Configure the storage account firewall to allow access only from the virtual network/subnet of the web app
Why this is correct
Configuring the storage account firewall to allow access only from the virtual network/subnet of the web app establishes a robust network-level security boundary. This setting ensures that the storage account is only accessible from within the specified Azure virtual network, effectively blocking all public internet access and unauthorized connections from outside the designated subnet. This directly fulfills the requirement to restrict access to the sensitive data exclusively to the web app's network environment, preventing external exposure.
- ✗
Generate a SAS token and store it in the web app's configuration
Why it's wrong here
Generating a Shared Access Signature (SAS) token and storing it in the web app's configuration introduces significant security risks and does not meet all requirements. SAS tokens are shared secrets that, if leaked, can grant unauthorized access to the storage account for their entire validity period, and their revocation can be complex. Furthermore, SAS tokens only provide authorization for specific operations; they do not inherently provide network-level access restriction, meaning they cannot block access from outside the web app's virtual network, failing a critical security requirement.
Visual reference
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.