AZ-204 Implement Azure security Practice Question
A company stores sensitive data in an Azure Storage account. They need to restrict access based on the client's IP address and require that clients use a valid SAS token. Which mechanism should they use?
⚠ Common exam trap
Many exam-takers confuse network-level IP restrictions (firewall/VNet) with SAS-level IP restrictions, not realizing that only a SAS token with an IP ACL can enforce both a valid token and a specific client IP address simultaneously.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SAS token with IP ACL.
A SAS token with an IP ACL (access control list) allows you to restrict access to a specific client IP address or range of IP addresses while also requiring a valid SAS token for authentication. This meets both requirements: IP-based restriction and SAS token validation. The IP ACL is specified as part of the SAS token's signed IP (sip) parameter, which enforces that requests must originate from the allowed IP range.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID authentication.
Why it's wrong here
Microsoft Entra ID authentication grants access based on identity and role assignments. While conditional access policies can enforce source IP restrictions for *login* to Azure, the access token issued for Azure Storage does not inherently embed or enforce a specific client IP address range for subsequent API calls. Therefore, Entra ID authentication alone cannot restrict storage access to a specific IP range *per request* without additional mechanisms like a SAS token.
- ✗
Shared Key.
Why it's wrong here
Shared Key authentication uses the storage account's primary or secondary access key to sign requests. This method provides full administrative access to the storage account and its contents, making it highly powerful and risky if compromised. Crucially, Shared Key authentication does not offer any built-in mechanism to restrict access based on the client's source IP address for individual requests, nor does it support time-limited access, making it unsuitable for granular, restricted sharing.
- ✓
SAS token with IP ACL.
Why this is correct
A Shared Access Signature (SAS) token provides delegated access to Azure Storage resources with granular control over permissions, services, resource types, and validity period. Critically, a SAS token can include an `sip` (signed IP) parameter, which specifies an acceptable range of public IP addresses or a single IP address from which requests must originate. This ensures that even if the SAS token is intercepted, it can only be used by clients within the designated IP range, significantly enhancing security for specific, time-limited operations.
- ✗
Firewall and virtual networks.
Why it's wrong here
Configuring a storage account's firewall and virtual network rules restricts access at the network perimeter, allowing requests only from specified IP addresses, IP ranges, or virtual networks. While effective for overall account security, this is a broad, account-level control that applies to *all* access attempts, regardless of the authentication method. It does not provide the granular, per-request, time-limited, or permission-specific access control that a SAS token offers, nor does it allow for temporary, restricted access to external entities without modifying the core network rules.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.