AZ-204 Implement Azure security Practice Question
A company has an Azure Storage account that stores sensitive data. They need to ensure that all access to the storage account is secured using Microsoft Entra ID authentication and that no storage account keys are used. Which configuration should be applied to enforce this?
⚠ Common exam trap
Many exam-takers confuse network-level security (firewall rules) with authentication enforcement, mistakenly believing that restricting network access alone prevents key-based access, when in fact shared keys can still be used from allowed networks.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable shared key access
Disabling shared key access (Option B) is the correct configuration because it explicitly blocks all authentication using storage account keys (both primary and secondary), forcing all requests to use Microsoft Entra ID (formerly Azure AD) for authorization. This ensures that only identities with appropriate RBAC roles (e.g., Storage Blob Data Owner) can access the storage account, meeting the requirement to eliminate key-based access entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable firewall rules
Why it's wrong here
Enabling firewall rules for an Azure storage account restricts network access to specified IP ranges or virtual networks. While this enhances security by limiting who can physically reach the storage account, it does not prevent a client with a valid storage account key from authenticating and accessing data if their network origin is permitted by the firewall. Therefore, it fails to enforce a specific authentication method like Microsoft Entra ID, which is the core requirement.
- ✓
Disable shared key access
Why this is correct
Disabling shared key access for an Azure storage account is the direct mechanism to prevent clients from authenticating using the storage account's primary or secondary access keys. When this setting is enabled, all requests must authenticate via Microsoft Entra ID (OAuth 2.0 tokens) or through Shared Access Signatures (SAS) that are themselves signed by Microsoft Entra ID or a user delegation key. This effectively enforces a more secure, identity-based authentication model, aligning with the requirement to manage sensitive data by restricting key-based access.
- ✗
Enable advanced threat protection
Why it's wrong here
Enabling advanced threat protection (now Microsoft Defender for Storage) provides an additional layer of security by monitoring for suspicious activities and potential threats against the storage account. This includes detecting unusual access patterns, malware uploads, and data exfiltration attempts. While crucial for identifying and alerting on security incidents, it is a detection and response service that does not enforce or modify the underlying authentication methods permitted for accessing the storage account. It will not prevent the use of shared keys if that access method is enabled.
- ✗
Enable soft delete
Why it's wrong here
Enabling soft delete for an Azure storage account is a data protection feature designed to recover accidentally or maliciously deleted data. When soft delete is active, deleted blobs, blob versions, or containers are retained for a specified duration, allowing for their restoration. This feature focuses solely on data resilience and availability, providing a safety net against data loss. It has no impact whatsoever on the authentication mechanisms or policies governing how users or applications gain access to the storage account.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.