AZ-204 Implement Azure security Practice Question
Network Topology
Refer to the exhibit. You are using Azure CLI to list blobs in a container. The command fails with an authorization error. The storage account has firewall rules enabled, and you are running the CLI from a machine that is not on the allowed network list. What is the most likely cause of the failure?
⚠ Common exam trap
Watch out — candidates often confuse network-level firewall blocking with missing RBAC role assignments, but the firewall denies the request before any identity-based authorization is checked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The storage account firewall is blocking the request because your IP is not in the allow list
The storage account firewall explicitly blocks all traffic except from IP addresses or subnets in the allow list. Since the CLI is running from a machine whose IP is not on that list, the request is denied at the network layer before any authentication or authorization checks occur. This is the most direct cause of the authorization error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The storage account firewall is blocking the request because your IP is not in the allow list
Why this is correct
Azure Storage firewalls are configured to restrict network access to the storage account based on specific IP addresses or virtual networks. If the client's public IP address from which the Azure CLI command is executed is not explicitly included in the storage account's allowed IP ranges, the firewall will block the incoming request. This network-level denial often manifests as an "AuthorizationFailure" or "Forbidden" error (HTTP 403), as the storage service rejects the connection attempt before full authentication and authorization processing can occur for an unapproved source.
- ✗
You do not have the 'Storage Blob Data Reader' role assigned
Why it's wrong here
Azure Storage supports multiple authorization mechanisms, including Azure Role-Based Access Control (RBAC), Shared Access Signatures (SAS), and account access keys. If the Azure CLI command is authenticating using a storage account access key or a SAS token, these credentials directly grant the necessary permissions for data plane operations. In such scenarios, the absence of an RBAC role like 'Storage Blob Data Reader' would not be the cause of an authorization error, as RBAC is bypassed in favor of the more direct authorization provided by the key or SAS.
- ✗
The container name is misspelled
Why it's wrong here
When an Azure CLI command attempts to interact with a container that does not exist or whose name is misspelled, the Azure Storage service typically returns a '404 Not Found' HTTP status code. This specific error indicates that the requested resource could not be located on the server. An 'AuthorizationFailure' (HTTP 403) error, in contrast, signifies that the resource *does* exist, but the caller lacks the necessary permissions to access or perform the requested operation on it.
- ✗
The storage account requires TLS 1.2 and your CLI uses an older version
Why it's wrong here
A mismatch in Transport Layer Security (TLS) versions between the client (Azure CLI) and the Azure Storage account would prevent the establishment of a secure connection. If the storage account is configured to enforce a minimum TLS version (e.g., TLS 1.2) and the client attempts to connect using an older, disallowed version, the connection handshake will fail. This results in a connection error, such as a 'handshake failure' or 'connection reset,' rather than an authorization error, which would only occur after a successful connection is established and credentials are presented.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.