AZ-204 Develop for Azure storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a storage account with a shared access signature (SAS) token and mount using the SAS URL

  Why it's wrong here

  Creating a storage account with a shared access signature (SAS) token provides delegated access to specific resources with granular permissions and an expiry time. However, a SAS token is an authentication mechanism, not a network isolation solution. The storage account's endpoint remains publicly accessible, meaning that even with a valid SAS token, traffic to the file share still traverses the public internet, failing to meet the requirement of avoiding internet exposure.

• ✗

  Create a storage account with a public endpoint and use a VPN gateway to connect the VMs

  Why it's wrong here

  Creating a storage account with a public endpoint directly contravenes the requirement to avoid exposing the file share to the internet. While a VPN gateway establishes a secure, private tunnel for traffic, the storage account's endpoint itself remains publicly addressable. This configuration is suitable for securely accessing Azure resources from on-premises networks or other virtual networks over the internet, where the resource's public addressability is permissible, but private data transmission is paramount.

• ✗

  Create a storage account with a public endpoint and configure the firewall to allow only the VNet

  Why it's wrong here

  Configuring a storage account with a public endpoint and firewall rules to allow only a specific VNet restricts *who* can access the storage account. While VNet service endpoints can route traffic directly over the Azure backbone, the storage account itself still presents a public IP address. This means traffic, though restricted, does not originate from a private IP within the VNet and does not bypass the public network entirely, thus not providing true private connectivity.

• ✓

  Create a storage account with a private endpoint and mount the file share using the private IP

  Why this is correct

  Creating a storage account with a private endpoint establishes a network interface for the storage account directly within a specified virtual network subnet. This assigns a private IP address from the VNet's address space to the storage account, making it accessible only from within that VNet or peered networks. All traffic to the file share then flows entirely within the Azure backbone network, bypassing the public internet and ensuring secure, private connectivity using the private IP.

Go deeper

Related to this question