AZ-204 Implement Azure security Practice Question
You need to secure access to an Azure Storage account that hosts sensitive data. The requirement is to restrict access to only requests originating from a specific virtual network. Which feature should you configure?
⚠ Common exam trap
Many exam-takers confuse network-level access control (firewall and VNet rules) with authentication or encryption mechanisms, leading them to pick options like Azure AD authentication or CMK, which do not restrict traffic to a specific virtual network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Storage firewall and virtual network rules
D is correct because Azure Storage firewall and virtual network rules allow you to restrict access to your storage account to only requests originating from a specific virtual network. This is achieved by configuring a service endpoint or a private endpoint for the storage account, which ensures that traffic from the designated VNet is permitted while all other public internet traffic is blocked. This directly meets the requirement of restricting access to a specific virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-managed keys (CMK)
Why it's wrong here
Customer-managed keys (CMK) are an encryption feature that allows you to use your own encryption keys to protect data at rest in Azure Storage. While critical for data security and compliance, CMK solely addresses the encryption of data stored within the account, not the network pathways or sources from which that data can be accessed. Therefore, it does not provide a mechanism to restrict access based on specific virtual networks or IP ranges.
- ✗
Azure AD authentication
Why it's wrong here
Azure Active Directory (Azure AD) authentication provides identity-based access control by verifying the user or application's identity and assigning appropriate roles and permissions. This mechanism ensures that only authorized identities can perform specific actions on the storage account, such as reading or writing data. However, Azure AD authentication does not inherently restrict the *network source* from which these authenticated identities can connect, making it insufficient for VNet-specific access control without additional network rules.
- ✗
Shared access signatures (SAS)
Why it's wrong here
Shared Access Signatures (SAS) provide delegated access to specific resources in your storage account for a limited time and with specific permissions, without sharing your account keys. While SAS tokens can include IP address restrictions to limit access to a single IP address or range, they do not directly integrate with or restrict access to specific Azure Virtual Networks (VNets) or subnets as a primary network security control. SAS is an authorization mechanism for specific operations, not a network-level firewall for VNet integration.
- ✓
Storage firewall and virtual network rules
Why this is correct
Storage firewall and virtual network rules are the primary mechanism for securing network access to an Azure Storage account by defining which networks are permitted to connect. By configuring these rules, you can explicitly allow traffic only from specified Azure Virtual Networks, subnets, or public IP address ranges, effectively creating a network perimeter. This ensures that only trusted private networks or specific external endpoints can establish a connection, directly addressing the requirement for VNet-based access control.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.