AZ-204 Develop for Azure storage Practice Question
You need to securely connect an on-premises application to Azure Blob Storage without exposing data to the public internet. Which feature should you use?
⚠ Common exam trap
Watch out — candidates often confuse IP firewall rules or SAS tokens as providing private connectivity, when in fact they only control access or authentication but still route traffic over the public internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Endpoint
Azure Private Endpoint uses a private IP address from your virtual network to connect to Azure Blob Storage over the Microsoft backbone network, ensuring traffic never traverses the public internet. This provides a secure, private connection for on-premises applications via VPN or ExpressRoute, meeting the requirement to avoid public exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP firewall rules on the storage account
Why it's wrong here
IP firewall rules on a storage account restrict access to specific public IP addresses or ranges. While this provides a layer of security by limiting who can connect, the connection still occurs over the public internet to the storage account's public endpoint. This exposes the traffic to potential interception or other public network risks, failing to meet the requirement for a truly secure, private connection from an on-premises application that avoids internet exposure.
- ✓
Azure Private Endpoint
Why this is correct
Azure Private Endpoint establishes a private link from a virtual network (VNet) to an Azure service, such as a storage account. It assigns a private IP address from the VNet to the storage account's endpoint, making the service accessible only within that VNet or connected networks, like an on-premises environment via VPN or ExpressRoute. This completely bypasses the public internet, ensuring that all traffic remains within the Microsoft backbone and the private network, thus providing the highest level of secure, private connectivity.
- ✗
Storage account access keys
Why it's wrong here
Storage account access keys are highly privileged shared secrets that grant full administrative access to the storage account. While they authenticate access, they do not secure the connection itself or prevent traffic from traversing the public internet. Distributing these keys to on-premises applications introduces significant security risks, as their compromise could lead to unauthorized access to all data, making them an insecure method for managing access and connectivity.
- ✗
Shared access signature (SAS) with stored access policy
Why it's wrong here
A Shared Access Signature (SAS) provides delegated access to specific Azure Storage resources with granular permissions and validity periods. Even when combined with a stored access policy for better management and revocation, SAS tokens are used to authenticate requests made to the storage account's public endpoint. This means the connection still traverses the public internet, failing to meet the requirement for a secure, private connection from an on-premises application that avoids public internet exposure.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.