AZ-305 Design infrastructure solutions Practice Question
Your company is migrating a legacy on-premises application to Azure. The application requires persistent storage for configuration files that must be accessible from multiple virtual machines in a virtual network. The storage must be accessible only from within the virtual network and should not be exposed to the internet. Which Azure storage solution should you use?
⚠ Common exam trap
Many exam-takers confuse service endpoints (which still expose the storage to the internet at the endpoint level) with private endpoints (which fully isolate the resource within the VNet), and they may overlook that Azure Files supports SMB for shared file access while Blob Storage does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Files with a private endpoint
Azure Files with a private endpoint is the correct choice because it provides fully managed file shares accessible via SMB or NFS protocols, supports persistent storage for configuration files, and ensures the storage is accessible only from within the virtual network by assigning a private IP address from the VNet, eliminating internet exposure. This meets the requirement for multi-VM access with network isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Disk Storage with shared disks
Why it's wrong here
Azure Disk Storage with shared disks relies on SCSI-3 Persistent Reservations to let multiple VMs attach to the same managed disk, but this is intended for clustered workloads like SQL Server Failover Cluster Instances or Windows Server Failover Clustering, not for general-purpose file sharing. Shared disks do not provide an SMB/NFS protocol layer, require premium SSD tiers with specific caching and availability-zone constraints, and lack the access-control and auditing features of a file service. Even if attached to multiple VMs, the shared disk is a raw block device that each VM must format and manage independently, and it cannot be exposed securely to a network without additional infrastructure.
- ✗
Azure NetApp Files with network security groups
Why it's wrong here
Azure NetApp Files is a fully managed, high-performance NFS/SMB file service, but when paired only with network security groups, it does not guarantee protection from internet exposure because NSGs are applied to subnets or NICs, not to the managed service endpoint itself. The service's public endpoint may still be reachable unless you disable public access and implement a private endpoint or a service endpoint combined with a deny-all NSG rule. Additionally, Azure NetApp Files is significantly more expensive and operationally complex than Azure Files for typical multi-VM file sharing, making it a poor fit for this cost-sensitive migration scenario.
- ✗
Azure Blob Storage with a service endpoint
Why it's wrong here
Azure Blob Storage is object storage, not a file-sharing protocol; although it can be accessed from VMs via REST or SDKs, it does not natively provide SMB or NFS file semantics like file locking, hierarchical directories, or ACLs that legacy applications expect. A service endpoint routes traffic from a virtual network to the blob service over the Azure backbone, but it does not block internet access by default — the service's public endpoint remains active unless you also disable public access or implement a private endpoint. Even if access is restricted, the application would require extensive code changes to use blob storage instead of a file share, making it an impractical migration path.
- ✓
Azure Files with a private endpoint
Why this is correct
Azure Files provides fully managed SMB file shares (also supports NFS for premium tiers) that can be mounted concurrently by multiple VMs, making it the most direct migration target for a legacy on-premises file-based application. By configuring a private endpoint, the file share is assigned a private IP address within your Azure virtual network, eliminating exposure to the public internet and ensuring traffic stays on the Microsoft backbone. Private endpoints also integrate with NSGs, private DNS zones, and Azure Active Directory authentication, giving you fine-grained access control and meeting security requirements without sacrificing the native file-protocol compatibility that legacy applications rely on.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 212-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.