AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?
⚠ Common exam trap
It's easy for candidates to confuse service endpoints (which only extend VNet identity but leave the public endpoint exposed) with private endpoints (which fully remove public exposure), leading them to choose option A instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.
Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.
Why it's wrong here
Service endpoints provide a direct route to the storage account from the VNet but the storage account's public endpoint is still available. This does not guarantee that only the VNet can access it if the firewall rule is bypassed or misconfigured.
- ✓
Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.
Why this is correct
This is correct because a private endpoint assigns the storage account a private IP address from the VNet's address space, and all traffic to the storage account is routed over the Microsoft backbone rather than the public internet. Disabling public network access on the storage account then blocks every connection that does not originate from that private endpoint. Together these controls enforce a network-level isolation boundary, ensuring that only resources inside the VNet can reach the queue messages and no external client or public internet path exists.
- ✗
Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.
Why it's wrong here
Azure Firewall's NAT rules translate traffic based on IP:port or FQDN, but they do not restrict or scopes access to a specific storage queue or blob container. Even if you route VNet traffic through Azure Firewall, the destination still resolves to the storage account's public endpoint, which remains reachable from the internet unless independently disabled. This approach also conflates network-layer filtering with PaaS-level authorization; Azure Firewall cannot filter on storage account, queue, or message-level permissions, so it fails the requirement to block all public internet access to the sensitive messages.
- ✗
Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.
Why it's wrong here
A shared access signature (SAS) token is a delegated authorization mechanism that operates over the storage account's public endpoint. Even with narrow permissions and a short expiry, any client that possesses the token can access the queue from anywhere on the internet, because the SAS URL includes the public hostname and the signature is validated after the request reaches the endpoint. This solution therefore does not block public network access at all; it merely restricts who knows the secret, leaving a security risk if the token is leaked and violating the stated requirement for network-level isolation.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.