AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure Blob Storage to store sensitive documents. The security policy requires that the storage account can only be accessed from a specific Azure virtual network (VNet) and that all access must use Azure Active Directory (Azure AD) authentication. They want to block any access that uses storage account keys or shared access signatures (SAS). Which configuration should they implement?
⚠ Common exam trap
Candidates often confuse 'Require secure transfer' (which only mandates HTTPS) with authentication enforcement, or assume that a private endpoint alone blocks key-based access, when in fact it only secures network connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.
It combines two essential controls: the storage account firewall restricts access to only the specified VNet, and disabling 'Allow storage account key access' enforces Azure AD authentication by blocking all requests that use account keys or SAS tokens. This ensures that only authenticated Azure AD identities from the allowed VNet can access the storage account, meeting the security policy requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.
Why this is correct
Configuring the firewall with an allow rule for the specific VNet permits only traffic originating from that VNet's service endpoint or private endpoint, while setting 'Allow storage account key access' to Disabled forces Azure AD authentication by rejecting shared keys and SAS tokens. With this combination, clients in the allowed VNet must authenticate via Azure AD and be granted an RBAC role such as Storage Blob Data Reader or Storage Blob Data Contributor. This satisfies both the network restriction and the authentication requirement precisely.
- ✗
Configure a private endpoint for the storage account and disable 'Allow storage account key access'.
Why it's wrong here
A private endpoint provides connectivity from a VNet, but it also allows key-based access unless 'Allow storage account key access' is disabled. This option does not mention firewall rules; private endpoint alone does not block other VNets or on-premises unless the public endpoint is disabled. The requirement includes limiting access to a specific VNet, which the firewall handles.
- ✗
Configure the storage account firewall to deny all networks, and set 'Allow storage account key access' to 'Disabled'.
Why it's wrong here
Setting the firewall to 'Deny all networks' creates an implicit block on every source, including the specific VNet, because there is no explicit allow rule for that VNet. The storage account will drop all traffic before authentication is even considered, so disabling key access is irrelevant and the VNet users lose access entirely. To meet the requirement, the firewall must include an explicit allow rule for the VNet's IP range or service endpoint, alongside denying other networks. In effect, this option is a blanket denial rather than a conditional restriction, making it incorrect.
- ✗
Configure the storage account firewall to allow access from the specific VNet, and enable 'Require secure transfer' (HTTPS only).
Why it's wrong here
Enabling 'Require secure transfer' forces HTTPS for all REST API calls, but it is purely a transport-level encryption control and does nothing to restrict which authentication method can be used. With shared key or SAS access still enabled, any client with a valid key or SAS token could authenticate from the allowed VNet, circumventing the Azure AD-only requirement. While the firewall restricts the network surface, the combination leaves the broader authentication surface open, so this choice fails the stated security goal. Additionally, HTTPS-only does not affect the storage account's key access setting; shared key and SAS remain operational.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.