AZ-500 Manage identity and access Practice Question
A Defender for Cloud secure score recommendation says storage accounts allow public blob access. What remediation best addresses the root issue?
⚠ Common exam trap
Candidates often confuse the storage account-level public access setting with container-level ACLs, thinking that disabling one automatically disables the other, or they may mistakenly believe that enabling static website hosting or using Front Door can override or mitigate the public access vulnerability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable public blob access at the storage account level and review container ACLs
The secure score recommendation indicates that storage accounts allow public blob access, which is a security risk. The root cause is that anonymous access is enabled at the storage account level, and individual container ACLs may also permit public access. Disabling public blob access at the storage account level (via the 'AllowBlobPublicAccess' property) immediately blocks all anonymous requests, and reviewing container ACLs ensures no residual permissions exist. This directly addresses the vulnerability by enforcing a deny-by-default posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable storage account static website hosting
Why it's wrong here
Enabling static website hosting on a storage account configures a feature for serving fixed content (HTML, CSS, JS) from a dedicated $web container. It does not alter the account's public blob access settings, nor does it enforce any authentication or authorization controls. Therefore, it cannot remediate a Secure Score recommendation about reducing data exposure from publicly accessible blobs.
- ✗
Increase Log Analytics retention
Why it's wrong here
Increasing Log Analytics retention extends the period that diagnostic logs and security telemetry are retained for auditing and incident investigation. While useful for post-breach forensics, it has no effect on the storage account's data-plane access policies, network exposure, or public blob access. Since the Secure Score recommendation targets an active security misconfiguration, retention settings are not a relevant or effective remediation.
- ✓
Disable public blob access at the storage account level and review container ACLs
Why this is correct
Disabling public blob access at the storage account root overrides any container-level permission to 'public read access' for blobs or containers, preventing anonymous requests. Reviewing container Access Control Lists (ACLs) ensures no individual container has been set to allow public access, closing the exact misconfiguration flagged by Defender for Cloud. This directly reduces the attack surface and aligns with the principle of default-deny for storage data.
- ✗
Create an Azure Front Door profile
Why it's wrong here
Creating an Azure Front Door profile introduces a content delivery network (CDN) and global load balancer in front of the storage endpoint, but it does not change the storage account's public access properties. A Front Door can add Web Application Firewall (WAF) rules for HTTP(S) traffic, yet it does not disable public blob access or enforce container ACLs. Because the Secure Score recommendation is specifically about the storage account's identity and access configuration, this option is not a valid mitigation.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.