AZ-500 Secure networking Practice Question
You need to allow a specific IP address (203.0.113.5) to access an Azure Storage account over the internet. All other internet traffic must be denied. You have enabled the storage account firewall. What should you configure?
⚠ Common exam trap
Candidates often confuse network-level controls (NSGs, service endpoints, private endpoints) with the storage account's built-in IP firewall, which is the only mechanism that can whitelist a specific internet IP address when the storage account firewall is enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the IP address to the firewall rules of the storage account.
The Azure Storage account firewall allows you to configure IP-based access control rules. By adding the specific IP address 203.0.113.5 to the firewall rules, you explicitly permit traffic from that IP while denying all other internet traffic, as the default rule is to deny when the firewall is enabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint for the storage account.
Why it's wrong here
Creating a private endpoint doesn't whitelist a public IP address; it maps the storage account to a private IP within your virtual network. While a private endpoint can be used to limit access to specific VNet clients, it bypasses the public endpoint entirely, so a request from 203.0.113.5 would still be subject to public firewall rules. This option would require disabling public access and does not satisfy the requirement to allow that specific public IP.
- ✓
Add the IP address to the firewall rules of the storage account.
Why this is correct
The storage account firewall supports IP-based network rules, allowing you to explicitly list 203.0.113.5/32 as an allowed client IP. All other public traffic is denied by default, making this the only option that directly addresses access from a specific public IP address. You can add the IP rule either on the storage account's Networking blade or programmatically via the REST API, and existing connections remain unaffected.
- ✗
Configure an NSG on the subnet to allow the IP address.
Why it's wrong here
A network security group (NSG) filters traffic at the subnet or virtual machine NIC layer, not at the PaaS storage account boundary. Storage accounts are not objects inside a subnet unless you're using a private endpoint, and even then the NSG would only control traffic to that endpoint. For a public IP address attempting to reach the storage account's public endpoint, the NSG has no visibility or enforcement path, so it cannot allow this access.
- ✗
Add a service endpoint for Microsoft.Storage to the subnet.
Why it's wrong here
A Microsoft.Storage service endpoint extends the VNet identity to the storage account, but it is designed to allow traffic from a virtual network subnet, not from a specific public IP address. Even if the subnet is enabled for the service endpoint, you would still need to add an allow rule in the storage firewall for that subnet. The address 203.0.113.5 is outside your VNet, so a service endpoint won't enable that IP's access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.