AZ-500 Secure compute, storage, and databases Practice Question
Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.
Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements. Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Azure AD DS and conditional access control authentication but do not enforce network-level IP restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.
Why it's wrong here
A Private Endpoint places the storage account onto a private IP inside your virtual network and eliminates exposure to the public endpoint, but it filters traffic by network path, not by the source IP address of the corporate user or device. A service endpoint merely marks the VNet as a trusted source and, like the private endpoint, does not allow you to specify an allowed corporate IP range; that granularity requires a storage account firewall or an NSG. Additionally, combining a private endpoint with a service endpoint is unnecessary and can cause routing ambiguity, and neither option addresses diagnostic log collection.
- ✗
Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.
Why it's wrong here
Incorrect. A SAS token can include an IP address range in its definition, but once issued, the token can be used from any IP that falls within that range. This does not enforce real-time IP restriction, and managing tokens for all users is impractical.
- ✓
Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.
Why this is correct
A storage account firewall is a network-level access control that evaluates the source IP of every request to the Azure Files endpoint, so locking it to the corporate IP range prevents all other clients from reaching the share over SMB or REST. Enabling diagnostic settings exports StorageRead and StorageWrite operation logs to a Log Analytics workspace, giving you a queryable record of access attempts, successful reads, and failures. Together, they enforce the IP restriction and provide the visibility needed to audit and alert on file share activity.
- ✗
Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.
Why it's wrong here
Azure AD DS integration and Azure AD authentication for Azure Files solve identity verification, allowing Kerberos/NTLM-based sign-in with on-premises user accounts, but they do not evaluate or restrict the source IP address of the SMB client. Conditional Access policies operate at the Azure AD authentication layer and cannot block traffic that has already been authorized to reach the storage account's public endpoint from a non-corporate network. This approach therefore leaves the file share reachable from anywhere that can present valid credentials, so it is not a substitute for an IP-based firewall restriction.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.