AZ-500 Secure compute, storage, and databases Practice Question
Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse network-level controls (firewall or private endpoint) with authentication mechanisms, mistakenly believing that restricting network access alone satisfies the requirement to avoid shared keys or SAS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure AD authentication with managed identities
Azure AD authentication with managed identities allows applications to authenticate to Azure Storage without using shared keys or SAS tokens. Managed identities provide an automatically managed identity in Azure AD, enabling applications to use OAuth 2.0 tokens for secure access to storage accounts. This approach eliminates the need for any shared secrets or keys, meeting the requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a stored access policy with a shared access signature
Why it's wrong here
A stored access policy defines constraints (start, expiry, permissions) for a shared access signature, but the SAS itself is signed with the storage account key or a user delegation key derived from an Azure AD identity. Even with a stored access policy, the application must manage and rotate shared keys or obtain a delegation key, which does not eliminate secret management. Additionally, SAS tokens do not represent the application's Azure AD identity; they are bearer tokens with scoped access, so they do not meet the requirement to authenticate the application identity in Azure AD.
- ✗
Configure a firewall on the storage account to allow only the application's IP address
Why it's wrong here
Configuring a firewall on the storage account only limits network traffic to permitted IP address ranges; it does not verify who is making the request. An attacker or another workload running from an allowed IP address could still access the blobs using the account key or a leaked SAS. Azure AD authentication with managed identities, by contrast, ties the request to a specific compute identity, so IP-based rules are purely a network boundary, not an identity solution.
- ✗
Enable a private endpoint for the storage account
Why it's wrong here
Enabling a private endpoint maps the storage account to a private IP address inside your virtual network, which removes internet exposure, but it says nothing about the caller's identity. Requests sent through the private endpoint still need to be authorized (with an account key, SAS, or Azure AD), and any service in the peered hub or same VNet can reach it. The private endpoint is a connectivity and isolation mechanism, not an authentication method, so it cannot replace Azure AD identity-based access.
- ✓
Use Azure AD authentication with managed identities
Why this is correct
Azure AD authentication with managed identities assigns an automatically managed service principal to the compute resource, and the SDK obtains an OAuth 2.0 token from Azure Instance Metadata Service without storing any secrets. The identity is then mapped to Azure RBAC roles such as Storage Blob Data Contributor/Reader, providing granular, revocable access. This eliminates shared-key management and clearly ties each request to an application identity, aligning with the requirement to authenticate without managing credentials.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.