DP-203 Design and implement data storage Practice Question
A data engineer is setting up Azure Data Lake Storage Gen2 for a new project. The security requirement is to prevent direct access to the storage account from the internet while allowing access from a specific virtual network. Which network security feature should be enabled?
⚠ Common exam trap
Candidates often confuse Azure Private Endpoint with a complete internet-blocking solution, but Private Endpoint alone does not disable the public endpoint; you must also configure the firewall to deny all public traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall and virtual network service endpoints
Firewall and virtual network service endpoints allow you to restrict access to Azure Data Lake Storage Gen2 to only traffic originating from a specific virtual network, effectively blocking all internet-based access. This is achieved by configuring a service endpoint on the subnet and a firewall rule on the storage account that denies all traffic except that from the designated virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Private Endpoint
Why it's wrong here
Azure Private Endpoint provides a private IP address within a virtual network for accessing the storage account, but it does not inherently disable or block the public endpoint's internet accessibility. While it enables secure, private connectivity from a VNet, it doesn't prevent direct internet access to the storage account itself. This option is tempting because it facilitates private access from a VNet, which is part of the requirement. It would be the correct choice if the goal was solely to establish a private connection to the storage account from a VNet, without needing to explicitly restrict public internet access to the service.
- ✗
Shared access signature (SAS)
Why it's wrong here
Not for network-level restriction.
- ✗
Azure Defender for Storage
Why it's wrong here
Security monitoring, not access control.
- ✓
Firewall and virtual network service endpoints
Why this is correct
Allow access from specific VNet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-203 question from scratch — 760 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.