DP-203 Design and implement data storage Practice Question
You need to store JSON files from an external partner in Azure Blob Storage. The files contain sensitive financial data. Which access method provides the highest security while allowing the partner to upload files?
⚠ Common exam trap
Test-takers frequently confuse IP-based firewalls (Option B) as a security method, but firewalls do not authenticate users or control data-plane permissions, and they can be bypassed if the partner's IP changes or if the partner uses a shared network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Generate a shared access signature (SAS) with write-only permission and expiry time
A Shared Access Signature (SAS) with write-only permission and an expiry time provides delegated, time-limited access to Azure Blob Storage without exposing the storage account key. This ensures the partner can upload JSON files but cannot read, modify, or list existing blobs, and access automatically revokes after the expiry, meeting the highest security requirement for sensitive financial data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the storage account access key with the partner
Why it's wrong here
Sharing the storage account access key grants full control over the storage account, including read, write, and delete permissions. This is a security risk because the key cannot be scoped to specific permissions or time-limited, making it unsuitable for sensitive data.
- ✗
Configure a firewall to allow only the partner's IP address
Why it's wrong here
A firewall restricting by IP address only controls network access; it does not authenticate the user or restrict data-plane operations. If the partner's IP changes or they use a shared network, unauthorized access may occur. Additionally, it doesn't provide write-only or time-limited permissions.
- ✓
Generate a shared access signature (SAS) with write-only permission and expiry time
Why this is correct
A Shared Access Signature (SAS) with write-only permission and an expiry time allows the partner to upload files without exposing the account key. It limits access to exactly what is needed (write only) and automatically revokes after the expiry, providing the highest security for sensitive financial data.
- ✗
Enable anonymous public access to a container
Why it's wrong here
Anonymous public access exposes the container to unauthenticated reads and writes, so sensitive financial data is reachable by anyone with the URL. It is tempting because it removes credential friction for the partner, but the correct method is a time-limited SAS token or Microsoft Entra ID-backed access scoped to upload only.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DP-203 question from scratch — 509 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.