DP-203 Design and implement data storage Practice Question
Your company stores sensitive customer data in Azure Data Lake Storage Gen2. You need to implement a security solution that prevents unauthorized access from the public internet while allowing access from specific Azure services and on-premises networks. Which feature should you configure?
⚠ Common exam trap
It's easy for candidates to confuse network-level access controls (firewall and service endpoints) with identity-based controls (Entra ID) or delegation mechanisms (SAS), mistakenly thinking authentication alone can block public internet traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure firewall rules and virtual network service endpoints.
Configuring firewall rules and virtual network service endpoints allows you to restrict access to your Azure Data Lake Storage Gen2 account to only traffic originating from specific virtual networks and trusted Azure services, while blocking all public internet traffic. This provides a network-level security boundary that meets the requirement of preventing unauthorized public access while permitting access from on-premises networks (via VPN/ExpressRoute) and specific Azure services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use private endpoints for all storage accounts.
Why it's wrong here
Private endpoints are useful but not the only method; firewall rules also work.
- ✗
Enable Microsoft Entra ID authentication only.
Why it's wrong here
Entra ID controls access but does not block network-level public internet access.
- ✓
Configure firewall rules and virtual network service endpoints.
Why this is correct
Firewall rules and service endpoints restrict access from public internet while allowing trusted services and VNets.
- ✗
Use shared access signatures (SAS) with IP restrictions.
Why it's wrong here
SAS tokens can be compromised; they do not block public internet access to the storage account.
Go deeper
Related to this question
About these practice questions
One of 760 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.