Describe core data concepts →hardMultiple ChoiceObjective-mapped

DP-900 Describe core data concepts Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
  "apiVersion": "2021-02-01",
  "name": "[concat(variables('storageName'), '/default/data')]",
  "dependsOn": [
    "[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"
  ],
  "properties": {
    "publicAccess": "None"
  }
}
```

You are reviewing an ARM template for an Azure Storage account. The container named 'data' is created with public access set to 'None'. What is the primary benefit of this configuration?

⚠ Common exam trap

It's easy for candidates to confuse 'public access set to None' with broader security features like encryption or deletion protection, when in fact it only controls anonymous read access and does not affect data encryption, soft delete, or accidental deletion safeguards.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It restricts access to authorized users only.

Setting public access to 'None' on a container means that anonymous read requests are not allowed. The primary benefit is that only requests with proper authorization (e.g., using an account key, a shared access signature, or Azure AD credentials) can access the blobs within that container. This directly restricts access to authorized users only, which is the core security advantage.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It encrypts data at rest.
Why it's wrong here
Azure Storage automatically encrypts all data at rest using 256-bit AES encryption, and this service-level setting is always enabled regardless of container configuration. The `publicAccess` property on a container only controls anonymous read access; it has no effect on encryption behaviors. Therefore, while data is indeed encrypted, that outcome is not the result of setting public access to None.
✓
It restricts access to authorized users only.
Why this is correct
When you set a container's public access level to `None`, you disable anonymous access, meaning any request must present valid credentials such as an account key, shared access signature (SAS), or an Azure AD identity with appropriate RBAC role assignments. Authorized users are then the only parties who can read or list blobs in that container. This is the direct function of the `publicAccess` property in the ARM template.
✗
It enables soft delete for the container.
Why it's wrong here
Container soft delete is an account-level data-protection feature that you enable separately in the Azure portal, via PowerShell, or through ARM properties like `containerDeleteRetentionPolicy`; it is not controlled by a container's `publicAccess` setting. Setting public access to `None` does not turn on soft delete, nor does it change how recently deleted containers are retained and recoverable. Confusing these two mechanisms is a common mistake because both relate to container-level security, but they are configured independently.
✗
It prevents accidental deletion of blobs.
Why it's wrong here
The public access level regulates anonymous read access only; it does not restrict what authorized users can do, so those users can still delete blobs or even the container. Preventing accidental deletion is handled by features such as blob soft delete, versioning, or an account-level lock, none of which are enabled by setting `publicAccess` to `None`. Without a retention policy or soft delete enabled, a `DELETE` operation from an authorized caller will permanently remove the data.

Go deeper

DP-900 Describe core data concepts Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question