az-104 Practice Question 1705
Exam: az-104
Domain: Implement and manage storage
Topic: Configure access to storage
Difficulty: medium
Contoso Ltd is experiencing unauthorized access to their Azure Blob Storage from an unexpected IP address. They want to restrict access to only specific IPs while maintaining access control. Which configuration should they implement to achieve this, and how does it work?
Answer Options
A
Implement Shared Access Signatures (SAS) for each blob.
B
Enable Storage Firewall to allow only specific IPs.
C
Use Stored Access Policies to set default permissions.
D
Deploy Network Security Groups (NSGs) in front of the storage account.
Correct Answer
B: Enable Storage Firewall to allow only specific IPs.
Explanation
The correct answer is to use Storage Firewall. Storage Firewall allows you to specify a list of allowed IP addresses or ranges that can access your storage account. This ensures that only the specified IPs can access the storage, thus mitigating unauthorized access. Other options like Shared Access Signatures (SAS) and Stored Access Policies are used for more granular access control at the object level rather than IP level restrictions. Shared Access Signatures provide temporary access with specific permissions, and Stored Access Policies allow setting default permissions for blobs and containers, but neither controls IP access directly.