You work for an organization that has offices in multiple regions across the world. There is a local file server at each office where departmental data is stored. Your company creates a storage account for a pilot of Azure File Sync for a remote office. 192.168.1.0/24 is the subnet used by the remote office. You need to make sure storage account can be accessed from nowhere other than the remote office. What will be your step of action?

Question

Accepted Answer

C. Configure the storage account to allow access from selected networks. Azure storage accounts have built-in network firewall capabilities that allow you to restrict access to specific virtual networks or public IP address ranges, directly fulfilling the requirement to allow access only from the remote office.

Answer

A. Create a Network Security Group (NSG) and create two rules: one rule that blocks all Server Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources within a virtual network, such as VMs, not for directly securing the public endpoint of a storage account.

Answer

B. Create a custom Azure role and allow the "Microsoft.Storager/read" DataActions permission for Creating a custom Azure role and granting `Microsoft.Storager/read` permissions is about access control (who can perform actions), not network access restriction (from where can actions be performed).

Answer

D. Create a Network Security Group (NSG) and create two rules: one rule that blocks all Server This choice is identical to A and is incorrect for the same reason, as NSGs do not directly secure a storage account's public endpoint.

You work for an organization that has offices in multiple regions across the world. There is a local file server at each office where departmental data is stored. Your company creates a storage…

Question

Options

How the community answered

Why each option

Community Discussion