Restricting storage account access to branch static IPs with Storage firewall rules

SC-100 By islever Editorial Last updated Sep 25, 2026

Specify requirements for securing SaaS, PaaS, and IaaS services

Short answer

C Azure Storage firewall rules restrict access to the branch static IP ranges at the lowest cost, with no extra resources needed.

Question

Your company has 10 branch offices. Each office has a local internet connection that uses a static IP address. You have an Azure subscription. The subscription contains a storage account named storage1 that stores blobs. Users in the branch offices access the blobs via the internet. You need to recommend a solution to ensure that the data in storage1 is accessible only from the branch office static IP addresses. The solution must minimize costs. What should include in the recommendation?

Azure Private Link
an Azure Firewall policy
Azure Storage firewall rules Correct Answer
a network security group (NSG)

Key Takeaways

Storage firewall rules are a built-in, low-cost control that limits access by source IP; Private Link and Azure Firewall add cost, and an NSG does not apply to PaaS storage.

To make an Azure Storage account reachable only from specific branch-office static IP addresses at the lowest cost, use Azure Storage firewall (network) rules, which restrict access to allowed IP ranges without deploying extra network resources.

Common mistake: Choosing Azure Private Link (A) or Azure Firewall (B) — both add cost and resources; the requirement is simply IP-based restriction, which Storage firewall rules satisfy natively and cheaply.

Expert Analysis

Why the Answer Is Correct

Azure Storage supports network firewall rules that allow access only from specified IP address ranges (the branch static IPs). This is a native, low-cost control built into the storage account, meeting the 'minimize costs' requirement without deploying any additional networking resources.

Why the Other Options Are Wrong

Azure Private Link (A) and Azure Firewall policy (B) would satisfy isolation but at significantly higher cost and operational overhead than a simple IP firewall. A network security group (D) applies to subnets/VMs, not to the PaaS storage account.

Community Comment Notes

The community strongly favored C (88 votes). Comments confirm Azure Storage firewall rules let you define the branch static IP ranges that may access the account, which is the lowest-cost approach.

Official Reference

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

This link opens the official vendor documentation in a new tab.

Community Votes

100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

676ae1a 👍 2 Answered C

Las reglas de firewall de Azure Storage permiten definir rangos de direcciones IP que pueden acceder a la cuenta de almacenamiento. Puedes configurar estas reglas para incluir las direcciones IP estáticas de tus sucursales.
Ali96 👍 2 Answered C

Option C (Azure Storage firewall rules) is the best solution.
tuyi2 👍 1 Answered B

Since the branches have static IP addresses, it makes sense to use Azure Firewall policy setting to whitelist the IP address that can access the storage accounts.
AlbertE1nstein 👍 1 Answered C

C. Azure Storage firewall rules
Lrrr_FromOmicronPersei8 👍 2 Answered C

Azure Storage Firewall rules

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide