Restricting storage account access to branch static IPs with Storage firewall rules

Specify requirements for securing SaaS, PaaS, and IaaS services
Answer Correct answer: C — Azure Storage firewall rules restrict access to the branch static IP ranges at the lowest cost, with no extra resources needed.

Your company has 10 branch offices. Each office has a local internet connection that uses a static IP address. You have an Azure subscription. The subscription contains a storage account named storage1 that stores blobs. Users in the branch offices access the blobs via the internet. You need to recommend a solution to ensure that the data in storage1 is accessible only from the branch office static IP addresses. The solution must minimize costs. What should include in the recommendation?

  1. Azure Private Link
  2. an Azure Firewall policy
  3. Azure Storage firewall rules Correct Answer
  4. a network security group (NSG)
azure storage firewall rules ip restriction storage account minimize cost network security

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Storage firewall rules are a built-in, low-cost control that limits access by source IP; Private Link and Azure Firewall add cost, and an NSG does not apply to PaaS storage.

To make an Azure Storage account reachable only from specific branch-office static IP addresses at the lowest cost, use Azure Storage firewall (network) rules, which restrict access to allowed IP ranges without deploying extra network resources.

Choosing Azure Private Link (A) or Azure Firewall (B) — both add cost and resources; the requirement is simply IP-based restriction, which Storage firewall rules satisfy natively and cheaply.

Community Discussion (5 comments)

Ali96 👍 2 Selected: C
Option C (Azure Storage firewall rules) is the best solution.
Lrrr_FromOmicronPersei8 👍 2 Selected: C
Azure Storage Firewall rules
676ae1a 👍 2 Selected: C
Las reglas de firewall de Azure Storage permiten definir rangos de direcciones IP que pueden acceder a la cuenta de almacenamiento. Puedes configurar estas reglas para incluir las direcciones IP estáticas de tus sucursales.
tuyi2 👍 1 Selected: B
Since the branches have static IP addresses, it makes sense to use Azure Firewall policy setting to whitelist the IP address that can access the storage accounts.
AlbertE1nstein 👍 1 Selected: C
C. Azure Storage firewall rules

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Azure Storage supports network firewall rules that allow access only from specified IP address ranges (the branch static IPs). This is a native, low-cost control built into the storage account, meeting the 'minimize costs' requirement without deploying any additional networking resources.

Why the Other Options Are Wrong

Azure Private Link (A) and Azure Firewall policy (B) would satisfy isolation but at significantly higher cost and operational overhead than a simple IP firewall. A network security group (D) applies to subnets/VMs, not to the PaaS storage account.

Community Comment Notes

The community strongly favored C (88 votes). Comments confirm Azure Storage firewall rules let you define the branch static IP ranges that may access the account, which is the lowest-cost approach.

Official Reference

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

Related Analysis

Your company has a main office and a branch office. The main

S-Grade

You have an on-premises server that runs Windows Server and

A-Grade

You have a Microsoft Entra tenant that syncs with an Active

A-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide