AZ104-Q: secure a private application data path
An application in a VNet must access a storage account with public access disabled. Developers must read blobs but not manage the account. Which design best satisfies both requirements?
- A) Give developers Owner and enable public blob access.
- B) Give the application an account key and a public IP.
- C) Use a Private Endpoint plus private DNS, and grant the application/developer identities only the required Azure Storage data-plane roles. ✓
- D) Add a CanNotDelete lock only. Answer: C. Network private access and least-privilege data authorization solve different parts of the requirement. Why not the others: Broad roles, shared keys, public exposure, and locks do not meet both controls.
Related
private-endpoint · private-dns · rbac · storage-network-rule