Exam SC-100 topic 4 question 2 discussion

To ensure that only the application servers can access the storage account, you should recommend: C. Firewall rules for the storage account Azure Blob Storage supports setting up firewall rules directly on the storage account. You can specify the IP addresses or ranges of your application servers to allow access while denying all other incoming traffic. This provides fine-grained control over who can access the storage account.

C is ok

C. firewall rules for the storage account You can configure the Azure Storage account firewall to allow traffic only from specific IP addresses or ranges, ensuring that only the designated application servers can access the blob storage.

C is the answer. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal Turning on firewall rules for your storage account blocks incoming requests for data by default, unless the requests originate from a service that operates within an Azure virtual network or from allowed public IP addresses. Requests that are blocked include those from other Azure services, from the Azure portal, and from logging and metrics services.

answer is; C https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

I would go for C because the other options are eliminated. It doesnt mention seperate firewall

https://docs.microsoft.com/en-us/azure/storage/common/configure-network-routing-preference?tabs=azure-portal#configure-the-routing-preference-for-the-default-public-endpoint