A lock-photo container was set to Blob anonymous read so a website could load images, and the storage account still allows public access. What should the security engineer do first for access control?
Select an answer to reveal the explanation.
Short Explanation
Anonymous blob read is an unlocked display case on the pier. Shut off allow-blob-anonymous-access on the account, then hand the website Entra or a short SAS—not a forever-open lid.
Full Explanation
Disabling allow blob anonymous access at the account prevents public anonymous reads even if a container setting would otherwise permit them. Websites should use authenticated patterns such as Microsoft Entra RBAC or short-lived shared access signatures. Making only one container private while the account still allows public access is incomplete. CDN caching and broader anonymous listing do not replace turning off account-level anonymous blob access.