A water-quality archive storage account is reachable from any Internet IP. Which resource firewall change should the security engineer make first?
Select an answer to reveal the explanation.
Short Explanation
Storage’s public front door isn’t fixed with an NSG sticker. Flip the account’s public network access to selected networks—or Disabled when Private Endpoint owns the path.
Full Explanation
Azure Storage exposes a resource-level network firewall. Setting public network access to Enabled from selected virtual networks and IP addresses—or Disabled when a Private Endpoint will take over—is the first control when a water-quality archive account is reachable from any Internet IP.
Attaching an NSG to the storage account’s public VIP fails because storage is PaaS and is not secured by attaching NSGs to a mythical storage VIP the way a VM NIC is. Rotating storage account keys fails as a network reachability control—keys change authentication secrets, not public network exposure. Enabling soft delete only fails by concept: soft delete aids recovery, it does not block anonymous Internet network paths.
Exam caveat: storage network rules and Private Endpoints are complementary; disabling public access usually follows Private Endpoint readiness. Operational check: set selected networks or Disabled, test legitimate VNet or PE access, confirm Internet clients fail, and monitor for broken backup or integration exceptions. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.