A water-quality storage account has a working Private Endpoint, but public network access is still Enabled from all networks. What judgment should the security engineer apply?
Select an answer to reveal the explanation.
Short Explanation
Private Endpoint plus “all networks” still leaves the public VIP open for business. Flip public access to Disabled—or tightly selected—so private is actually private.
Full Explanation
A working Private Endpoint does not automatically block public VIP access if public network access remains Enabled from all networks. For a water-quality storage account, set public network access to Disabled (or selected networks that exclude the open Internet) so the Private Endpoint is the intended path.
Leaving all networks enabled because a Private Endpoint automatically blocks every public VIP request fails—public access can still succeed until disabled. Switching only the access tier to Cool fails as a network control. Removing the Private Endpoint so the public VIP becomes the sole hardened path reverses the private design.
Exam caveat: Private Endpoint plus Disabled public access is the complete private-storage pattern. Operational check: disable public access, verify PE path works, verify Internet clients fail, and monitor dependent services for missing trusted exceptions. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.