Cascade Regional Airlines locked down the network security group on the booking-tier subnet to deny all outbound traffic except to a handful of approved destinations, then discovered that VMs in that subnet can still reach a maintenance-records storage account whose public network access is left fully open. The network team wants a single control that governs whether the storage account itself accepts that traffic, independent of any subnet's NSG rules. What should they configure?
Select an answer to reveal the explanation.
Short Explanation
An NSG only ever watches traffic moving in and out of the VMs and subnets it's attached to — it has no say over what a separate resource, like a storage account, decides to accept on its own front door. Think of the storage account as a building with its own front desk and its own guest list; the storage account firewall is that guest list, and it's the only thing that actually controls who gets let in.
Full Explanation
Network security groups are a virtual-network construct: they evaluate traffic against subnet- or NIC-level rules and only govern what leaves or enters the VMs and subnets they are attached to. Azure Storage, by contrast, is a PaaS resource that sits outside the VNet's data plane and enforces its own access decisions through its account-level network rules, commonly called the storage account firewall. Locking down a subnet's NSG restricts what the VMs in that subnet can send, but it does nothing to the storage account's own posture — if the account's public network access is still open, any client on the internet, not just the restricted VMs, can still reach it. An outbound NSG rule naming a service tag only tightens what the subnet is permitted to send outward; it cannot make the storage account itself refuse inbound requests from elsewhere. NSGs cannot be attached to a PaaS resource like a storage account at all — they only bind to subnets and network interfaces, so there is no such thing as an NSG applied directly to the storage account. Application security groups exist purely to group VM network interfaces for use inside NSG rules; a storage account has no NIC to add to an ASG. The concrete fix and the operational check are the same: configure the storage account's own network rules to deny public access by default and allow only the selected virtual networks or IP ranges, then confirm from outside those allowed sources that a request to the account is refused.