Exam AZ-700 topic 5 question 7 discussion

IP network rules can't be used in the following cases: To restrict access to clients in same Azure region as the storage account. IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests. Source: https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-an-internet-ip-range Yes, Yes, No

correct! the second one is a YES, firewall has no effect in service endpoints. look here: "Storage firewall rules only apply to the public endpoints of a storage account, not private endpoints. The process of approving the creation of a private endpoint grants implicit access to traffic from the subnet that hosts the private endpoint" https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#about-virtual-network-endpoints

This is in range. /26 means you can made 4 subnet. to me box 3 should be yes etwork Address Usable Host Range Broadcast Address: 132.124.53.0 132.124.53.1 - 132.124.53.62 132.124.53.63 132.124.53.64 132.124.53.65 - 132.124.53.126 132.124.53.127 132.124.53.128 132.124.53.129 - 132.124.53.190 132.124.53.191 132.124.53.192 132.124.53.193 - 132.124.53.254 132.124.53.255

I would agree with you if we were discussing private endpoints, as they bypass public access and firewall rules. Service Endpoints do not. VM2 can pass through subnet 1 to get to the endpoint, but it's source address is still subnet 2 which has not been granted access on the storage account. If a storage account has a Private Endpoint and no rules you can connect to it. If a storage account has a Service Endpoint and no rules you cannot connect to it. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-a-virtual-network "You can enable a Service endpoint for Azure Storage within the VNet. The service endpoint routes traffic from the VNet through an optimal path to the Azure Storage service. The identities of the subnet and the virtual network are also transmitted with each request. Administrators can then configure network rules for the storage account that allow requests to be received from specific subnets in a VNet. Clients granted access via these network rules must continue to meet the authorization requirements of the storage account to access the data."

YYN, I concur

A private endpoint uses a private IP address from your virtual network to access a storage account over the Microsoft backbone network. With a private endpoint, traffic between your virtual network and the storage account are secured over a private link. Storage firewall rules only apply to the public endpoints of a storage account, not private endpoints. The process of approving the creation of a private endpoint grants implicit access to traffic from the subnet that hosts the private endpoint https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-a-virtual-network Also during my testing i noticed the following, if i ADD vNET and chose subnet, the process will automatically create Service-Endpoint and hence having SEP doesnt mean you automatically granted access unless you are in the allow list of the FW otherwise Private Endpoint is ONLY way to bypass the FW

The subnet1 is allowed, check the config of the Storage networking

Yes you are well explaining why the public allowed IP range will not allow the connection from VM2 and why the private IP addresses from VNet1/Subnet2 should be allowed instead (only VNet1/subnet1 is allowed if you look on the storage account configuration) So, Y,N,N.

Question is if it access using service endpoint not public IP