Pass Your Microsoft SC-500 Exam Easy!

Disallowing Shared Key is a sensible hardening step after migration, but it might invalidate a key-signed SAS and aggravate this failure. It does not identify whether the current 403 comes from SAS scope, expiry, or the network filter.

Anonymous container settings control calls without an authorization token. The question concerns a request that includes a SAS and may be filtered by a firewall; making a container private does not diagnose the rejection.

Enabling HTTPS or fixing an older TLS client solves an insecure transport handshake, but the described client already negotiates HTTPS and receives a service response. This step would not establish why the request was denied.

Restricting anonymous access is an important preventive security control, but it does not by itself collect a record of authenticated and failed Blob API calls needed for investigation.

Distinguishing a SAS authorization failure from a firewall deny is a troubleshooting task; without an appropriate diagnostic destination the team lacks a durable monitoring feed for both successful and failed requests.

Legal hold and retention policy scope can preserve records against tampering but are not the service-level request telemetry collection and monitored workspace access controls required here.

RBAC and SAS remain necessary for data authorization; neither by itself limits source traffic to the named subnet.

Resource-instance rules authorize certain Azure resources, but are not the requested subnet-level source restriction.

Trusted Microsoft-service exceptions apply to enumerated supported services, not arbitrary application requests from the specified subnet.

Auditing all existing firewall exceptions is useful housekeeping, but it does not itself create the narrowly scoped allow rules required for the two known vendor sources.

A resource-instance rule is for certain Azure resource instances, not a general mechanism to admit an unrelated vendor connecting from specified public IP addresses.

Checking NAT is part of validating the vendor’s address report, but merely observing the translated IP does not add the required allow entries to the account firewall.

A private endpoint and disabled public access may be a good private-only design, but this choice assumes the workload already has functional private DNS/routing. Without configuring its actual path, it does not directly resolve a denied request.

A VNet rule for a different subnet does not admit requests from the actual workload. Identify its supported networking route before adding a subnet or private endpoint rule; the existing identity does not alter where packets originate.

The trusted-services exception is not a blanket permit for all managed identities or Azure resources. The scenario says this workload is not an eligible exception, so enabling it cannot be relied on to resolve the blocked request.

Data-plane permissions protect which client may read or write, but a client with valid credentials can still use the public endpoint when it remains enabled. The network requirement is private-only connectivity.

NAT address verification is useful for public-IP firewall troubleshooting, not for removing the unwanted public endpoint when a private-only design is required.

Auditing public allowlists is helpful but leaves a public endpoint operating if selected public networks remain allowed. The stated architecture requires disabling that public access, not merely pruning one range.

A service endpoint and subnet rule can admit a particular VNet workload, but that is not what the trusted-services exception means. It cannot establish whether the service being discussed qualifies for the exception.

Reviewing every network rule can find stale allow entries, but it does not answer the immediate claim that this one exception grants network access to all Azure resources.

Permitting a workload’s real path is important for a denied request, but assuming that the generic trusted-services toggle admits all managed identities confuses the exception with a general networking allow rule.

A general rule audit may reveal stale entries, but the immediate diagnostic is to identify the translated public source rather than insert the unroutable private host address as an allowed internet source.

Disabling public network access and switching to a private endpoint is a different architectural choice that requires a configured private route. It does not tell the engineer which source a public-endpoint firewall actually evaluates for the current connection.

Resource-instance rules are for supported Azure resources; an on-premises host with a private RFC1918 address is not such a resource instance and does not qualify under this mechanism.

Inspecting NAT addresses does not solve an instance that cannot be isolated with a stable IP rule. A named resource-instance rule avoids depending on transient egress IPs when the service supports this feature.

A private endpoint may be preferable when supported and reachable, but the stated scenario requires a selected-network public-endpoint rule for a supported resource instance, not a change to private-only routing.

An IP rule depends on identifiable stable public egress addresses; this resource has no usable range. Guessing a broad provider IP range would violate the requirement to allow only the named instance.

Disabling the public endpoint and using a private endpoint is a separate network topology. It would not itself confer read permissions and is unnecessary to disprove the operator’s claim.

A resource-instance rule is another way to admit certain Azure resource network paths. It does not remove the independent requirement for authorized Blob operations.

Adding the same subnet to the firewall again would not create an identity, a token or blob data permissions. The network admission condition is already satisfied in this case.

Inspecting NAT addresses helps establish which public source a legitimate client uses. It does not remove a known obsolete range that continues admitting unwanted requests.

Disabling all public network access can block the obsolete range, but it would also disconnect the expressly required public vendors. The change needs to retain legitimate approved IPs rather than replace the business network model.

Creating narrow rules for a vendor is necessary if approved entries are missing, but appending more allow rules without deleting the stale range leaves the original unauthorized reachability intact.