Your team creates a new Azure Storage account using default settings and does not touch the Networking tab at all. Assuming a client presents a valid access key, from which networks can it authenticate to the account's public endpoint?
- A. Any network, public or private, because storage accounts allow traffic from all networks until firewall rules are added Correct
- B. Only virtual networks that exist in the same subscription as the storage account
- C. Only the private IP range used internally by the Azure portal
- D. No networks, because a default-deny firewall is applied automatically at account creation
Why A is correct
A freshly created storage account has its network access set to allow connections from all networks by default. The firewall only starts restricting traffic once an administrator explicitly adds virtual network rules, IP rules, or switches to selected networks or disabled public access. Until that configuration happens, any client anywhere can reach the public endpoint, though it still needs a valid authorization mechanism such as an access key, SAS token, or Microsoft Entra role assignment to actually read or write data.
Why the others are incorrect
A same-subscription restriction is never applied automatically — network access isn't scoped by subscription boundaries at all. The storage firewall has nothing to do with the Azure portal's own internal IP ranges, which is an unrelated management surface. And the premise is backwards: no firewall is enabled by default, so the account isn't locked down until someone configures one.