Secure storage, databases, and networking
Four layers, and none of them implies another
A request that arrives from an allowed source still has to meet the storage account's authorization requirements: network admission and authorization are separate controls, and satisfying one does not satisfy the other. Storage accounts, databases, and the virtual networks around them all sit behind the same four layers: network admission (may this request reach the resource at all), authorization (may this caller perform this operation), data protection (how the bytes are protected while stored and while moving), and monitoring and detection (what records the access and raises an alert on it). That independence holds across all four, so the favorite trap in this domain, the largest on the exam at 29.1 percent, is a scenario that fixes the wrong layer or assumes that adding one control retired another. Name the layer the requirement is really about, and the right service usually follows.
The domain unfolds in three steps: storage, then databases, then the network around both
Read this page as the map and the three subtopics as the territory. Implement security for storage accounts walks all four layers on one resource type, from the storage firewall (a per-resource allow list, like the logical-server firewall on the databases page; Azure Firewall is a separate appliance) and its default network action through Entra data roles and shared access signatures (SAS) to encryption keys, recoverability, and Defender for Storage; go there when a scenario names blobs, files, queues, tables, or an account key. Implement security for databases does the same for Azure SQL Database and SQL Managed Instance, where the Microsoft Entra administrator, the logical-server firewall, transparent data encryption (TDE), the audit policy, and the Defender for Databases plans are each a separate switch; go there when a scenario names a database, a login, or a column. Implement security for Azure network services then covers the plumbing the first two sit on: network security groups (NSGs) and application security groups (ASGs), Azure Virtual Network Manager security admin rules, Azure Firewall, private endpoints and Azure Private Link, VPN connections, Microsoft Entra Private Access, and Azure Network Watcher for working out which rule decided.
When two answers both work, take the identity-backed private path and then close the old one
One instinct earns marks across all three subtopics: prefer a Microsoft Entra identity over a shared secret, and a private path over a public one. A Storage data role or a user delegation SAS beats an account key, and a private endpoint beats an IP allow list when the requirement says traffic must never cross the internet. A data role means a data-plane role such as Storage Blob Data Contributor, not a management role like Contributor. Then finish the job: Azure adds the new path without retiring the old one, so approving a private endpoint leaves public network access enabled, granting a data role leaves Shared Key authorization working, and appointing a Microsoft Entra administrator leaves SQL logins accepted. When two options both satisfy the requirement, the exam-correct one normally also disables what it replaced.
The four layers, as each subtopic configures them
| Drill into | Network admission | Authorization | Data protection | Monitoring and detection |
|---|---|---|---|---|
| Implement security for storage accounts | Storage firewall default action, virtual-network and IP rules, private endpoints | Entra data roles, user delegation SAS, service and account SAS, Shared Key | HTTPS-only and minimum TLS, customer-managed keys, infrastructure encryption, soft delete, versioning, immutability | Defender for Storage: activity monitoring, malware scanning, sensitive-data threat detection |
| Implement security for databases | Logical-server and database firewall rules, service endpoints, private endpoint, public network access | Microsoft Entra administrator, Entra-only authentication, database users and roles | TDE with a service-managed or customer-managed key, Always Encrypted, dynamic data masking, ledger | Server-level or database-level audit policy, Defender for Databases plans |
| Implement security for Azure network services | Virtual Network Manager security admin rules, NSGs and ASGs, Azure Firewall, private endpoints and Private Link | Microsoft Entra Private Access: a per-application private path, gated by assignment and Conditional Access | IPsec on VPN gateway connections; private paths keep traffic off the public internet | Network Watcher IP flow verify and effective security rules |