HOTSPOT - You have an Azure subscription that contains an Azure Storage account named storageaccount1. You export storageaccount1 as an Azure Resource Manager template. The template contains the following sections. For each of the following statements, select Yes if the statement is true. Otherwise, select No. Hot Area:

1. Yes: The network access control list (ACL) for storageaccount1 has the

defaultAction set to "Allow". Since the ipRules and virtualNetworkRules arrays

are empty, there are no restrictions in place. Therefore, traffic from any public

IP address, including 131.107.103.10, is permitted by default.

2. Yes: The storage account is of the kind: "StorageV2" (General-purpose V2).

GPv2 accounts support all blob access tiers (Hot, Cool, and Archive) and

allow for setting the tier at the individual blob level. While the default account-

level accessTier is "Hot", individual blobs can be moved to the Archive tier

after upload.

3. No: Accessing an Azure file share with Azure AD credentials requires

enabling an identity-based authentication source on the storage account,

such as Azure Active Directory Domain Services (Azure AD DS), and

assigning appropriate Azure RBAC roles (e.g., Storage File Data SMB Share

Contributor) to the user. Being a Global Administrator in Azure AD does not

inherently grant data-plane access to file shares. The provided template

shows no such configuration.

1. Network ACLs:

o Microsoft Learn: "Configure Azure Storage firewalls and virtual

networks". This document states that the default action is to allow or

deny traffic when no other rules match. The template clearly shows

"defaultAction": "Allow".

§

URL: https://learn.microsoft.com/enus/azure/storage/common/storage-network-security?tabs=azure-

portal

2. Blob Access Tiers:

o Microsoft Learn: "Access tiers for blob data". This document confirms

that "General-purpose v2 (GPv2) accounts support all access tiers for

block blobs" and "You can set the tier of a blob on upload or change

the tier of an existing blob."

§

URL: https://learn.microsoft.com/enus/azure/storage/blobs/access-tiers-overview

§

Section: "Blob-level tiering"

3. Azure Files Identity-Based Authentication:

o Microsoft Learn: "Overview of Azure Files identity-based authentication

options for SMB access". This article outlines the necessary steps,

including enabling an AD source and assigning both share-level and

file/directory-level permissions. It clarifies that authentication is not

enabled by default.

§

URL: https://learn.microsoft.com/enus/azure/storage/files/storage-files-active-directory-overview

§

Section: "How it works"