Question

A company hosts static image assets in a blob container named 'assets' within a general-purpose v2 storage account. The web development team needs anonymous, read-only access to individual blobs in this container so that images can be referenced directly by URL from a public marketing website, without requiring any SAS token or account key. The storage account currently has 'Allow Blob anonymous access' enabled at the account level. What should you configure on the container to meet the requirement with the least privilege?

Accepted Answer

Set the container's public access level to 'Blob (anonymous read access for blobs only)'.

Answer

Set the container's public access level to 'Container (anonymous read access for containers and blobs)'.

Answer

Set the container's public access level to 'Private (no anonymous access)' and generate a stored access policy.

Answer

Generate an account-level SAS token with read permission and distribute the URL.