Examkin

Question

Difficulty: HardConfigure Azure Files and Azure File Sync

An administrator is configuring Azure File Sync to synchronize files between an on-premises Windows Server and an Azure file share named share-a in a storage account named storagea. The on-premises server connects to an Azure virtual network using a Site-to-Site VPN. To meet security requirements, all synchronization traffic must traverse the VPN connection instead of the public internet. The administrator creates a private endpoint for the Storage Sync Service in the virtual network. Which configuration must be completed to ensure the on-premises server can successfully synchronize files with share-a?

  1. Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.Answer
  2. B
    Configure a service endpoint for Microsoft.Storage on the gateway subnet, and add the public IP address of the on-premises server to the firewall of storagea.
  3. C
    Create a second cloud endpoint in the sync group that maps to the private IP address of the Storage Sync Service private endpoint.
  4. D
    Assign the Storage File Data SMB Share Contributor role at the storage account level to the managed identity of the Storage Sync Service.

Answer

Create a private endpoint for storagea targeting the file sub-resource, and configure DNS resolution on-premises for both the Storage Sync Service and storagea private IP addresses.
To route all Azure File Sync traffic over a private connection (such as a VPN or ExpressRoute), both the management endpoint (Storage Sync Service) and the data transfer endpoint (Storage Account File share) must have private endpoints configured. Additionally, the on-premises DNS must be configured to resolve these service endpoints to their respective private IP addresses instead of their public IPs.

Step-by-Step Solution

1
Analyze network path requirements
Identify that the Storage Sync Service private endpoint alone is insufficient because actual file transfer occurs directly between the server and the storage account (Azure Files).
Azure File Sync consists of management traffic (to Storage Sync Service) and data transfer traffic (to the storage account hosting the file share).
2
Determine Storage Account private link requirement
Establish that a private endpoint targeting the 'file' sub-resource of storagea must be created.
Both endpoints must reside within the private network space to keep all synchronization traffic off the public internet.
3
Ensure DNS name resolution
Configure the local DNS forwarders or hosts file on-premises to resolve the Storage Sync Service and storage account FQDNs to their private IP addresses.
Without correct DNS resolution, the agent will continue to attempt connecting to the public IP addresses of the services.

Key Concept

Azure File Sync Private Endpoint Configuration
Rate this question

Topics

Configure Azure Files and Azure File Sync

More questions from this topic