Examkin

Question

Difficulty: HardConfigure Azure App Services

You manage an Azure App Service web app named WebApp1 and an Azure Storage account named storage1. Access to storage1 is restricted by a firewall.

You need to configure WebApp1 to perform scheduled custom backups to storage1 using a secure, identity-based connection without exposing storage1 to the public internet.

Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Enable a system-assigned managed identity on WebApp1.
  2. 2Assign the Storage Blob Data Contributor role to the managed identity of WebApp1 on storage1.
  3. 3Configure regional virtual network integration for WebApp1.
  4. 4Configure the network firewalls on storage1 to allow access from the subnet used by WebApp1.
  5. 5Configure the backup settings in WebApp1 to target a container in storage1 using the managed identity.

Answer

The correct sequence of actions is: First, enable a system-assigned managed identity on WebApp1. Second, assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1. Third, configure regional virtual network integration for WebApp1. Fourth, configure the network firewalls on storage1 to allow access from the subnet used by WebApp1. Finally, configure the backup settings in WebApp1 using the storage container and the managed identity.
The correct sequence resolves dependencies step-by-step: first creating the security principal (managed identity), then granting it access to write blobs (Storage Blob Data Contributor role), next routing WebApp1's outbound traffic through a virtual network subnet (regional VNet integration), allowing that subnet through the storage account firewall, and finally saving the backup configuration targeting the storage account using the identity.

Step-by-Step Solution

1
Enable a system-assigned managed identity on WebApp1.
A security principal for the Web App is registered in Microsoft Entra ID.
A managed identity is needed to authenticate WebApp1 to storage1 without storing credentials in the application configuration.
2
Assign the Storage Blob Data Contributor role to the managed identity of WebApp1 on storage1.
The managed identity is authorized to read, write, and delete blobs inside the storage account.
The backup system writes archives to storage container blobs, which requires data-plane write access.
3
Configure regional virtual network integration for WebApp1.
Outbound traffic from WebApp1 is routed through the integrated subnet.
Because storage1 is protected by a firewall, WebApp1 must route its traffic through a virtual network to reach it securely.
4
Configure the network firewalls on storage1 to allow access from the subnet used by WebApp1.
The storage account is configured to accept inbound connections from the App Service's subnet.
Without this rule, the storage firewall will block all inbound connection attempts originating from WebApp1.
5
Configure the backup settings in WebApp1 to target a container in storage1 using the managed identity.
The App Service successfully validates the connection and schedules the custom backup.
Validation succeeds because both authentication permissions and network accessibility have been configured.

Key Concept

Configuring App Service backups to secured storage using managed identities and VNet integration
Rate this question

Topics

Configure Azure App Services

More questions from this topic