Examkin

Question

Difficulty: MediumConfigure Storage Account Network Access

A company implements network-level security on an Azure Storage account named stdata2026. The storage account's network access is set to 'Enabled from selected virtual networks and IP addresses', and the virtual network VNet-App and subnet Subnet-Web are added to the allowed networks list. However, virtual machines running inside Subnet-Web are unable to access the storage containers in stdata2026. You need to resolve this issue and allow the virtual machines to access the storage account over the Azure backbone network. Which configuration should you perform on Subnet-Web?

  1. A
    Assign the Storage Blob Data Reader role to the virtual machines' managed identities.
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account's firewall.
  3. Configure the service endpoint settings for Microsoft.Storage on the subnet properties.Answer
  4. D
    Add an inbound security rule to the subnet's Network Security Group (NSG) to allow traffic from the storage account.

Answer

Configure the service endpoint settings for Microsoft.Storage on the subnet properties.
For a storage account configured with a firewall that restricts access to a specific virtual network subnet, the subnet must have the Microsoft.Storage service endpoint enabled. This ensures that the traffic originating from the subnet is routed with its virtual network identity intact so the storage account firewall can validate and permit the request.

Step-by-Step Solution

1
Analyze the network configuration of the storage account.
The storage account firewall is configured to restrict access to selected virtual networks, specifically Subnet-Web.
When access is restricted to selected networks, the storage account expects incoming traffic to carry the virtual network and subnet identifier.
2
Identify the missing requirement on the subnet level.
The Subnet-Web subnet does not have the Microsoft.Storage service endpoint enabled.
Without the service endpoint enabled on the subnet, traffic to the storage account is sent using public IP routing rather than virtual network routing, causing the storage account firewall to reject it.
3
Enable the service endpoint on the subnet.
The virtual machines in Subnet-Web can now successfully authenticate and access the storage account over the Azure backbone network.
Enabling the Microsoft.Storage service endpoint configures the subnet to inject the virtual network ID into the route header, satisfying the storage account's network access rules.

Key Concept

Azure Storage Account Network Security and Service Endpoints
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic