An administrator needs to restrict network access to an Azure Storage account named stdatafiles. The storage account must only be accessible from a subnet named Subnet1 in a virtual network named VNet1, and from an on-premises administration workstation with the public IP address 203.0.113.50.
Which two actions should you perform?
- Enable the Microsoft.Storage service endpoint on Subnet1.Answer
- Configure the stdatafiles firewall to allow access from selected virtual networks and IP addresses, then add VNet1/Subnet1 and the IP address 203.0.113.50.Answer
- CAssign the Storage Blob Data Reader role to the virtual machines in Subnet1 and to the administrator's security principal.
- DEnable the 'Allow trusted Microsoft services to access this storage account' bypass setting on stdatafiles.
Answer
Enable the Microsoft.Storage service endpoint on Subnet1, and configure the stdatafiles firewall to allow access from selected virtual networks and IP addresses, adding VNet1/Subnet1 and the client's public IP address.
To allow secure, direct access from an Azure subnet, the Microsoft.Storage service endpoint must be enabled on the subnet. Once enabled, the subnet and the public IP address of the on-premises workstation can be added to the storage account's firewall rules when set to allow access from selected networks.
Step-by-Step Solution
Key Concept
Azure Storage firewall configuration and virtual network service endpoints.