Examkin

Question

Difficulty: HardManage Data Movement using AzCopy and Storage Explorer

You have an Azure Storage account named stcopy104 that has its firewall configured to 'Enabled from selected virtual networks and IP addresses'. An administrator named Admin1 is assigned the Storage Blob Data Contributor role for stcopy104. From an on-premises virtual machine, Admin1 runs the 'azcopy login' command and authenticates successfully using Microsoft Entra ID. Admin1 then attempts to upload files to a blob container in stcopy104 by running 'azcopy copy', but the command fails with an HTTP 403 (Authorization Failure) error. Which configuration change is required to resolve this issue?

  1. A
    Assign the Storage Blob Data Owner role to Admin1.
  2. B
    Generate a Shared Access Signature (SAS) token with an expiration window of 24 hours and use it for authentication.
  3. Add the public IP address of the on-premises virtual machine to the firewall settings of stcopy104.Answer
  4. D
    Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on stcopy104.

Answer

Add the public IP address of the on-premises virtual machine to the firewall settings of stcopy104.
The correct answer is to add the public IP address of the on-premises virtual machine to the firewall settings of the storage account. When the firewall of a storage account is configured for selected networks, all incoming requests to the storage account's data plane (such as blob upload requests) are blocked unless the source IP address is explicitly allowed. Even though authentication via Entra ID succeeds because the client can reach the global Entra ID login endpoints, the actual file transfer is blocked at the storage account boundary.

Step-by-Step Solution

1
Analyze the authentication and access paths.
The command 'azcopy login' authenticates against the Microsoft Entra ID endpoint, which is open to the public internet, explaining why login succeeded.
To distinguish between control/identity plane and data plane security boundaries.
2
Evaluate the current data-plane RBAC role permissions.
Admin1 is assigned the Storage Blob Data Contributor role, which is sufficient for upload operations.
To rule out permission-related issues on the data plane.
3
Evaluate the network firewall restrictions on the storage account.
The firewall is enabled for selected networks and currently blocks traffic from the on-premises virtual machine's public IP address.
To identify the root cause of the HTTP 403 (Authorization Failure) error during data transfer.
4
Determine the correct firewall bypass mechanism.
The client's public IP must be added to the allowed IP ranges of stcopy104, as AzCopy on-premises does not qualify as a trusted Microsoft service.
To configure the network rule that permits the AzCopy data transfer.

Key Concept

Azure Storage firewall restrictions on data plane operations versus Entra ID control plane authentication
Estimated Time:2m 30s
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic