Examkin

Question

Difficulty: MediumManage Data Movement using AzCopy and Storage Explorer

An administrator needs to use Azure Storage Explorer from an on-premises workstation to download files from a blob container named `securedocs`. The host storage account `stproddata` is configured with public network access restricted to 'Enabled from selected virtual networks and IP addresses'. The administrator must connect to the specific blob container with minimum required permissions. Move the steps to the active area and arrange them in the correct sequence to achieve this goal.

  1. 1Identify the public IP address of the on-premises workstation.
  2. 2Add the workstation's public IP address to the allowed IP ranges under the Networking settings of the storage account.
  3. 3Generate a Service SAS URI at the blob container level with Read and List permissions.
  4. 4Launch Azure Storage Explorer, open the Connect dialog, and select Blob container as the resource type.
  5. 5Select Shared access signature (SAS) as the connection method, paste the generated SAS URI, and complete the connection.

Answer

The correct sequence of steps is: 1) Identify the public IP address of the on-premises workstation; 2) Add the workstation's public IP address to the allowed IP ranges under the Networking settings of the storage account; 3) Generate a Service SAS URI at the blob container level with Read and List permissions; 4) Launch Azure Storage Explorer, open the Connect dialog, and select Blob container as the resource type; 5) Select Shared access signature (SAS) as the connection method, paste the generated SAS URI, and complete the connection.
The correct sequence ensures that network connectivity is authorized first by identifying and adding the workstation's public IP address to the storage account firewall settings. Once network access is enabled, a container-level Service SAS URI is generated to meet the minimum privilege requirement. Finally, the connection wizard in Azure Storage Explorer is launched, configured for a blob container, and the SAS URI is applied to successfully browse and download files.

Step-by-Step Solution

1
Determine the public IP address of the on-premises workstation.
The public IP address of the local client machine is identified.
This IP address is necessary to configure the network access rules of the restricted storage account.
2
Configure the storage account firewall to permit traffic from the workstation's public IP address.
The firewall rule is updated, allowing traffic from the workstation to reach the storage services.
If the firewall is not updated first, the storage account will block all traffic from the workstation, causing the connection to fail.
3
Generate a Service SAS URI at the blob container level with Read and List permissions in the Azure portal.
A container-level Shared Access Signature (SAS) URI is successfully generated.
A Service SAS restricts access specifically to the 'securedocs' container instead of the entire storage account, which satisfies the least-privilege requirement.
4
Open Azure Storage Explorer, launch the connection wizard, and select 'Blob container' as the target resource.
The wizard is prepared to receive the connection details for a single blob container.
Selecting the correct resource type ensures that Storage Explorer expects a container-scoped credential rather than account-level keys.
5
Select the Shared access signature (SAS) option, input the generated SAS URI, and complete the wizard.
The connection is established and the 'securedocs' container is accessible.
Pasting the container SAS URI completes the authentication process, allowing the administrator to download files.

Key Concept

Connecting to Azure Storage resources through Storage Explorer using container-scoped Service SAS tokens while resolving storage firewall constraints.
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic