Examkin

Question

Difficulty: Very hardManage Data Movement using AzCopy and Storage Explorer

An administrator needs to migrate a folder named `C:\Data` from an on-premises VM to a container named `migration-data` in an Azure Storage account named `mystorageacct` using AzCopy. The migration must meet the following security requirements:

- Authentication to the storage account must be performed using a Microsoft Entra ID service principal.
- Network access to the storage account must be restricted, allowing connections only from the migration VM's public IP address, which is 203.0.113.80203.0.113.80.

Which sequence of actions should the administrator perform on the Azure Portal and the migration VM to execute the migration successfully? To answer, arrange the actions in the correct order.

  1. 1Assign the Storage Blob Data Contributor role to the service principal at the scope of the `mystorageacct` storage account.
  2. 2In the networking settings of `mystorageacct`, allow access from the public IP address 203.0.113.80203.0.113.80.
  3. 3On the migration VM, set the `AZCOPY_SPA_CLIENT_SECRET` environment variable to the client secret value of the service principal.
  4. 4On the migration VM, run the command: `azcopy login --service-principal --application-id <AppID> --tenant-id <TenantID>`.
  5. 5On the migration VM, run the command: `azcopy copy "C:\Data" "https://mystorageacct.blob.core.windows.net/migration-data"`.

Answer

The correct sequence of actions is: First, assign the Storage Blob Data Contributor role to the service principal. Second, configure the storage account firewall to allow traffic from the public IP address. Third, set the client secret using the environment variable on the migration VM. Fourth, authenticate using the service principal login command. Fifth, execute the AzCopy copy command.
The correct order follows a progression from cloud authorization and network provisioning down to the local machine's environment setup, command-line login, and execution. Setting the RBAC permissions and updating the storage firewall on the Azure side ensures the cloud resources are ready. Setting the environment variable on the migration VM is a prerequisite for running the service principal login command. Once logged in, the copy command can interact with the storage container.

Step-by-Step Solution

1
Assign the Storage Blob Data Contributor role to the service principal.
The service principal is authorized to write blobs to the storage account.
Without this RBAC role assignment, any copy operations using Entra ID credentials will fail with an authorization error.
2
Add the public IP address 203.0.113.80203.0.113.80 to the storage account firewall rules.
The storage account permits inbound connections from the migration VM.
If the firewall is not configured, the migration VM will be unable to communicate with the storage endpoint.
3
Set the `AZCOPY_SPA_CLIENT_SECRET` environment variable on the migration VM.
The client secret is stored securely in the local shell environment.
AzCopy does not accept client secrets directly in the CLI syntax; it relies on reading this specific environment variable.
4
Execute the `azcopy login --service-principal` command using the Application ID and Tenant ID.
The local AzCopy session is successfully authenticated with Microsoft Entra ID.
Authentication must occur before attempting data transfer commands that use Microsoft Entra ID credentials.
5
Execute `azcopy copy "C:\Data" "https://mystorageacct.blob.core.windows.net/migration-data"`.
The folder content is uploaded to the target blob container.
This command initiates the actual data movement once security, firewall, and authentication configurations are complete.

Key Concept

Configuring secure authentication and network connectivity parameters for AzCopy migrations using Microsoft Entra ID and storage account firewalls.
Rate this question

Topics

Manage Data Movement using AzCopy and Storage Explorer

More questions from this topic