Examkin

Question

Difficulty: HardConfigure Azure Files and Azure File Sync

An organization has an on-premises Windows Server named Server1 that uses Azure File Sync to synchronize files to an Azure file share named share1. The file share is hosted in an Azure Storage account named storage1.

To comply with security policies, you configure the firewall on storage1 by setting public network access to 'Enabled from selected virtual networks and IP addresses'. You also select the option to 'Allow trusted Microsoft services to access this storage account'.

Immediately after applying these settings, you observe that Server1 can no longer synchronize files with share1.

You need to restore the synchronization between Server1 and share1 while keeping the public network access restricted to selected networks.

What should you do?

  1. Add the public IP address of the on-premises network where Server1 is located to the firewall allowed list of storage1.Answer
  2. B
    Configure the Storage Sync Service to use a system-assigned managed identity and assign it the Storage File Data Privileged Contributor role on storage1.
  3. C
    Configure the firewall of storage1 to allow traffic from the outbound IP addresses of the Storage Sync Service.
  4. D
    Ensure the 'Allow trusted Microsoft services to access this storage account' setting remains enabled, as this automatically permits the Storage Sync Agent traffic.

Answer

Add the public IP address of the on-premises network where Server1 is located to the firewall allowed list of storage1.
The correct answer is correct because the Storage Sync Agent on Server1 communicates directly with the Azure Storage account hosting the file share. When public network access is restricted to selected networks, the storage account firewall blocks this communication. Since Azure File Sync is not a trusted Microsoft service, the bypass setting does not allow the agent to connect. Consequently, the public IP address (or NAT IP range) of the on-premises network where Server1 is located must be explicitly permitted in the storage account firewall settings.

Step-by-Step Solution

1
Analyze the communication flow of Azure File Sync.
The Storage Sync Agent installed on the on-premises server initiates connections directly to the storage account (storage1) over HTTPS (port 443) to synchronize files.
This establishes that the network path originates from the on-premises server's public IP address.
2
Verify if Azure File Sync can bypass the storage firewall using the trusted services exception.
Azure File Sync is not classified as a trusted Microsoft service for storage firewall bypass.
This explains why the synchronization fails even though the 'Allow trusted Microsoft services to access this storage account' option is selected.
3
Formulate the correct firewall configuration.
You must explicitly add the public IP address or NAT range of the on-premises network hosting Server1 to the permitted IP list in the storage account's firewall settings.
This allows the agent's HTTPS traffic to reach the storage account while keeping public access restricted for all other unauthorized networks.

Key Concept

Azure File Sync network requirements and Storage Account firewall bypass limitations
Rate this question

Topics

Configure Azure Files and Azure File Sync

More questions from this topic