Examkin

Question

Difficulty: Very hardConfigure Storage Account Network Access

You manage the network security for an Azure environment. You have a storage account named `corpdata2026` with its firewall configured to deny all public network traffic by default. The environment contains a virtual network named `VNet1` with two subnets: `SubnetA` and `SubnetB`. You must implement a solution that satisfies the following requirements:
- Virtual machines in `SubnetA` must be able to securely transfer data to `corpdata2026` over its public endpoint without routing traffic over the public internet.
- Virtual machines in `SubnetB` must not have any network access to `corpdata2026`.
- The Azure Backup service must be able to perform scheduled backups of the file shares in `corpdata2026`.
- No private endpoints can be deployed due to IP address space constraints in `VNet1`.

Which two configuration actions should you perform to meet these requirements?

  1. Enable the Microsoft.Storage service endpoint on SubnetA and add a virtual network rule for SubnetA to the firewall of corpdata2026.Answer
  2. Select the exception that allows trusted Microsoft services to access the storage account in the firewall settings of corpdata2026.Answer
  3. C
    Add an IP network rule to corpdata2026 allowing the public IP address range of the Azure Backup service.
  4. D
    Assign the Storage Blob Data Contributor role to the managed identities of the virtual machines in SubnetA.

Answer

Enable the Microsoft.Storage service endpoint on SubnetA, add a virtual network rule for SubnetA to the firewall of corpdata2026, and select the exception that allows trusted Microsoft services to access the storage account in the firewall settings of corpdata2026.
To securely connect SubnetA to the storage account over its public endpoint without traversing the public internet, a virtual network service endpoint for Microsoft.Storage must be enabled on SubnetA, and SubnetA must be allowed in the virtual network rules of the storage account firewall. To allow Azure Backup to access the restricted storage account, the 'Allow trusted Microsoft services to access this storage account' firewall exception must be enabled.

Step-by-Step Solution

1
Enable the service endpoint for Microsoft.Storage on the target subnet.
Traffic from SubnetA destined for Azure Storage is routed through the Microsoft backbone network instead of the public internet.
This is a prerequisite for adding a virtual network rule to the storage account firewall.
2
Add a virtual network rule to the firewall of corpdata2026 targeting SubnetA.
The storage account accepts traffic originating from SubnetA while continuing to deny all other public networks.
This permits VMs in SubnetA to access the storage account, while VMs in SubnetB remain blocked since SubnetB is not added to the virtual network rules.
3
Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account firewall.
The Azure Backup service can securely access the storage account resources to perform backup tasks.
Azure Backup is a trusted Microsoft service and requires this network exception to bypass the firewall when public access is restricted.

Key Concept

Azure Storage firewalls allow restricting access to specific virtual networks using Service Endpoints and allowing trusted Microsoft services via built-in exceptions.
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic