Examkin

Question

Difficulty: HardConfigure Storage Account Network Access

You need to secure network access to an Azure Storage account named `saoperations` from a virtual network named `VNet-Prod`. The storage account contains blob data. The security requirements are:

1. Public network access to `saoperations` must be disabled.
2. VMs in `VNet-Prod` must access `saoperations` using a private IP address.
3. VMs in `VNet-Prod` must resolve the storage account's fully qualified domain name (FQDN) to its private IP address.

In which sequence should you perform the configuration steps to minimize service disruption and ensure correct name resolution?

  1. 1Create a Private DNS Zone named `privatelink.blob.core.windows.net`.
  2. 2Link the Private DNS Zone `privatelink.blob.core.windows.net` to the virtual network `VNet-Prod`.
  3. 3Create a private endpoint in `VNet-Prod` targeting the `blob` sub-resource of `saoperations`.
  4. 4Configure a Private DNS zone group for the private endpoint targeting the DNS zone.
  5. 5Configure the firewall of `saoperations` to disable public network access.

Answer

The correct sequence of steps starts with creating the Private DNS Zone, followed by linking the zone to the virtual network. Next, the private endpoint is created, followed by configuring the Private DNS zone group. Finally, public network access to the storage account is disabled.
The correct sequence ensures that the DNS infrastructure and private connection are completely configured and linked to the virtual network before public access is disabled, preventing connection dropouts. Creating the Private DNS Zone first allows the subsequent virtual network link and zone group auto-registration to reference the zone. The zone group automatically updates the Private DNS Zone with the private endpoint's IP. Once the endpoint is functional, disabling public network access completes the lockdown.

Step-by-Step Solution

1
Create the Private DNS Zone.
A Private DNS Zone named `privatelink.blob.core.windows.net` is provisioned.
The Private DNS Zone acts as the authoritative source for the private endpoint IP addresses and must exist before linking or auto-registration can be configured.
2
Link the Private DNS Zone to `VNet-Prod`.
The Private DNS Zone is linked to the virtual network.
This link allows virtual machines inside the virtual network to perform DNS resolution against the zone.
3
Create the private endpoint.
A private endpoint is deployed in `VNet-Prod` with a private IP address mapped to the `blob` sub-resource of `saoperations`.
The private endpoint establishes private connectivity to the storage account.
4
Configure the Private DNS zone group.
The private IP address of the private endpoint is registered to the Private DNS Zone.
This automates the creation of the DNS A record mapping `saoperations.privatelink.blob.core.windows.net` to the private IP address.
5
Disable public network access on the storage account.
The storage account firewall is configured to block public network traffic.
This secures the storage account by ensuring that traffic is only allowed via the private endpoint, avoiding disruption by doing this after private connectivity is operational.

Key Concept

Azure Storage private endpoint configuration requires a specific sequence starting with Private DNS Zone creation, Virtual Network linking, Private Endpoint provisioning, Private DNS zone group integration, and finally disabling public network access to prevent service downtime.
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic