Examkin

Question

Difficulty: MediumConfigure Storage Account Network Access

An administrator is configuring network security for an Azure Storage account named dataops2026. The storage account's network access is currently restricted to 'Enabled from selected virtual networks and IP addresses'. The administrator must ensure that only virtual machines inside a subnet named AppSubnet of a virtual network named VNet-Core can access the storage account. In addition, Azure Backup must be able to back up the storage account's blobs. Which of the following configurations are required to meet these requirements? (Select two.)

  1. Enable the Microsoft.Storage service endpoint on AppSubnet.Answer
  2. Select the 'Allow trusted Microsoft services to access this storage account' bypass option on dataops2026.Answer
  3. C
    Assign the Storage Account Contributor role to the Azure Backup service principal.
  4. D
    Add the public IP addresses of the Azure Backup service to the firewall allowed IP list of dataops2026.

Answer

To allow access from the subnet and enable backups, you must enable the Microsoft.Storage service endpoint on the application subnet and select the option to allow trusted Microsoft services to access the storage account.
Enabling the Microsoft.Storage service endpoint on the application subnet allows the subnet's virtual machines to communicate securely with the storage account and registers the subnet identity with the storage firewall. Selecting the trusted Microsoft services exception allows Azure Backup to bypass the network-level restrictions and access the storage account.

Step-by-Step Solution

1
Enable the Microsoft.Storage service endpoint on AppSubnet within VNet-Core.
Allows traffic from the subnet to securely reach the storage account using Azure's private backbone network and exposes the subnet identity to the storage firewall.
Restricting access to a specific subnet requires the subnet to have the service endpoint enabled so the storage account firewall can validate the subnet resource ID.
2
Configure the storage account firewall settings to allow traffic from AppSubnet.
Limits network access to only the configured subnet and allowed IPs.
Ensures public network access is restricted to the designated subnet.
3
Enable the 'Allow trusted Microsoft services to access this storage account' bypass setting on dataops2026.
Enables Azure Backup to access the storage account blobs despite the firewall restrictions.
Azure Backup is a trusted Microsoft service and requires this network exception to perform backup tasks when public access is restricted.

Key Concept

Azure Storage network security rules require service endpoints on subnets to restrict access, and trusted service bypasses to allow backup and management services to function.
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic