Your organization needs to migrate files from an on-premises server to a container named u… — Microsoft Azure Administrator (AZ-104)

Your organization needs to migrate files from an on-premises server to a container named uploads in an Azure Storage account named corpstore. The on-premises server connects to the internet via a public IP address of $203.0.113.15$ .

The firewall for the corpstore storage account is configured as follows:
- Allowed networks: 'Enabled from selected virtual networks and IP addresses'
- Allowed IP addresses: None
- Exception: 'Allow Azure services on the trusted services list to access this storage account' is selected.

You log in to the server, install AzCopy, and run the command `azcopy login` using an administrator account that has been assigned the 'Contributor' and 'Reader and Data Access' roles at the storage account level. When you run `azcopy sync "/data" "https://corpstore.blob.core.windows.net/uploads"`, the synchronization fails with network and authorization errors.

Which combination of actions will allow the synchronization to complete successfully using Microsoft Entra ID authentication?

Add $203.0.113.15$ to the allowed IP address ranges of the storage account firewall, and assign the Storage Blob Data Contributor role to the administrator account.Answer
B
Enable the trusted Microsoft services exception, and verify that the administrator account has the Contributor role.
C
Add $203.0.113.15$ to the allowed IP address ranges of the storage account firewall, and verify that the administrator account has the Contributor role.
D
Add $203.0.113.15$ to the allowed IP address ranges of the storage account firewall, and assign the Storage Blob Data Reader role to the administrator account.

Answer

Add the server's public IP address

203.0.113.15

to the storage account firewall allowed ranges, and assign the Storage Blob Data Contributor role to the administrator account.

The correct action requires resolving both the network block and the authorization failure. Adding the server's public IP address

203.0.113.15

to the allowed IP address ranges in the storage account firewall settings allows network traffic from the on-premises server. Assigning the Storage Blob Data Contributor role provides the data-plane write and read permissions required by the Entra ID-authenticated AzCopy session to sync files to the blob container.

Step-by-Step Solution

Analyze the network configuration.

The storage account firewall is configured to block all traffic except from specific IP addresses. Since the on-premises server has the public IP address

203.0.113.15

and it is not whitelisted, the traffic is blocked.

To allow the local server to connect to the storage account over the public internet, its public IP must be whitelisted.

Analyze the Entra ID authentication and RBAC roles.

The administrator is authenticated via `azcopy login` (Microsoft Entra ID) and has the Contributor and Reader and Data Access roles. Neither role grants data-plane permissions (e.g., Storage Blob Data Contributor or Storage Blob Data Owner) required to write blobs.

Microsoft Entra ID authentication for Azure Storage data-plane operations requires explicit data-plane RBAC roles, independent of control-plane roles.

Select the correct combination of changes.

Adding

203.0.113.15

to the allowed IP address ranges resolves the network block, and assigning Storage Blob Data Contributor resolves the authorization mismatch.

Both network access and data-plane authorization must be properly configured for the sync command to succeed.

Key Concept

Data plane authentication and network security configuration for Azure Storage data movement

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic